Analysis
-
max time kernel
140s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
08-05-2021 06:41
Static task
static1
Behavioral task
behavioral1
Sample
Contract_Documents_pdf.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Contract_Documents_pdf.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
Contract_Documents_pdf.exe
-
Size
719KB
-
MD5
6e6d28191079ca5c04b0eab5b98cd076
-
SHA1
83486f15158b67bf5c811cbfcd81f3aae42fcbcf
-
SHA256
a0bb5a244b144a8e10087fd70a04580c3bb8c4c8add7da671a06f10020473004
-
SHA512
3c4baa6d72afd5051e9f009084343ff1308ef76f8f15db00bb69ae6082c3dd96a0c2e129bbfd21199a9f76e5116166b429d9043d25ac12481b69107597fcee7a
Score
10/10
Malware Config
Extracted
Family
remcos
C2
abujafirms1.duckdns.org:12000
194.5.98.203:1988
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Contract_Documents_pdf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Jrtlwe = "C:\\Users\\Public\\ewltrJ.url" Contract_Documents_pdf.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1348-59-0x00000000762C1000-0x00000000762C3000-memory.dmpFilesize
8KB
-
memory/1348-60-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1348-61-0x0000000004C71000-0x0000000004CE9000-memory.dmpFilesize
480KB
-
memory/1348-62-0x0000000004CF0000-0x0000000004D68000-memory.dmpFilesize
480KB