Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:00
Static task
static1
Behavioral task
behavioral1
Sample
Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe
Resource
win10v2004-20220414-en
General
-
Target
Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe
-
Size
273KB
-
MD5
716d5468b4acda0549df7307b2db1500
-
SHA1
4c228a8b8d406e62ffe2827294c88d895a8663d4
-
SHA256
aa9608f32f753da933fc3d931a99fd1767b9970a5a95ac7ed01e11a51421f213
-
SHA512
beff5e1447b87d2792d6199bf9a464760761574f23a433962b18f2a967e9b84c953095cd77e846d29663653de50634758b9e08a79b9ed9653648dbe32343f174
Malware Config
Extracted
remcos
2.5.1 Pro
ZonaBancos1
recuperaciondecartera.website:6790
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
PXServiceNet.exe
-
copy_folder
System32
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
xlogs9.dat
-
keylog_flag
false
-
keylog_folder
Runtime5
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos-WMUCYW
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
MServices
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
PXServiceNet.exePXServiceNet.exePXServiceNet.exepid process 5044 PXServiceNet.exe 4428 PXServiceNet.exe 2156 PXServiceNet.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation WScript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exePXServiceNet.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MServices = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PXServiceNet.exe\"" Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run\ PXServiceNet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MServices = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\PXServiceNet.exe\"" PXServiceNet.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exePXServiceNet.exedescription pid process target process PID 2160 set thread context of 4324 2160 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe PID 5044 set thread context of 2156 5044 PXServiceNet.exe PXServiceNet.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exePXServiceNet.exepid process 2160 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe 2160 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe 2160 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe 2160 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe 2160 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe 2160 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe 2160 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe 2160 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe 5044 PXServiceNet.exe 5044 PXServiceNet.exe 5044 PXServiceNet.exe 5044 PXServiceNet.exe 5044 PXServiceNet.exe 5044 PXServiceNet.exe 5044 PXServiceNet.exe 5044 PXServiceNet.exe 5044 PXServiceNet.exe 5044 PXServiceNet.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exePXServiceNet.exedescription pid process Token: SeDebugPrivilege 2160 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Token: SeDebugPrivilege 5044 PXServiceNet.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
PXServiceNet.exepid process 2156 PXServiceNet.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exeCobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exeWScript.execmd.exePXServiceNet.exedescription pid process target process PID 2160 wrote to memory of 4324 2160 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe PID 2160 wrote to memory of 4324 2160 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe PID 2160 wrote to memory of 4324 2160 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe PID 2160 wrote to memory of 4324 2160 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe PID 2160 wrote to memory of 4324 2160 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe PID 2160 wrote to memory of 4324 2160 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe PID 2160 wrote to memory of 4324 2160 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe PID 2160 wrote to memory of 4324 2160 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe PID 2160 wrote to memory of 4324 2160 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe PID 2160 wrote to memory of 4324 2160 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe PID 4324 wrote to memory of 3796 4324 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe WScript.exe PID 4324 wrote to memory of 3796 4324 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe WScript.exe PID 4324 wrote to memory of 3796 4324 Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe WScript.exe PID 3796 wrote to memory of 4908 3796 WScript.exe cmd.exe PID 3796 wrote to memory of 4908 3796 WScript.exe cmd.exe PID 3796 wrote to memory of 4908 3796 WScript.exe cmd.exe PID 4908 wrote to memory of 5044 4908 cmd.exe PXServiceNet.exe PID 4908 wrote to memory of 5044 4908 cmd.exe PXServiceNet.exe PID 4908 wrote to memory of 5044 4908 cmd.exe PXServiceNet.exe PID 5044 wrote to memory of 4428 5044 PXServiceNet.exe PXServiceNet.exe PID 5044 wrote to memory of 4428 5044 PXServiceNet.exe PXServiceNet.exe PID 5044 wrote to memory of 4428 5044 PXServiceNet.exe PXServiceNet.exe PID 5044 wrote to memory of 2156 5044 PXServiceNet.exe PXServiceNet.exe PID 5044 wrote to memory of 2156 5044 PXServiceNet.exe PXServiceNet.exe PID 5044 wrote to memory of 2156 5044 PXServiceNet.exe PXServiceNet.exe PID 5044 wrote to memory of 2156 5044 PXServiceNet.exe PXServiceNet.exe PID 5044 wrote to memory of 2156 5044 PXServiceNet.exe PXServiceNet.exe PID 5044 wrote to memory of 2156 5044 PXServiceNet.exe PXServiceNet.exe PID 5044 wrote to memory of 2156 5044 PXServiceNet.exe PXServiceNet.exe PID 5044 wrote to memory of 2156 5044 PXServiceNet.exe PXServiceNet.exe PID 5044 wrote to memory of 2156 5044 PXServiceNet.exe PXServiceNet.exe PID 5044 wrote to memory of 2156 5044 PXServiceNet.exe PXServiceNet.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Cobro Juridico_0269238974920802_5210818_018214297558997881904018_759752_5835240459117026008_2344621_118955780952_pdf.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exeC:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exe"C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exe"C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsFilesize
434B
MD5d33aedaade0c88a1a0e2ab0df13b0664
SHA1e044455e25cc9598045e24f79ddf7482f8f66765
SHA256a7636b433c56dfb0e833c5354352e4f88bc01701eb81895c0cedc645eb2ae85c
SHA512570f7d522896c053f96ad1d5c1da761468a66722cb2b09f914ae293312f69214b38b25767e90cfd36d5def0219c8b104757c08b56dc2a5b261e8d900344d8924
-
C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exeFilesize
273KB
MD5716d5468b4acda0549df7307b2db1500
SHA14c228a8b8d406e62ffe2827294c88d895a8663d4
SHA256aa9608f32f753da933fc3d931a99fd1767b9970a5a95ac7ed01e11a51421f213
SHA512beff5e1447b87d2792d6199bf9a464760761574f23a433962b18f2a967e9b84c953095cd77e846d29663653de50634758b9e08a79b9ed9653648dbe32343f174
-
C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exeFilesize
273KB
MD5716d5468b4acda0549df7307b2db1500
SHA14c228a8b8d406e62ffe2827294c88d895a8663d4
SHA256aa9608f32f753da933fc3d931a99fd1767b9970a5a95ac7ed01e11a51421f213
SHA512beff5e1447b87d2792d6199bf9a464760761574f23a433962b18f2a967e9b84c953095cd77e846d29663653de50634758b9e08a79b9ed9653648dbe32343f174
-
C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exeFilesize
273KB
MD5716d5468b4acda0549df7307b2db1500
SHA14c228a8b8d406e62ffe2827294c88d895a8663d4
SHA256aa9608f32f753da933fc3d931a99fd1767b9970a5a95ac7ed01e11a51421f213
SHA512beff5e1447b87d2792d6199bf9a464760761574f23a433962b18f2a967e9b84c953095cd77e846d29663653de50634758b9e08a79b9ed9653648dbe32343f174
-
C:\Users\Admin\AppData\Roaming\System32\PXServiceNet.exeFilesize
273KB
MD5716d5468b4acda0549df7307b2db1500
SHA14c228a8b8d406e62ffe2827294c88d895a8663d4
SHA256aa9608f32f753da933fc3d931a99fd1767b9970a5a95ac7ed01e11a51421f213
SHA512beff5e1447b87d2792d6199bf9a464760761574f23a433962b18f2a967e9b84c953095cd77e846d29663653de50634758b9e08a79b9ed9653648dbe32343f174
-
memory/2156-151-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2156-152-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2156-147-0x0000000000000000-mapping.dmp
-
memory/2160-130-0x0000000000810000-0x0000000000858000-memory.dmpFilesize
288KB
-
memory/2160-133-0x0000000005670000-0x0000000005702000-memory.dmpFilesize
584KB
-
memory/2160-132-0x0000000005980000-0x0000000005F24000-memory.dmpFilesize
5.6MB
-
memory/2160-131-0x0000000005330000-0x00000000053CC000-memory.dmpFilesize
624KB
-
memory/3796-139-0x0000000000000000-mapping.dmp
-
memory/4324-135-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4324-138-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4324-137-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4324-134-0x0000000000000000-mapping.dmp
-
memory/4428-145-0x0000000000000000-mapping.dmp
-
memory/4908-141-0x0000000000000000-mapping.dmp
-
memory/5044-142-0x0000000000000000-mapping.dmp