Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 11:58
Static task
static1
Behavioral task
behavioral1
Sample
Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe
Resource
win10v2004-20220414-en
General
-
Target
Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe
-
Size
476KB
-
MD5
4b665d364bee62dc7c1f74e93b0d660b
-
SHA1
c22cb71c3c0ea98edaeaec8077988abc51296fcb
-
SHA256
417022af236bc97978cd14c5ffb8e5ced3392987a8b73ae3a5f1906367419abd
-
SHA512
e8e025fed9f4a633d65b9a4b8f9f23984e76ff35fcd73020d3e5f7f9df514c9c1c6161796569668a715a44d765c14effc51b8732a32e1b853c72a9f6b9c9d2b8
Malware Config
Extracted
remcos
2.5.1 Pro
ZonaBancos1
recuperaciondecartera.website:6790
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
PXServiceNet.exe
-
copy_folder
System32
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
xlogs9.dat
-
keylog_flag
false
-
keylog_folder
Runtime5
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos-WMUCYW
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
MServices
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
PXServiceNet.exePXServiceNet.exePXServiceNet.exepid process 1700 PXServiceNet.exe 4468 PXServiceNet.exe 1372 PXServiceNet.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation WScript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exePXServiceNet.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MServices = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PXServiceNet.exe\"" Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run\ PXServiceNet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MServices = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PXServiceNet.exe\"" PXServiceNet.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exePXServiceNet.exedescription pid process target process PID 1684 set thread context of 5000 1684 Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe PID 1700 set thread context of 1372 1700 PXServiceNet.exe PXServiceNet.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exePXServiceNet.exepid process 1684 Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe 1684 Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe 1684 Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe 1684 Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe 1684 Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe 1684 Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe 1684 Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe 1684 Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe 1700 PXServiceNet.exe 1700 PXServiceNet.exe 1700 PXServiceNet.exe 1700 PXServiceNet.exe 1700 PXServiceNet.exe 1700 PXServiceNet.exe 1700 PXServiceNet.exe 1700 PXServiceNet.exe 1700 PXServiceNet.exe 1700 PXServiceNet.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exePXServiceNet.exedescription pid process Token: SeDebugPrivilege 1684 Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe Token: SeDebugPrivilege 1700 PXServiceNet.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
PXServiceNet.exepid process 1372 PXServiceNet.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exeCobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exeWScript.execmd.exePXServiceNet.exedescription pid process target process PID 1684 wrote to memory of 5000 1684 Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe PID 1684 wrote to memory of 5000 1684 Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe PID 1684 wrote to memory of 5000 1684 Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe PID 1684 wrote to memory of 5000 1684 Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe PID 1684 wrote to memory of 5000 1684 Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe PID 1684 wrote to memory of 5000 1684 Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe PID 1684 wrote to memory of 5000 1684 Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe PID 1684 wrote to memory of 5000 1684 Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe PID 1684 wrote to memory of 5000 1684 Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe PID 1684 wrote to memory of 5000 1684 Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe PID 5000 wrote to memory of 4892 5000 Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe WScript.exe PID 5000 wrote to memory of 4892 5000 Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe WScript.exe PID 5000 wrote to memory of 4892 5000 Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe WScript.exe PID 4892 wrote to memory of 2164 4892 WScript.exe cmd.exe PID 4892 wrote to memory of 2164 4892 WScript.exe cmd.exe PID 4892 wrote to memory of 2164 4892 WScript.exe cmd.exe PID 2164 wrote to memory of 1700 2164 cmd.exe PXServiceNet.exe PID 2164 wrote to memory of 1700 2164 cmd.exe PXServiceNet.exe PID 2164 wrote to memory of 1700 2164 cmd.exe PXServiceNet.exe PID 1700 wrote to memory of 4468 1700 PXServiceNet.exe PXServiceNet.exe PID 1700 wrote to memory of 4468 1700 PXServiceNet.exe PXServiceNet.exe PID 1700 wrote to memory of 4468 1700 PXServiceNet.exe PXServiceNet.exe PID 1700 wrote to memory of 1372 1700 PXServiceNet.exe PXServiceNet.exe PID 1700 wrote to memory of 1372 1700 PXServiceNet.exe PXServiceNet.exe PID 1700 wrote to memory of 1372 1700 PXServiceNet.exe PXServiceNet.exe PID 1700 wrote to memory of 1372 1700 PXServiceNet.exe PXServiceNet.exe PID 1700 wrote to memory of 1372 1700 PXServiceNet.exe PXServiceNet.exe PID 1700 wrote to memory of 1372 1700 PXServiceNet.exe PXServiceNet.exe PID 1700 wrote to memory of 1372 1700 PXServiceNet.exe PXServiceNet.exe PID 1700 wrote to memory of 1372 1700 PXServiceNet.exe PXServiceNet.exe PID 1700 wrote to memory of 1372 1700 PXServiceNet.exe PXServiceNet.exe PID 1700 wrote to memory of 1372 1700 PXServiceNet.exe PXServiceNet.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Cobro Juridico_02734551495093835_5034123_466184020757220845_830988_48109555117189306190_39876829_70731030598_pdf.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exeC:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exe"C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exe"C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsFilesize
434B
MD5d33aedaade0c88a1a0e2ab0df13b0664
SHA1e044455e25cc9598045e24f79ddf7482f8f66765
SHA256a7636b433c56dfb0e833c5354352e4f88bc01701eb81895c0cedc645eb2ae85c
SHA512570f7d522896c053f96ad1d5c1da761468a66722cb2b09f914ae293312f69214b38b25767e90cfd36d5def0219c8b104757c08b56dc2a5b261e8d900344d8924
-
C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exeFilesize
476KB
MD54b665d364bee62dc7c1f74e93b0d660b
SHA1c22cb71c3c0ea98edaeaec8077988abc51296fcb
SHA256417022af236bc97978cd14c5ffb8e5ced3392987a8b73ae3a5f1906367419abd
SHA512e8e025fed9f4a633d65b9a4b8f9f23984e76ff35fcd73020d3e5f7f9df514c9c1c6161796569668a715a44d765c14effc51b8732a32e1b853c72a9f6b9c9d2b8
-
C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exeFilesize
476KB
MD54b665d364bee62dc7c1f74e93b0d660b
SHA1c22cb71c3c0ea98edaeaec8077988abc51296fcb
SHA256417022af236bc97978cd14c5ffb8e5ced3392987a8b73ae3a5f1906367419abd
SHA512e8e025fed9f4a633d65b9a4b8f9f23984e76ff35fcd73020d3e5f7f9df514c9c1c6161796569668a715a44d765c14effc51b8732a32e1b853c72a9f6b9c9d2b8
-
C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exeFilesize
476KB
MD54b665d364bee62dc7c1f74e93b0d660b
SHA1c22cb71c3c0ea98edaeaec8077988abc51296fcb
SHA256417022af236bc97978cd14c5ffb8e5ced3392987a8b73ae3a5f1906367419abd
SHA512e8e025fed9f4a633d65b9a4b8f9f23984e76ff35fcd73020d3e5f7f9df514c9c1c6161796569668a715a44d765c14effc51b8732a32e1b853c72a9f6b9c9d2b8
-
C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exeFilesize
476KB
MD54b665d364bee62dc7c1f74e93b0d660b
SHA1c22cb71c3c0ea98edaeaec8077988abc51296fcb
SHA256417022af236bc97978cd14c5ffb8e5ced3392987a8b73ae3a5f1906367419abd
SHA512e8e025fed9f4a633d65b9a4b8f9f23984e76ff35fcd73020d3e5f7f9df514c9c1c6161796569668a715a44d765c14effc51b8732a32e1b853c72a9f6b9c9d2b8
-
memory/1372-152-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1372-153-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1372-148-0x0000000000000000-mapping.dmp
-
memory/1684-130-0x0000000000D90000-0x0000000000E0E000-memory.dmpFilesize
504KB
-
memory/1684-134-0x0000000006320000-0x00000000063BC000-memory.dmpFilesize
624KB
-
memory/1684-133-0x0000000005840000-0x000000000584A000-memory.dmpFilesize
40KB
-
memory/1684-132-0x0000000005860000-0x00000000058F2000-memory.dmpFilesize
584KB
-
memory/1684-131-0x0000000005D70000-0x0000000006314000-memory.dmpFilesize
5.6MB
-
memory/1700-143-0x0000000000000000-mapping.dmp
-
memory/2164-142-0x0000000000000000-mapping.dmp
-
memory/4468-146-0x0000000000000000-mapping.dmp
-
memory/4892-139-0x0000000000000000-mapping.dmp
-
memory/5000-140-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/5000-138-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/5000-136-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/5000-135-0x0000000000000000-mapping.dmp