Analysis
- max time kernel
150s - max time network
157s - platform
windows7_x64 - resource
win7 - submitted
15/10/2020, 11:59
Static task
static1
Behavioral task
behavioral1
Sample
New order for 1x40ft container.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
New order for 1x40ft container.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target New order for 1x40ft container.exe
- Size 769KB
- Sample201015-29grvetpcn
- SHA256 74ac8fc2b4b1a8d3a9aa59496ea6fcd5669e26ed51fec6c3a62a9a68bea89343
- MD5 4c95b4e3635b639f4c9293e22e9a6c7c
- SHA1 70fa15d267a9c4a563796df4aeef1a8bfec0e011
- SHA512 8d85766f09f85e12b455aa58ac0ecd1be8e7907d6967224e939bd6976c90d8e07f033902f95ddebc48d7c27843b04b340d78b5a2e19037146540f742f7cc73ec
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
remcos
C2
-
79.134.225.80:1952
Signatures
- ServiceHost packer 4 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral1/memory/468-36-0x0000000000000000-mapping.dmp servicehost behavioral1/memory/468-35-0x0000000000000000-mapping.dmp servicehost behavioral1/memory/468-37-0x0000000000000000-mapping.dmp servicehost behavioral1/memory/468-38-0x0000000000000000-mapping.dmp servicehost - Executes dropped EXE 2 IoCs
pid Process 468 remcos.exe 1820 remcos.exe - Loads dropped DLL 7 IoCs
pid Process 2024 cmd.exe 2024 cmd.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\ New order for 1x40ft container.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" New order for 1x40ft container.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\ remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" remcos.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 1012 New order for 1x40ft container.exe 1012 New order for 1x40ft container.exe 1012 New order for 1x40ft container.exe 1012 New order for 1x40ft container.exe 468 remcos.exe 468 remcos.exe 468 remcos.exe 468 remcos.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1012 set thread context of 1852 1012 New order for 1x40ft container.exe 31 PID 468 set thread context of 1820 468 remcos.exe 39 - Program crash 2 IoCs
pid pid_target Process procid_target 1856 1012 WerFault.exe 23 1532 468 WerFault.exe 36 - Delays execution with timeout.exe 2 IoCs
pid Process 796 timeout.exe 1000 timeout.exe - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1012 New order for 1x40ft container.exe 1012 New order for 1x40ft container.exe 1012 New order for 1x40ft container.exe 1012 New order for 1x40ft container.exe 1012 New order for 1x40ft container.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 1856 WerFault.exe 468 remcos.exe 468 remcos.exe 468 remcos.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe 1532 WerFault.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1856 WerFault.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1012 New order for 1x40ft container.exe Token: SeDebugPrivilege 1856 WerFault.exe Token: SeDebugPrivilege 468 remcos.exe Token: SeDebugPrivilege 1532 WerFault.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1820 remcos.exe - Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 1012 wrote to memory of 796 1012 New order for 1x40ft container.exe 25 PID 1012 wrote to memory of 796 1012 New order for 1x40ft container.exe 25 PID 1012 wrote to memory of 796 1012 New order for 1x40ft container.exe 25 PID 1012 wrote to memory of 796 1012 New order for 1x40ft container.exe 25 PID 1012 wrote to memory of 1564 1012 New order for 1x40ft container.exe 30 PID 1012 wrote to memory of 1564 1012 New order for 1x40ft container.exe 30 PID 1012 wrote to memory of 1564 1012 New order for 1x40ft container.exe 30 PID 1012 wrote to memory of 1564 1012 New order for 1x40ft container.exe 30 PID 1012 wrote to memory of 1852 1012 New order for 1x40ft container.exe 31 PID 1012 wrote to memory of 1852 1012 New order for 1x40ft container.exe 31 PID 1012 wrote to memory of 1852 1012 New order for 1x40ft container.exe 31 PID 1012 wrote to memory of 1852 1012 New order for 1x40ft container.exe 31 PID 1012 wrote to memory of 1852 1012 New order for 1x40ft container.exe 31 PID 1012 wrote to memory of 1852 1012 New order for 1x40ft container.exe 31 PID 1012 wrote to memory of 1852 1012 New order for 1x40ft container.exe 31 PID 1012 wrote to memory of 1852 1012 New order for 1x40ft container.exe 31 PID 1012 wrote to memory of 1852 1012 New order for 1x40ft container.exe 31 PID 1012 wrote to memory of 1852 1012 New order for 1x40ft container.exe 31 PID 1012 wrote to memory of 1852 1012 New order for 1x40ft container.exe 31 PID 1012 wrote to memory of 1856 1012 New order for 1x40ft container.exe 32 PID 1012 wrote to memory of 1856 1012 New order for 1x40ft container.exe 32 PID 1012 wrote to memory of 1856 1012 New order for 1x40ft container.exe 32 PID 1012 wrote to memory of 1856 1012 New order for 1x40ft container.exe 32 PID 1852 wrote to memory of 1940 1852 New order for 1x40ft container.exe 33 PID 1852 wrote to memory of 1940 1852 New order for 1x40ft container.exe 33 PID 1852 wrote to memory of 1940 1852 New order for 1x40ft container.exe 33 PID 1852 wrote to memory of 1940 1852 New order for 1x40ft container.exe 33 PID 1940 wrote to memory of 2024 1940 WScript.exe 34 PID 1940 wrote to memory of 2024 1940 WScript.exe 34 PID 1940 wrote to memory of 2024 1940 WScript.exe 34 PID 1940 wrote to memory of 2024 1940 WScript.exe 34 PID 2024 wrote to memory of 468 2024 cmd.exe 36 PID 2024 wrote to memory of 468 2024 cmd.exe 36 PID 2024 wrote to memory of 468 2024 cmd.exe 36 PID 2024 wrote to memory of 468 2024 cmd.exe 36 PID 468 wrote to memory of 1000 468 remcos.exe 37 PID 468 wrote to memory of 1000 468 remcos.exe 37 PID 468 wrote to memory of 1000 468 remcos.exe 37 PID 468 wrote to memory of 1000 468 remcos.exe 37 PID 468 wrote to memory of 1820 468 remcos.exe 39 PID 468 wrote to memory of 1820 468 remcos.exe 39 PID 468 wrote to memory of 1820 468 remcos.exe 39 PID 468 wrote to memory of 1820 468 remcos.exe 39 PID 468 wrote to memory of 1820 468 remcos.exe 39 PID 468 wrote to memory of 1820 468 remcos.exe 39 PID 468 wrote to memory of 1820 468 remcos.exe 39 PID 468 wrote to memory of 1820 468 remcos.exe 39 PID 468 wrote to memory of 1820 468 remcos.exe 39 PID 468 wrote to memory of 1820 468 remcos.exe 39 PID 468 wrote to memory of 1820 468 remcos.exe 39 PID 468 wrote to memory of 1532 468 remcos.exe 40 PID 468 wrote to memory of 1532 468 remcos.exe 40 PID 468 wrote to memory of 1532 468 remcos.exe 40 PID 468 wrote to memory of 1532 468 remcos.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\New order for 1x40ft container.exe"C:\Users\Admin\AppData\Local\Temp\New order for 1x40ft container.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\SysWOW64\timeout.exetimeout 42⤵
- Delays execution with timeout.exe
PID:796
-
-
C:\Users\Admin\AppData\Local\Temp\New order for 1x40ft container.exe"C:\Users\Admin\AppData\Local\Temp\New order for 1x40ft container.exe"2⤵PID:1564
-
-
C:\Users\Admin\AppData\Local\Temp\New order for 1x40ft container.exe"C:\Users\Admin\AppData\Local\Temp\New order for 1x40ft container.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\SysWOW64\timeout.exetimeout 46⤵
- Delays execution with timeout.exe
PID:1000
-
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1820
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 6286⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1532
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 6322⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1856
-