Overview

overview

10

Static

static

Factura Se...df.exe

windows7_x64

10

Factura Se...df.exe

windows10_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    06-05-2021 15:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Factura Serfinanza_091060156_57614532_47411165355359140_4125802_77434958822958585231_35731076880_pdf.exe

  • Size

    1.8MB

  • MD5

    e13f7ded8bfc14808ca964c5dec10b9f

  • SHA1

    c5606c21b84a858ed7b54da2a7f17802fffcddb3

  • SHA256

    e8cac456b3e4a072d16142f0dd9f9b0500013cfefe7359e4293d4cff61f9eaf7

  • SHA512

    91d0cfb0e051c3ab5f8b97a5d8afb83476d825d7e87760a93220fd44cfd42c93b6b394341924521202988595e1a787586c087b614d8ab7df42563ccc2b490e7d

Score
10/10
remcospersistencerat

Malware Config

Extracted

Family

remcos

C2

databasepropersonombrecomercialideasearchwords.services:3521

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 25 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza_091060156_57614532_47411165355359140_4125802_77434958822958585231_35731076880_pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza_091060156_57614532_47411165355359140_4125802_77434958822958585231_35731076880_pdf.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:584
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:200
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:2344
    • C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza_091060156_57614532_47411165355359140_4125802_77434958822958585231_35731076880_pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Factura Serfinanza_091060156_57614532_47411165355359140_4125802_77434958822958585231_35731076880_pdf.exe"
      2⤵
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1252
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1244
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3768
          • C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
            C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2096
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c timeout 1
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2064
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                7⤵
                • Delays execution with timeout.exe
                PID:748
            • C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
              "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of SetWindowsHookEx
              PID:1136
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 1456
              6⤵
              • Program crash
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1428
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 584 -s 1492
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2140

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\install.vbs
    MD5

    a39af763b1c09ead3c98a6a615f377fe

    SHA1

    9bd3d39c89e47fe7072270ecc80b810103235c03

    SHA256

    a3930d7535eb768523ee52bbe69f13f857a0ae0f982d7bfc354d802f21010f8f

    SHA512

    3ed8e33ac95fd2536286b4afb2ed2a082bb5f98843478262b32263a14a5dbe0425de7b8d9662a5e482b207ebf8484ace8009ecd1881a6f6f8b0ccf3b0fdfe5da

    Download Submit
  • C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
    MD5

    e13f7ded8bfc14808ca964c5dec10b9f

    SHA1

    c5606c21b84a858ed7b54da2a7f17802fffcddb3

    SHA256

    e8cac456b3e4a072d16142f0dd9f9b0500013cfefe7359e4293d4cff61f9eaf7

    SHA512

    91d0cfb0e051c3ab5f8b97a5d8afb83476d825d7e87760a93220fd44cfd42c93b6b394341924521202988595e1a787586c087b614d8ab7df42563ccc2b490e7d

    Download Submit
  • C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
    MD5

    e13f7ded8bfc14808ca964c5dec10b9f

    SHA1

    c5606c21b84a858ed7b54da2a7f17802fffcddb3

    SHA256

    e8cac456b3e4a072d16142f0dd9f9b0500013cfefe7359e4293d4cff61f9eaf7

    SHA512

    91d0cfb0e051c3ab5f8b97a5d8afb83476d825d7e87760a93220fd44cfd42c93b6b394341924521202988595e1a787586c087b614d8ab7df42563ccc2b490e7d

    Download Submit
  • C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
    MD5

    e13f7ded8bfc14808ca964c5dec10b9f

    SHA1

    c5606c21b84a858ed7b54da2a7f17802fffcddb3

    SHA256

    e8cac456b3e4a072d16142f0dd9f9b0500013cfefe7359e4293d4cff61f9eaf7

    SHA512

    91d0cfb0e051c3ab5f8b97a5d8afb83476d825d7e87760a93220fd44cfd42c93b6b394341924521202988595e1a787586c087b614d8ab7df42563ccc2b490e7d

    Download Submit
  • memory/200-119-0x0000000000000000-mapping.dmp
    Download
  • memory/584-121-0x0000000006EB0000-0x0000000006EB1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/584-118-0x00000000046E0000-0x000000000471E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/584-114-0x0000000000120000-0x0000000000121000-memory.dmp
    Filesize

    4KB

    Download
  • memory/584-117-0x0000000004740000-0x0000000004741000-memory.dmp
    Filesize

    4KB

    Download
  • memory/584-116-0x0000000004C60000-0x0000000004C61000-memory.dmp
    Filesize

    4KB

    Download
  • memory/748-136-0x0000000000000000-mapping.dmp
    Download
  • memory/1136-142-0x0000000000400000-0x0000000000422000-memory.dmp
    Filesize

    136KB

    Download
  • memory/1136-140-0x0000000000413FA4-mapping.dmp
    Download
  • memory/1244-125-0x0000000000000000-mapping.dmp
    Download
  • memory/1252-124-0x0000000000400000-0x0000000000422000-memory.dmp
    Filesize

    136KB

    Download
  • memory/1252-123-0x0000000000413FA4-mapping.dmp
    Download
  • memory/1252-122-0x0000000000400000-0x0000000000422000-memory.dmp
    Filesize

    136KB

    Download
  • memory/2064-135-0x0000000000000000-mapping.dmp
    Download
  • memory/2096-128-0x0000000000000000-mapping.dmp
    Download
  • memory/2096-137-0x0000000005F20000-0x0000000005F21000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2344-120-0x0000000000000000-mapping.dmp
    Download
  • memory/3768-127-0x0000000000000000-mapping.dmp
    Download