Analysis
-
max time kernel
150s -
max time network
178s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:00
Static task
static1
Behavioral task
behavioral1
Sample
Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe
Resource
win10v2004-20220414-en
General
-
Target
Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe
-
Size
273KB
-
MD5
716d5468b4acda0549df7307b2db1500
-
SHA1
4c228a8b8d406e62ffe2827294c88d895a8663d4
-
SHA256
aa9608f32f753da933fc3d931a99fd1767b9970a5a95ac7ed01e11a51421f213
-
SHA512
beff5e1447b87d2792d6199bf9a464760761574f23a433962b18f2a967e9b84c953095cd77e846d29663653de50634758b9e08a79b9ed9653648dbe32343f174
Malware Config
Extracted
remcos
2.5.1 Pro
ZonaBancos1
recuperaciondecartera.website:6790
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
PXServiceNet.exe
-
copy_folder
System32
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
xlogs9.dat
-
keylog_flag
false
-
keylog_folder
Runtime5
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos-WMUCYW
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
MServices
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
PXServiceNet.exePXServiceNet.exepid process 1840 PXServiceNet.exe 852 PXServiceNet.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1236 cmd.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exePXServiceNet.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\MServices = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PXServiceNet.exe\"" Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\ PXServiceNet.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\MServices = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PXServiceNet.exe\"" PXServiceNet.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exePXServiceNet.exedescription pid process target process PID 1944 set thread context of 740 1944 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe PID 1840 set thread context of 852 1840 PXServiceNet.exe PXServiceNet.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exePXServiceNet.exepid process 1944 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe 1944 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe 1944 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe 1944 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe 1944 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe 1944 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe 1944 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe 1944 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe 1840 PXServiceNet.exe 1840 PXServiceNet.exe 1840 PXServiceNet.exe 1840 PXServiceNet.exe 1840 PXServiceNet.exe 1840 PXServiceNet.exe 1840 PXServiceNet.exe 1840 PXServiceNet.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exePXServiceNet.exedescription pid process Token: SeDebugPrivilege 1944 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Token: SeDebugPrivilege 1840 PXServiceNet.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
PXServiceNet.exepid process 852 PXServiceNet.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exeCobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exeWScript.execmd.exePXServiceNet.exedescription pid process target process PID 1944 wrote to memory of 740 1944 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe PID 1944 wrote to memory of 740 1944 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe PID 1944 wrote to memory of 740 1944 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe PID 1944 wrote to memory of 740 1944 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe PID 1944 wrote to memory of 740 1944 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe PID 1944 wrote to memory of 740 1944 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe PID 1944 wrote to memory of 740 1944 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe PID 1944 wrote to memory of 740 1944 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe PID 1944 wrote to memory of 740 1944 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe PID 1944 wrote to memory of 740 1944 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe PID 1944 wrote to memory of 740 1944 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe PID 740 wrote to memory of 1824 740 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe WScript.exe PID 740 wrote to memory of 1824 740 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe WScript.exe PID 740 wrote to memory of 1824 740 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe WScript.exe PID 740 wrote to memory of 1824 740 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe WScript.exe PID 1824 wrote to memory of 1236 1824 WScript.exe cmd.exe PID 1824 wrote to memory of 1236 1824 WScript.exe cmd.exe PID 1824 wrote to memory of 1236 1824 WScript.exe cmd.exe PID 1824 wrote to memory of 1236 1824 WScript.exe cmd.exe PID 1236 wrote to memory of 1840 1236 cmd.exe PXServiceNet.exe PID 1236 wrote to memory of 1840 1236 cmd.exe PXServiceNet.exe PID 1236 wrote to memory of 1840 1236 cmd.exe PXServiceNet.exe PID 1236 wrote to memory of 1840 1236 cmd.exe PXServiceNet.exe PID 1840 wrote to memory of 852 1840 PXServiceNet.exe PXServiceNet.exe PID 1840 wrote to memory of 852 1840 PXServiceNet.exe PXServiceNet.exe PID 1840 wrote to memory of 852 1840 PXServiceNet.exe PXServiceNet.exe PID 1840 wrote to memory of 852 1840 PXServiceNet.exe PXServiceNet.exe PID 1840 wrote to memory of 852 1840 PXServiceNet.exe PXServiceNet.exe PID 1840 wrote to memory of 852 1840 PXServiceNet.exe PXServiceNet.exe PID 1840 wrote to memory of 852 1840 PXServiceNet.exe PXServiceNet.exe PID 1840 wrote to memory of 852 1840 PXServiceNet.exe PXServiceNet.exe PID 1840 wrote to memory of 852 1840 PXServiceNet.exe PXServiceNet.exe PID 1840 wrote to memory of 852 1840 PXServiceNet.exe PXServiceNet.exe PID 1840 wrote to memory of 852 1840 PXServiceNet.exe PXServiceNet.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exeC:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exe"C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsFilesize
434B
MD5d33aedaade0c88a1a0e2ab0df13b0664
SHA1e044455e25cc9598045e24f79ddf7482f8f66765
SHA256a7636b433c56dfb0e833c5354352e4f88bc01701eb81895c0cedc645eb2ae85c
SHA512570f7d522896c053f96ad1d5c1da761468a66722cb2b09f914ae293312f69214b38b25767e90cfd36d5def0219c8b104757c08b56dc2a5b261e8d900344d8924
-
C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exeFilesize
273KB
MD5716d5468b4acda0549df7307b2db1500
SHA14c228a8b8d406e62ffe2827294c88d895a8663d4
SHA256aa9608f32f753da933fc3d931a99fd1767b9970a5a95ac7ed01e11a51421f213
SHA512beff5e1447b87d2792d6199bf9a464760761574f23a433962b18f2a967e9b84c953095cd77e846d29663653de50634758b9e08a79b9ed9653648dbe32343f174
-
C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exeFilesize
273KB
MD5716d5468b4acda0549df7307b2db1500
SHA14c228a8b8d406e62ffe2827294c88d895a8663d4
SHA256aa9608f32f753da933fc3d931a99fd1767b9970a5a95ac7ed01e11a51421f213
SHA512beff5e1447b87d2792d6199bf9a464760761574f23a433962b18f2a967e9b84c953095cd77e846d29663653de50634758b9e08a79b9ed9653648dbe32343f174
-
C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exeFilesize
273KB
MD5716d5468b4acda0549df7307b2db1500
SHA14c228a8b8d406e62ffe2827294c88d895a8663d4
SHA256aa9608f32f753da933fc3d931a99fd1767b9970a5a95ac7ed01e11a51421f213
SHA512beff5e1447b87d2792d6199bf9a464760761574f23a433962b18f2a967e9b84c953095cd77e846d29663653de50634758b9e08a79b9ed9653648dbe32343f174
-
\Users\Admin\AppData\Roaming\System32\PXServiceNet.exeFilesize
273KB
MD5716d5468b4acda0549df7307b2db1500
SHA14c228a8b8d406e62ffe2827294c88d895a8663d4
SHA256aa9608f32f753da933fc3d931a99fd1767b9970a5a95ac7ed01e11a51421f213
SHA512beff5e1447b87d2792d6199bf9a464760761574f23a433962b18f2a967e9b84c953095cd77e846d29663653de50634758b9e08a79b9ed9653648dbe32343f174
-
memory/740-62-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/740-59-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/740-60-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/740-64-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/740-65-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/740-66-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/740-68-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/740-69-0x0000000000413B74-mapping.dmp
-
memory/740-72-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/740-74-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/852-100-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/852-99-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/852-95-0x0000000000413B74-mapping.dmp
-
memory/1236-77-0x0000000000000000-mapping.dmp
-
memory/1824-73-0x0000000000000000-mapping.dmp
-
memory/1840-84-0x0000000000470000-0x0000000000486000-memory.dmpFilesize
88KB
-
memory/1840-80-0x0000000000000000-mapping.dmp
-
memory/1840-82-0x00000000012C0000-0x0000000001308000-memory.dmpFilesize
288KB
-
memory/1944-58-0x00000000004E0000-0x00000000004F6000-memory.dmpFilesize
88KB
-
memory/1944-56-0x0000000000890000-0x00000000008CC000-memory.dmpFilesize
240KB
-
memory/1944-55-0x0000000075EF1000-0x0000000075EF3000-memory.dmpFilesize
8KB
-
memory/1944-57-0x0000000000530000-0x0000000000548000-memory.dmpFilesize
96KB
-
memory/1944-54-0x0000000000CC0000-0x0000000000D08000-memory.dmpFilesize
288KB