Analysis
- max time kernel
149s - max time network
150s - platform
windows10_x64 - resource
win10v200722 - submitted
15/10/2020, 11:59
Static task
static1
Behavioral task
behavioral1
Sample
New order for 1x40ft container.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
New order for 1x40ft container.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target New order for 1x40ft container.exe
- Size 769KB
- Sample201015-29grvetpcn
- SHA256 74ac8fc2b4b1a8d3a9aa59496ea6fcd5669e26ed51fec6c3a62a9a68bea89343
- MD5 4c95b4e3635b639f4c9293e22e9a6c7c
- SHA1 70fa15d267a9c4a563796df4aeef1a8bfec0e011
- SHA512 8d85766f09f85e12b455aa58ac0ecd1be8e7907d6967224e939bd6976c90d8e07f033902f95ddebc48d7c27843b04b340d78b5a2e19037146540f742f7cc73ec
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
remcos
C2
-
79.134.225.80:1952
Signatures
- ServiceHost packer 5 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/2488-30-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2488-31-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2488-32-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2488-33-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/2488-34-0x0000000000000000-mapping.dmp servicehost - Executes dropped EXE 4 IoCs
pid Process 2488 remcos.exe 2164 remcos.exe 1496 remcos.exe 3420 remcos.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\ remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" remcos.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\ New order for 1x40ft container.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" New order for 1x40ft container.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
pid Process 2096 New order for 1x40ft container.exe 2096 New order for 1x40ft container.exe 2096 New order for 1x40ft container.exe 2096 New order for 1x40ft container.exe 2096 New order for 1x40ft container.exe 2488 remcos.exe 2488 remcos.exe 2488 remcos.exe 2488 remcos.exe 2488 remcos.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2096 set thread context of 1020 2096 New order for 1x40ft container.exe 77 PID 2488 set thread context of 3420 2488 remcos.exe 86 - Program crash 1 IoCs
pid pid_target Process procid_target 2104 2488 WerFault.exe 81 - Delays execution with timeout.exe 2 IoCs
pid Process 3920 timeout.exe 1804 timeout.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings New order for 1x40ft container.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2096 New order for 1x40ft container.exe 2096 New order for 1x40ft container.exe 2096 New order for 1x40ft container.exe 2488 remcos.exe 2488 remcos.exe 2488 remcos.exe 2488 remcos.exe 2488 remcos.exe 2488 remcos.exe 2488 remcos.exe 2104 WerFault.exe 2104 WerFault.exe 2104 WerFault.exe 2104 WerFault.exe 2104 WerFault.exe 2104 WerFault.exe 2104 WerFault.exe 2104 WerFault.exe 2104 WerFault.exe 2104 WerFault.exe 2104 WerFault.exe 2104 WerFault.exe 2104 WerFault.exe 2104 WerFault.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3420 remcos.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2096 New order for 1x40ft container.exe Token: SeDebugPrivilege 2488 remcos.exe Token: SeRestorePrivilege 2104 WerFault.exe Token: SeBackupPrivilege 2104 WerFault.exe Token: SeDebugPrivilege 2104 WerFault.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3420 remcos.exe - Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 2096 wrote to memory of 3920 2096 New order for 1x40ft container.exe 72 PID 2096 wrote to memory of 3920 2096 New order for 1x40ft container.exe 72 PID 2096 wrote to memory of 3920 2096 New order for 1x40ft container.exe 72 PID 2096 wrote to memory of 1020 2096 New order for 1x40ft container.exe 77 PID 2096 wrote to memory of 1020 2096 New order for 1x40ft container.exe 77 PID 2096 wrote to memory of 1020 2096 New order for 1x40ft container.exe 77 PID 2096 wrote to memory of 1020 2096 New order for 1x40ft container.exe 77 PID 2096 wrote to memory of 1020 2096 New order for 1x40ft container.exe 77 PID 2096 wrote to memory of 1020 2096 New order for 1x40ft container.exe 77 PID 2096 wrote to memory of 1020 2096 New order for 1x40ft container.exe 77 PID 2096 wrote to memory of 1020 2096 New order for 1x40ft container.exe 77 PID 2096 wrote to memory of 1020 2096 New order for 1x40ft container.exe 77 PID 2096 wrote to memory of 1020 2096 New order for 1x40ft container.exe 77 PID 1020 wrote to memory of 3776 1020 New order for 1x40ft container.exe 78 PID 1020 wrote to memory of 3776 1020 New order for 1x40ft container.exe 78 PID 1020 wrote to memory of 3776 1020 New order for 1x40ft container.exe 78 PID 3776 wrote to memory of 3820 3776 WScript.exe 79 PID 3776 wrote to memory of 3820 3776 WScript.exe 79 PID 3776 wrote to memory of 3820 3776 WScript.exe 79 PID 3820 wrote to memory of 2488 3820 cmd.exe 81 PID 3820 wrote to memory of 2488 3820 cmd.exe 81 PID 3820 wrote to memory of 2488 3820 cmd.exe 81 PID 2488 wrote to memory of 1804 2488 remcos.exe 82 PID 2488 wrote to memory of 1804 2488 remcos.exe 82 PID 2488 wrote to memory of 1804 2488 remcos.exe 82 PID 2488 wrote to memory of 2164 2488 remcos.exe 84 PID 2488 wrote to memory of 2164 2488 remcos.exe 84 PID 2488 wrote to memory of 2164 2488 remcos.exe 84 PID 2488 wrote to memory of 1496 2488 remcos.exe 85 PID 2488 wrote to memory of 1496 2488 remcos.exe 85 PID 2488 wrote to memory of 1496 2488 remcos.exe 85 PID 2488 wrote to memory of 3420 2488 remcos.exe 86 PID 2488 wrote to memory of 3420 2488 remcos.exe 86 PID 2488 wrote to memory of 3420 2488 remcos.exe 86 PID 2488 wrote to memory of 3420 2488 remcos.exe 86 PID 2488 wrote to memory of 3420 2488 remcos.exe 86 PID 2488 wrote to memory of 3420 2488 remcos.exe 86 PID 2488 wrote to memory of 3420 2488 remcos.exe 86 PID 2488 wrote to memory of 3420 2488 remcos.exe 86 PID 2488 wrote to memory of 3420 2488 remcos.exe 86 PID 2488 wrote to memory of 3420 2488 remcos.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\New order for 1x40ft container.exe"C:\Users\Admin\AppData\Local\Temp\New order for 1x40ft container.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\timeout.exetimeout 42⤵
- Delays execution with timeout.exe
PID:3920
-
-
C:\Users\Admin\AppData\Local\Temp\New order for 1x40ft container.exe"C:\Users\Admin\AppData\Local\Temp\New order for 1x40ft container.exe"2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\timeout.exetimeout 46⤵
- Delays execution with timeout.exe
PID:1804
-
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"6⤵
- Executes dropped EXE
PID:2164
-
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"6⤵
- Executes dropped EXE
PID:1496
-
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3420
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 10686⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2104
-
-
-
-
-