Analysis
- max time kernel
150s - max time network
149s - platform
windows10_x64 - resource
win10 - submitted
13/10/2020, 05:54
General
- Target ROTAREX-ORDEN#0012102020.exe
- Size 813KB
- Sample201013-jvtrkatt8s
- SHA256 85eb2c7d5206686595f009a4e5a57a5743f736fa457454477377bea7368a2ab8
Malware Config
Extracted
-
remcos
-
wilsondavid.ddns.net:1145
Signatures
- Modifies Windows Defender Real-time Protection settings 3 TTPs
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Windows security modification 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ROTAREX-ORDEN#0012102020.exe"C:\Users\Admin\AppData\Local\Temp\ROTAREX-ORDEN#0012102020.exe"1⤵
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YkCAjkt" /XML "C:\Users\Admin\AppData\Local\Temp\tmp89C.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\ROTAREX-ORDEN#0012102020.exe"C:\Users\Admin\AppData\Local\Temp\ROTAREX-ORDEN#0012102020.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1300-32-0x00000000091C0000-0x00000000091C1000-memory.dmp
memory/1300-31-0x0000000008E00000-0x0000000008E01000-memory.dmp
memory/1300-35-0x0000000009160000-0x0000000009161000-memory.dmp
memory/1300-33-0x0000000009170000-0x0000000009171000-memory.dmp
memory/1300-16-0x0000000006EF0000-0x0000000006EF1000-memory.dmp
memory/1300-30-0x0000000008C90000-0x0000000008C91000-memory.dmp
memory/1300-23-0x0000000008CB0000-0x0000000008CE3000-memory.dmp
memory/1300-21-0x0000000007F50000-0x0000000007F51000-memory.dmp
memory/1300-17-0x0000000006FD0000-0x0000000006FD1000-memory.dmp
memory/1300-12-0x0000000073AE0000-0x00000000741CE000-memory.dmp
memory/1300-13-0x0000000000F80000-0x0000000000F81000-memory.dmp
memory/1300-14-0x00000000070C0000-0x00000000070C1000-memory.dmp
memory/1300-15-0x0000000006E50000-0x0000000006E51000-memory.dmp
memory/1300-19-0x0000000007060000-0x0000000007061000-memory.dmp
memory/1300-18-0x00000000078D0000-0x00000000078D1000-memory.dmp
memory/1300-20-0x0000000007C40000-0x0000000007C41000-memory.dmp
memory/2536-41-0x0000000000400000-0x0000000000421000-memory.dmp
memory/2536-39-0x0000000000400000-0x0000000000421000-memory.dmp
memory/3832-8-0x0000000008050000-0x000000000A04F000-memory.dmp
memory/3832-3-0x00000000055B0000-0x00000000055B1000-memory.dmp
memory/3832-7-0x00000000057E0000-0x00000000057E1000-memory.dmp
memory/3832-6-0x00000000054A0000-0x00000000054A1000-memory.dmp
memory/3832-4-0x0000000005B50000-0x0000000005B51000-memory.dmp
memory/3832-0-0x0000000073AE0000-0x00000000741CE000-memory.dmp
memory/3832-1-0x0000000000BE0000-0x0000000000BE1000-memory.dmp
memory/3832-5-0x0000000005650000-0x0000000005651000-memory.dmp
memory/3832-9-0x000000000A450000-0x000000000A4B3000-memory.dmp
memory/3832-10-0x000000000A5E0000-0x000000000A62D000-memory.dmp