Analysis
- max time kernel
123s - max time network
124s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
13/11/2021, 18:13
General
- Target Remix v1.4 Loader.exe
- Size 12.8MB
- Sample211113-wtq8ssccfk
- SHA256 8dc5d35e7f0a75f8a864ce2a569ac1cc3825521bcd269e5bc2ee7e6ce40c3fae
Malware Config
Signatures
- Drops startup file 2 IoCs
- Loads dropped DLL 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Remix v1.4 Loader.exe"C:\Users\Admin\AppData\Local\Temp\Remix v1.4 Loader.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Remix v1.4 Loader.exe"2⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2248-133-0x0000000000570000-0x0000000000571000-memory.dmp
memory/2248-135-0x0000000002940000-0x0000000002950000-memory.dmp
memory/2248-123-0x00000000028E0000-0x00000000028F0000-memory.dmp
memory/2248-122-0x00000000028D0000-0x00000000028E0000-memory.dmp
memory/2248-124-0x00000000028F0000-0x0000000002900000-memory.dmp
memory/2248-125-0x0000000002900000-0x0000000002910000-memory.dmp
memory/2248-126-0x0000000000570000-0x0000000000571000-memory.dmp
memory/2248-127-0x0000000002910000-0x0000000002920000-memory.dmp
memory/2248-130-0x0000000002920000-0x0000000002930000-memory.dmp
memory/2248-131-0x0000000002930000-0x0000000002940000-memory.dmp
memory/2248-118-0x0000000000570000-0x0000000000571000-memory.dmp
memory/2248-136-0x0000000002950000-0x0000000002960000-memory.dmp
memory/2248-119-0x0000000000570000-0x0000000000571000-memory.dmp
memory/2248-137-0x0000000002960000-0x0000000002970000-memory.dmp
memory/2248-117-0x0000000002660000-0x00000000028D0000-memory.dmp
memory/2248-143-0x0000000002980000-0x0000000002990000-memory.dmp
memory/2248-142-0x0000000002970000-0x0000000002980000-memory.dmp
memory/2248-144-0x0000000002990000-0x00000000029A0000-memory.dmp
memory/2248-145-0x00000000029A0000-0x00000000029B0000-memory.dmp
memory/2248-146-0x00000000029F0000-0x0000000002A00000-memory.dmp
memory/2248-147-0x00000000029B0000-0x00000000029C0000-memory.dmp
memory/2248-148-0x00000000029C0000-0x00000000029D0000-memory.dmp
memory/2248-149-0x00000000029D0000-0x00000000029E0000-memory.dmp
memory/2248-150-0x00000000029E0000-0x00000000029F0000-memory.dmp
memory/2248-116-0x0000000002660000-0x00000000028D0000-memory.dmp
memory/2248-153-0x0000000002A00000-0x0000000002A10000-memory.dmp
memory/2248-154-0x0000000000570000-0x0000000000571000-memory.dmp