Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
08-05-2021 06:41
Static task
static1
Behavioral task
behavioral1
Sample
Contract_Documents_pdf.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Contract_Documents_pdf.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
Contract_Documents_pdf.exe
-
Size
719KB
-
MD5
6e6d28191079ca5c04b0eab5b98cd076
-
SHA1
83486f15158b67bf5c811cbfcd81f3aae42fcbcf
-
SHA256
a0bb5a244b144a8e10087fd70a04580c3bb8c4c8add7da671a06f10020473004
-
SHA512
3c4baa6d72afd5051e9f009084343ff1308ef76f8f15db00bb69ae6082c3dd96a0c2e129bbfd21199a9f76e5116166b429d9043d25ac12481b69107597fcee7a
Score
10/10
Malware Config
Extracted
Family
remcos
C2
abujafirms1.duckdns.org:12000
194.5.98.203:1988
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Contract_Documents_pdf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Jrtlwe = "C:\\Users\\Public\\ewltrJ.url" Contract_Documents_pdf.exe