Analysis
-
max time kernel
313s -
max time network
320s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
30-08-2021 06:38
Static task
static1
Behavioral task
behavioral1
Sample
Documento de carta de porte de Dhl,pdf.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Documento de carta de porte de Dhl,pdf.exe
Resource
win10v20210408
General
-
Target
Documento de carta de porte de Dhl,pdf.exe
-
Size
684KB
-
MD5
757cc6207682ec829c36a9e62fedc1d8
-
SHA1
8460c24b5d1ee1873265beb324e83e43d7f56816
-
SHA256
c1dfc207e54b30fc1686efaa9037af9aa07f47fbfb0beba70493e9fb383b4d8e
-
SHA512
5b817219982699a53a80a2f422738ea2c359a9db24f8ad4f20b5bad9eee32bb3dbe7de77eb750b1ce84d7d9b4b5c36168236f8a810bd0228971f6f0a9dfeb70b
Malware Config
Extracted
remcos
Global_New
godisgood247.duckdns.org:6397
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-FP4JCG
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Documento de carta de porte de Dhl,pdf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pbcqydy = "C:\\Users\\Public\\Libraries\\ydyqcbP.url" Documento de carta de porte de Dhl,pdf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Documento de carta de porte de Dhl,pdf.exedescription pid process target process PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe PID 908 wrote to memory of 3216 908 Documento de carta de porte de Dhl,pdf.exe Documento de carta de porte de Dhl,pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Documento de carta de porte de Dhl,pdf.exe"C:\Users\Admin\AppData\Local\Temp\Documento de carta de porte de Dhl,pdf.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Documento de carta de porte de Dhl,pdf.exe"C:\Users\Admin\AppData\Local\Temp\Documento de carta de porte de Dhl,pdf.exe"2⤵
- Adds Run key to start application
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/908-114-0x0000000000510000-0x000000000065A000-memory.dmpFilesize
1.3MB
-
memory/908-117-0x0000000010410000-0x000000001042B000-memory.dmpFilesize
108KB
-
memory/2988-122-0x0000000000000000-mapping.dmp
-
memory/2988-124-0x0000000000970000-0x0000000000971000-memory.dmpFilesize
4KB
-
memory/2988-123-0x0000000000910000-0x0000000000911000-memory.dmpFilesize
4KB
-
memory/2988-125-0x0000000010590000-0x000000001060D000-memory.dmpFilesize
500KB
-
memory/2988-126-0x0000000000850000-0x0000000000851000-memory.dmpFilesize
4KB
-
memory/2988-127-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/3216-116-0x0000000000000000-mapping.dmp
-
memory/3216-120-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/3216-121-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB