Analysis
- max time kernel
148s - max time network
145s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:44
Static task
static1
Behavioral task
behavioral1
Sample
2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16.exe
- Size 1.1MB
- Sample201109-ktdllfyan2
- SHA256 2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16
- MD5 6baf52b941389d943af311234227adce
- SHA1 05edcb00cc2d8ecea1370819c7e233803e475482
- SHA512 fc5bf18f34c0e328854ff686f7c8e08e9658d6ebd5c454b3ffd0f6dd42e11853593506a0ca35318b16418968eafa109091bff5a310410080f74fe0ffc8421f7a
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
remcos
C2
-
daya4659.ddns.net:8282
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 588 created 3956 588 WerFault.exe 85 - ServiceHost packer 3 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/3956-18-0x000000000042800A-mapping.dmp servicehost behavioral2/memory/3956-19-0x000000000042800A-mapping.dmp servicehost behavioral2/memory/3956-20-0x000000000042800A-mapping.dmp servicehost - Executes dropped EXE 8 IoCs
pid Process 1552 remcos.exe 832 remcos.exe 3216 sfc.exe 1540 sfc.exe 2512 sfc.exe 2552 sfc.exe 1240 sfc.exe 1736 sfc.exe - Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" 2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ 2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" 2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" remcos.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ remcos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" remcos.exe - Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 1156 set thread context of 3052 1156 2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16.exe 75 PID 1552 set thread context of 832 1552 remcos.exe 84 PID 832 set thread context of 3956 832 remcos.exe 85 PID 3216 set thread context of 1540 3216 sfc.exe 92 PID 2512 set thread context of 2552 2512 sfc.exe 96 PID 1240 set thread context of 1736 1240 sfc.exe 100 - Program crash 1 IoCs
pid pid_target Process procid_target 588 3956 WerFault.exe 85 - Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1032 schtasks.exe 220 schtasks.exe 2776 schtasks.exe 3976 schtasks.exe 3944 schtasks.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings 2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16.exe - Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 588 WerFault.exe 588 WerFault.exe 588 WerFault.exe 588 WerFault.exe 588 WerFault.exe 588 WerFault.exe 588 WerFault.exe 588 WerFault.exe 588 WerFault.exe 588 WerFault.exe 588 WerFault.exe 588 WerFault.exe 588 WerFault.exe 588 WerFault.exe 588 WerFault.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 832 remcos.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 588 WerFault.exe Token: SeBackupPrivilege 588 WerFault.exe Token: SeDebugPrivilege 588 WerFault.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 832 remcos.exe - Suspicious use of WriteProcessMemory 59 IoCs
description pid Process procid_target PID 1156 wrote to memory of 3052 1156 2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16.exe 75 PID 1156 wrote to memory of 3052 1156 2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16.exe 75 PID 1156 wrote to memory of 3052 1156 2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16.exe 75 PID 1156 wrote to memory of 3052 1156 2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16.exe 75 PID 1156 wrote to memory of 3052 1156 2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16.exe 75 PID 1156 wrote to memory of 1032 1156 2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16.exe 76 PID 1156 wrote to memory of 1032 1156 2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16.exe 76 PID 1156 wrote to memory of 1032 1156 2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16.exe 76 PID 3052 wrote to memory of 1000 3052 2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16.exe 77 PID 3052 wrote to memory of 1000 3052 2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16.exe 77 PID 3052 wrote to memory of 1000 3052 2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16.exe 77 PID 1000 wrote to memory of 2040 1000 WScript.exe 79 PID 1000 wrote to memory of 2040 1000 WScript.exe 79 PID 1000 wrote to memory of 2040 1000 WScript.exe 79 PID 2040 wrote to memory of 1552 2040 cmd.exe 81 PID 2040 wrote to memory of 1552 2040 cmd.exe 81 PID 2040 wrote to memory of 1552 2040 cmd.exe 81 PID 1552 wrote to memory of 832 1552 remcos.exe 84 PID 1552 wrote to memory of 832 1552 remcos.exe 84 PID 1552 wrote to memory of 832 1552 remcos.exe 84 PID 1552 wrote to memory of 832 1552 remcos.exe 84 PID 1552 wrote to memory of 832 1552 remcos.exe 84 PID 832 wrote to memory of 3956 832 remcos.exe 85 PID 832 wrote to memory of 3956 832 remcos.exe 85 PID 832 wrote to memory of 3956 832 remcos.exe 85 PID 832 wrote to memory of 3956 832 remcos.exe 85 PID 832 wrote to memory of 3956 832 remcos.exe 85 PID 832 wrote to memory of 3956 832 remcos.exe 85 PID 832 wrote to memory of 3956 832 remcos.exe 85 PID 832 wrote to memory of 3956 832 remcos.exe 85 PID 832 wrote to memory of 3956 832 remcos.exe 85 PID 832 wrote to memory of 3956 832 remcos.exe 85 PID 1552 wrote to memory of 220 1552 remcos.exe 89 PID 1552 wrote to memory of 220 1552 remcos.exe 89 PID 1552 wrote to memory of 220 1552 remcos.exe 89 PID 3216 wrote to memory of 1540 3216 sfc.exe 92 PID 3216 wrote to memory of 1540 3216 sfc.exe 92 PID 3216 wrote to memory of 1540 3216 sfc.exe 92 PID 3216 wrote to memory of 1540 3216 sfc.exe 92 PID 3216 wrote to memory of 1540 3216 sfc.exe 92 PID 3216 wrote to memory of 2776 3216 sfc.exe 93 PID 3216 wrote to memory of 2776 3216 sfc.exe 93 PID 3216 wrote to memory of 2776 3216 sfc.exe 93 PID 2512 wrote to memory of 2552 2512 sfc.exe 96 PID 2512 wrote to memory of 2552 2512 sfc.exe 96 PID 2512 wrote to memory of 2552 2512 sfc.exe 96 PID 2512 wrote to memory of 2552 2512 sfc.exe 96 PID 2512 wrote to memory of 2552 2512 sfc.exe 96 PID 2512 wrote to memory of 3976 2512 sfc.exe 97 PID 2512 wrote to memory of 3976 2512 sfc.exe 97 PID 2512 wrote to memory of 3976 2512 sfc.exe 97 PID 1240 wrote to memory of 1736 1240 sfc.exe 100 PID 1240 wrote to memory of 1736 1240 sfc.exe 100 PID 1240 wrote to memory of 1736 1240 sfc.exe 100 PID 1240 wrote to memory of 1736 1240 sfc.exe 100 PID 1240 wrote to memory of 1736 1240 sfc.exe 100 PID 1240 wrote to memory of 3944 1240 sfc.exe 101 PID 1240 wrote to memory of 3944 1240 sfc.exe 101 PID 1240 wrote to memory of 3944 1240 sfc.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16.exe"C:\Users\Admin\AppData\Local\Temp\2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16.exe"C:\Users\Admin\AppData\Local\Temp\2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16.exe"2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Roaming\remcos\remcos.exeC:\Users\Admin\AppData\Roaming\remcos\remcos.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:3956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 5688⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:588
-
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F6⤵
- Creates scheduled task(s)
PID:220
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:1032
-
-
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exeC:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"2⤵
- Executes dropped EXE
PID:1540
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2776
-
-
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exeC:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"2⤵
- Executes dropped EXE
PID:2552
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:3976
-
-
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exeC:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"2⤵
- Executes dropped EXE
PID:1736
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:3944
-