Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10_x64 -
resource
win10 -
submitted
10-07-2020 12:11
General
-
Target
SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe
-
Size
1.5MB
-
MD5
0c6a22a028ce02e10608bb44b7b4c66f
-
SHA1
686ca5b3fdb1606769054107783ab4ad49a3acec
-
SHA256
491cff43b259addd44a312094b15674d2c33c9ab901500130fead03e7d9d6530
-
SHA512
dbee8252a20e0e90242282b14c76ca8256700055b65f27f3b19131bd27613a5168363d4507daac641234504f15b3b6d4a53140b5c591e6df732aa253087ffaaa
Score
10/10
Malware Config
Extracted
Family
remcos
C2
karimgoussd.ug:6969
fgdjhksdfsdxcbv.ru:6969
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Adds Run entry to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 22 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Modifies registry key 1 TTPs 3 IoCs
-
Suspicious use of WriteProcessMemory 528 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies registry class 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Artemis0C6A22A028CE.16359.exe"1⤵
- Adds Run entry to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TapiUnattend.exe"C:\Windows\System32\TapiUnattend.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Public\Natso.bat3⤵
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "4⤵
- Modifies registry key
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I4⤵
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Public\Runex.bat3⤵
-
C:\Windows \System32\fodhelper.exe"C:\Windows \System32\fodhelper.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Public\x.bat5⤵
-
C:\Windows\system32\cmd.execmd /c C:\Users\Public\x.vbs6⤵
- Modifies registry class
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\x.vbs"7⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\cde.bat" "8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local9⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"2⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
-
-
-
-
-
-
-
-
-
-
Filesize
256KB
-
-
-
-
-
-
-
Filesize
92KB
-
Filesize
92KB
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-