Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    09-07-2020 00:36

General

  • Target

    remcos.exe

  • Size

    649KB

  • MD5

    c088802b03e3bc1ef0082f268847a5f7

  • SHA1

    28fd21058e88cd0e77cc9da119c7b7ecd582e2ac

  • SHA256

    4444f1da7f9b30eb4fb593b9492e42745332402980e118b6a0431c7d1f5670ce

  • SHA512

    6f296335284aa8337a60df52ffae7f87eb29502cea0ab050e2429ad841f79cd757a3e75a75cfb32463458d646d92ead9476c99fa4d058113be02b903b99e0d6a

Score
8/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 530 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run entry to start application 2 TTPs 1 IoCs
  • Modifies registry key 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs

Processes

  • C:\Users\Admin\AppData\Local\Temp\remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\remcos.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Adds Run entry to start application
    PID:3176
    • C:\Windows\SysWOW64\TapiUnattend.exe
      "C:\Windows\System32\TapiUnattend.exe"
      2⤵
        PID:1880
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Public\Natso.bat
          3⤵
            PID:1788
            • C:\Windows\SysWOW64\reg.exe
              reg delete hkcu\Environment /v windir /f
              4⤵
              • Modifies registry key
              PID:408
            • C:\Windows\SysWOW64\reg.exe
              reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "
              4⤵
              • Modifies registry key
              PID:4108
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
              4⤵
                PID:4136
              • C:\Windows\SysWOW64\reg.exe
                reg delete hkcu\Environment /v windir /f
                4⤵
                • Modifies registry key
                PID:4216
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Public\Runex.bat
              3⤵
                PID:4156
                • C:\Windows \System32\fodhelper.exe
                  "C:\Windows \System32\fodhelper.exe"
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:4268
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\Users\Public\x.bat
                    5⤵
                      PID:4304
              • C:\Program Files (x86)\internet explorer\ieinstal.exe
                "C:\Program Files (x86)\internet explorer\ieinstal.exe"
                2⤵
                  PID:1772

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Public\Natso.bat

              • C:\Users\Public\Runex.bat

              • C:\Users\Public\fodhelper.exe

              • C:\Users\Public\propsys.dll

              • C:\Windows \System32\PROPSYS.dll

              • C:\Windows \System32\fodhelper.exe

              • \Windows \System32\propsys.dll

              • memory/408-128-0x0000000000000000-mapping.dmp

              • memory/1772-129-0x0000000000000000-mapping.dmp

              • memory/1772-136-0x0000000000000000-mapping.dmp

              • memory/1772-134-0x0000000000000000-mapping.dmp

              • memory/1772-131-0x0000000000000000-mapping.dmp

              • memory/1788-126-0x0000000000000000-mapping.dmp

              • memory/1880-68-0x0000000000000000-mapping.dmp

              • memory/1880-34-0x0000000000000000-mapping.dmp

              • memory/1880-11-0x0000000000000000-mapping.dmp

              • memory/1880-12-0x0000000000000000-mapping.dmp

              • memory/1880-13-0x0000000000000000-mapping.dmp

              • memory/1880-14-0x0000000000000000-mapping.dmp

              • memory/1880-15-0x0000000000000000-mapping.dmp

              • memory/1880-16-0x0000000000000000-mapping.dmp

              • memory/1880-17-0x0000000000000000-mapping.dmp

              • memory/1880-18-0x0000000000000000-mapping.dmp

              • memory/1880-19-0x0000000000000000-mapping.dmp

              • memory/1880-20-0x0000000000000000-mapping.dmp

              • memory/1880-21-0x0000000000000000-mapping.dmp

              • memory/1880-75-0x0000000000000000-mapping.dmp

              • memory/1880-23-0x0000000000000000-mapping.dmp

              • memory/1880-24-0x0000000000000000-mapping.dmp

              • memory/1880-25-0x0000000000000000-mapping.dmp

              • memory/1880-26-0x0000000000000000-mapping.dmp

              • memory/1880-27-0x0000000000000000-mapping.dmp

              • memory/1880-28-0x0000000000000000-mapping.dmp

              • memory/1880-29-0x0000000000000000-mapping.dmp

              • memory/1880-30-0x0000000000000000-mapping.dmp

              • memory/1880-31-0x0000000000000000-mapping.dmp

              • memory/1880-32-0x0000000000000000-mapping.dmp

              • memory/1880-33-0x0000000000000000-mapping.dmp

              • memory/1880-76-0x0000000000000000-mapping.dmp

              • memory/1880-35-0x0000000000000000-mapping.dmp

              • memory/1880-36-0x0000000000000000-mapping.dmp

              • memory/1880-37-0x0000000000000000-mapping.dmp

              • memory/1880-38-0x0000000000000000-mapping.dmp

              • memory/1880-39-0x0000000000000000-mapping.dmp

              • memory/1880-40-0x0000000000000000-mapping.dmp

              • memory/1880-41-0x0000000000000000-mapping.dmp

              • memory/1880-77-0x0000000000000000-mapping.dmp

              • memory/1880-43-0x0000000000000000-mapping.dmp

              • memory/1880-44-0x0000000000000000-mapping.dmp

              • memory/1880-45-0x0000000000000000-mapping.dmp

              • memory/1880-46-0x0000000000000000-mapping.dmp

              • memory/1880-47-0x0000000000000000-mapping.dmp

              • memory/1880-48-0x0000000000000000-mapping.dmp

              • memory/1880-49-0x0000000000000000-mapping.dmp

              • memory/1880-50-0x0000000000000000-mapping.dmp

              • memory/1880-51-0x0000000000000000-mapping.dmp

              • memory/1880-52-0x0000000000000000-mapping.dmp

              • memory/1880-53-0x0000000000000000-mapping.dmp

              • memory/1880-54-0x0000000000000000-mapping.dmp

              • memory/1880-55-0x0000000000000000-mapping.dmp

              • memory/1880-56-0x0000000000000000-mapping.dmp

              • memory/1880-57-0x0000000000000000-mapping.dmp

              • memory/1880-58-0x0000000000000000-mapping.dmp

              • memory/1880-59-0x0000000000000000-mapping.dmp

              • memory/1880-60-0x0000000000000000-mapping.dmp

              • memory/1880-61-0x0000000000000000-mapping.dmp

              • memory/1880-62-0x0000000000000000-mapping.dmp

              • memory/1880-63-0x0000000000000000-mapping.dmp

              • memory/1880-64-0x0000000000000000-mapping.dmp

              • memory/1880-65-0x0000000000000000-mapping.dmp

              • memory/1880-66-0x0000000000000000-mapping.dmp

              • memory/1880-67-0x0000000000000000-mapping.dmp

              • memory/1880-9-0x0000000000000000-mapping.dmp

              • memory/1880-69-0x0000000000000000-mapping.dmp

              • memory/1880-70-0x0000000000000000-mapping.dmp

              • memory/1880-71-0x0000000000000000-mapping.dmp

              • memory/1880-72-0x0000000000000000-mapping.dmp

              • memory/1880-73-0x0000000000000000-mapping.dmp

              • memory/1880-74-0x0000000000000000-mapping.dmp

              • memory/1880-22-0x0000000000000000-mapping.dmp

              • memory/1880-10-0x0000000000000000-mapping.dmp

              • memory/1880-42-0x0000000000000000-mapping.dmp

              • memory/1880-78-0x0000000000000000-mapping.dmp

              • memory/1880-79-0x0000000000000000-mapping.dmp

              • memory/1880-80-0x0000000000000000-mapping.dmp

              • memory/1880-81-0x0000000000000000-mapping.dmp

              • memory/1880-82-0x0000000000000000-mapping.dmp

              • memory/1880-83-0x0000000000000000-mapping.dmp

              • memory/1880-84-0x0000000000000000-mapping.dmp

              • memory/1880-85-0x0000000000000000-mapping.dmp

              • memory/1880-86-0x0000000000000000-mapping.dmp

              • memory/1880-87-0x0000000000000000-mapping.dmp

              • memory/1880-88-0x0000000000000000-mapping.dmp

              • memory/1880-89-0x0000000000000000-mapping.dmp

              • memory/1880-90-0x0000000000000000-mapping.dmp

              • memory/1880-91-0x0000000000000000-mapping.dmp

              • memory/1880-92-0x0000000000000000-mapping.dmp

              • memory/1880-93-0x0000000000000000-mapping.dmp

              • memory/1880-94-0x0000000000000000-mapping.dmp

              • memory/1880-95-0x0000000000000000-mapping.dmp

              • memory/1880-96-0x0000000000000000-mapping.dmp

              • memory/1880-97-0x0000000000000000-mapping.dmp

              • memory/1880-98-0x0000000000000000-mapping.dmp

              • memory/1880-99-0x0000000000000000-mapping.dmp

              • memory/1880-100-0x0000000000000000-mapping.dmp

              • memory/1880-101-0x0000000000000000-mapping.dmp

              • memory/1880-102-0x0000000000000000-mapping.dmp

              • memory/1880-103-0x0000000000000000-mapping.dmp

              • memory/1880-104-0x0000000000000000-mapping.dmp

              • memory/1880-105-0x0000000000000000-mapping.dmp

              • memory/1880-106-0x0000000000000000-mapping.dmp

              • memory/1880-107-0x0000000000000000-mapping.dmp

              • memory/1880-108-0x0000000000000000-mapping.dmp

              • memory/1880-109-0x0000000000000000-mapping.dmp

              • memory/1880-110-0x0000000000000000-mapping.dmp

              • memory/1880-111-0x0000000000000000-mapping.dmp

              • memory/1880-112-0x0000000000000000-mapping.dmp

              • memory/1880-113-0x0000000000000000-mapping.dmp

              • memory/1880-114-0x0000000000000000-mapping.dmp

              • memory/1880-115-0x0000000000000000-mapping.dmp

              • memory/1880-116-0x0000000000000000-mapping.dmp

              • memory/1880-117-0x0000000000000000-mapping.dmp

              • memory/1880-118-0x0000000000000000-mapping.dmp

              • memory/1880-119-0x0000000000000000-mapping.dmp

              • memory/1880-120-0x0000000000000000-mapping.dmp

              • memory/1880-121-0x0000000000000000-mapping.dmp

              • memory/1880-122-0x0000000000000000-mapping.dmp

              • memory/1880-123-0x0000000000000000-mapping.dmp

              • memory/1880-125-0x0000000000000000-mapping.dmp

              • memory/1880-0-0x0000000000000000-mapping.dmp

              • memory/1880-1-0x0000000000000000-mapping.dmp

              • memory/1880-8-0x0000000000000000-mapping.dmp

              • memory/1880-2-0x0000000000000000-mapping.dmp

              • memory/1880-3-0x0000000000000000-mapping.dmp

              • memory/1880-7-0x0000000000000000-mapping.dmp

              • memory/1880-4-0x0000000000000000-mapping.dmp

              • memory/1880-6-0x0000000000000000-mapping.dmp

              • memory/1880-5-0x0000000000000000-mapping.dmp

              • memory/3176-135-0x0000000010530000-0x000000001054A000-memory.dmp

                Filesize

                104KB

              • memory/3176-124-0x0000000010410000-0x0000000010450000-memory.dmp

                Filesize

                256KB

              • memory/4108-130-0x0000000000000000-mapping.dmp

              • memory/4136-132-0x0000000000000000-mapping.dmp

              • memory/4156-133-0x0000000000000000-mapping.dmp

              • memory/4216-137-0x0000000000000000-mapping.dmp

              • memory/4268-141-0x0000000000000000-mapping.dmp

              • memory/4304-145-0x0000000000000000-mapping.dmp