Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-07-2021 10:56
Static task
static1
Behavioral task
behavioral1
Sample
Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe
Resource
win10v20210408
General
-
Target
Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe
-
Size
293KB
-
MD5
f3ec2ac5f8cd8dfb46f3a4d14acc4c84
-
SHA1
45cc84a525944b49a77bb693e2cc6f9e38e7d27c
-
SHA256
de2346e7683a4ed34d62a2954a38949335e6c1b27085a1cc82c08b0c6aec514e
-
SHA512
890a5881861259344ae46ac43edffaf86a203604175da1c85b6b5964c61b9dff7b68d7c5191689913ac9adb11332b7c085ac5ca317124bea309641e7a702cbc3
Malware Config
Extracted
remcos
3.1.5 Pro
AdminBancos
databasepropersonombrecomercialideasearchwords.services:2508
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
xlogs201.dat
-
keylog_flag
false
-
keylog_folder
Runtime2021
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
RemcosLEG-0OFGX3
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exeieinstal.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe ieinstal.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ieinstal.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run ieinstal.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\erelong = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tusindbenets\\FORFJAMSKETS.exe" ieinstal.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exeieinstal.exepid process 636 Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe 744 ieinstal.exe 744 ieinstal.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exedescription pid process target process PID 636 set thread context of 744 636 Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe ieinstal.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exepid process 636 Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe 636 Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exeieinstal.exepid process 636 Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe 744 ieinstal.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exeieinstal.execmd.exedescription pid process target process PID 636 wrote to memory of 2176 636 Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe ieinstal.exe PID 636 wrote to memory of 2176 636 Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe ieinstal.exe PID 636 wrote to memory of 2176 636 Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe ieinstal.exe PID 636 wrote to memory of 744 636 Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe ieinstal.exe PID 636 wrote to memory of 744 636 Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe ieinstal.exe PID 636 wrote to memory of 744 636 Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe ieinstal.exe PID 636 wrote to memory of 744 636 Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe ieinstal.exe PID 744 wrote to memory of 1648 744 ieinstal.exe cmd.exe PID 744 wrote to memory of 1648 744 ieinstal.exe cmd.exe PID 744 wrote to memory of 1648 744 ieinstal.exe cmd.exe PID 1648 wrote to memory of 2328 1648 cmd.exe reg.exe PID 1648 wrote to memory of 2328 1648 cmd.exe reg.exe PID 1648 wrote to memory of 2328 1648 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe"C:\Users\Admin\AppData\Local\Temp\Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe"1⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Users\Admin\AppData\Local\Temp\Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe"2⤵
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Users\Admin\AppData\Local\Temp\Serfinanza_Extracto_3925684864088446202605_15411665189244361977_577131188431184261981_8054548415905136416878.exe"2⤵
- Checks QEMU agent file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/636-122-0x0000000077C60000-0x0000000077DEE000-memory.dmpFilesize
1.6MB
-
memory/636-116-0x0000000002BB0000-0x0000000002BC6000-memory.dmpFilesize
88KB
-
memory/636-121-0x0000000077C60000-0x0000000077DEE000-memory.dmpFilesize
1.6MB
-
memory/636-119-0x00007FFBBC280000-0x00007FFBBC45B000-memory.dmpFilesize
1.9MB
-
memory/636-120-0x0000000077C60000-0x0000000077DEE000-memory.dmpFilesize
1.6MB
-
memory/744-118-0x00000000030A0000-mapping.dmp
-
memory/744-117-0x00000000030A0000-0x00000000031A0000-memory.dmpFilesize
1024KB
-
memory/744-124-0x0000000077C60000-0x0000000077DEE000-memory.dmpFilesize
1.6MB
-
memory/744-127-0x000000001EB00000-0x000000001EB01000-memory.dmpFilesize
4KB
-
memory/744-125-0x0000000077C60000-0x0000000077DEE000-memory.dmpFilesize
1.6MB
-
memory/744-123-0x00007FFBBC280000-0x00007FFBBC45B000-memory.dmpFilesize
1.9MB
-
memory/744-130-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/1648-128-0x0000000000000000-mapping.dmp
-
memory/2328-129-0x0000000000000000-mapping.dmp