Analysis
- max time kernel
149s - max time network
150s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:24
Static task
static1
Behavioral task
behavioral1
Sample
359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634.exe
- Size 1.1MB
- Sample201109-qdezy834ex
- SHA256 359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634
- MD5 314192597d07cf8c85025cf35512f811
- SHA1 163a89c5f9ce9bf10a085c3c7df4a3b6020efb97
- SHA512 310ee97517aae1d74a0fa8028a91df832877b4d2890e90ecc4367176f269ed7ba4945aab982af4cb3c6597b6dc4fc1bfa8605d286023a20482ae91a19efb8df2
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
remcos
C2
-
daya4659.ddns.net:8282
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 2676 created 1816 2676 WerFault.exe 86 - ServiceHost packer 3 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/1816-23-0x000000000042800A-mapping.dmp servicehost behavioral2/memory/1816-25-0x000000000042800A-mapping.dmp servicehost behavioral2/memory/1816-24-0x000000000042800A-mapping.dmp servicehost - Executes dropped EXE 8 IoCs
pid Process 3488 remcos.exe 1960 sfc.exe 3996 remcos.exe 3348 sfc.exe 512 sfc.exe 2172 sfc.exe 3148 sfc.exe 3296 sfc.exe - Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" remcos.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" 359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ 359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" 359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\ remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" remcos.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ remcos.exe - Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 984 set thread context of 3860 984 359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634.exe 75 PID 3488 set thread context of 3996 3488 remcos.exe 85 PID 3996 set thread context of 1816 3996 remcos.exe 86 PID 1960 set thread context of 3348 1960 sfc.exe 91 PID 512 set thread context of 2172 512 sfc.exe 96 PID 3148 set thread context of 3296 3148 sfc.exe 100 - Program crash 1 IoCs
pid pid_target Process procid_target 2676 1816 WerFault.exe 86 - Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3856 schtasks.exe 4024 schtasks.exe 3076 schtasks.exe 1836 schtasks.exe 4072 schtasks.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings 359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634.exe - Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe 2676 WerFault.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3996 remcos.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeRestorePrivilege 2676 WerFault.exe Token: SeBackupPrivilege 2676 WerFault.exe Token: SeDebugPrivilege 2676 WerFault.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3996 remcos.exe - Suspicious use of WriteProcessMemory 59 IoCs
description pid Process procid_target PID 984 wrote to memory of 3860 984 359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634.exe 75 PID 984 wrote to memory of 3860 984 359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634.exe 75 PID 984 wrote to memory of 3860 984 359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634.exe 75 PID 984 wrote to memory of 3860 984 359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634.exe 75 PID 984 wrote to memory of 3860 984 359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634.exe 75 PID 3860 wrote to memory of 784 3860 359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634.exe 76 PID 3860 wrote to memory of 784 3860 359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634.exe 76 PID 3860 wrote to memory of 784 3860 359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634.exe 76 PID 984 wrote to memory of 4072 984 359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634.exe 77 PID 984 wrote to memory of 4072 984 359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634.exe 77 PID 984 wrote to memory of 4072 984 359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634.exe 77 PID 784 wrote to memory of 3644 784 WScript.exe 79 PID 784 wrote to memory of 3644 784 WScript.exe 79 PID 784 wrote to memory of 3644 784 WScript.exe 79 PID 3644 wrote to memory of 3488 3644 cmd.exe 81 PID 3644 wrote to memory of 3488 3644 cmd.exe 81 PID 3644 wrote to memory of 3488 3644 cmd.exe 81 PID 3488 wrote to memory of 3996 3488 remcos.exe 85 PID 3488 wrote to memory of 3996 3488 remcos.exe 85 PID 3488 wrote to memory of 3996 3488 remcos.exe 85 PID 3488 wrote to memory of 3996 3488 remcos.exe 85 PID 3488 wrote to memory of 3996 3488 remcos.exe 85 PID 3996 wrote to memory of 1816 3996 remcos.exe 86 PID 3996 wrote to memory of 1816 3996 remcos.exe 86 PID 3996 wrote to memory of 1816 3996 remcos.exe 86 PID 3996 wrote to memory of 1816 3996 remcos.exe 86 PID 3996 wrote to memory of 1816 3996 remcos.exe 86 PID 3996 wrote to memory of 1816 3996 remcos.exe 86 PID 3996 wrote to memory of 1816 3996 remcos.exe 86 PID 3996 wrote to memory of 1816 3996 remcos.exe 86 PID 3996 wrote to memory of 1816 3996 remcos.exe 86 PID 3996 wrote to memory of 1816 3996 remcos.exe 86 PID 3488 wrote to memory of 3856 3488 remcos.exe 89 PID 3488 wrote to memory of 3856 3488 remcos.exe 89 PID 3488 wrote to memory of 3856 3488 remcos.exe 89 PID 1960 wrote to memory of 3348 1960 sfc.exe 91 PID 1960 wrote to memory of 3348 1960 sfc.exe 91 PID 1960 wrote to memory of 3348 1960 sfc.exe 91 PID 1960 wrote to memory of 3348 1960 sfc.exe 91 PID 1960 wrote to memory of 3348 1960 sfc.exe 91 PID 1960 wrote to memory of 4024 1960 sfc.exe 92 PID 1960 wrote to memory of 4024 1960 sfc.exe 92 PID 1960 wrote to memory of 4024 1960 sfc.exe 92 PID 512 wrote to memory of 2172 512 sfc.exe 96 PID 512 wrote to memory of 2172 512 sfc.exe 96 PID 512 wrote to memory of 2172 512 sfc.exe 96 PID 512 wrote to memory of 2172 512 sfc.exe 96 PID 512 wrote to memory of 2172 512 sfc.exe 96 PID 512 wrote to memory of 3076 512 sfc.exe 97 PID 512 wrote to memory of 3076 512 sfc.exe 97 PID 512 wrote to memory of 3076 512 sfc.exe 97 PID 3148 wrote to memory of 3296 3148 sfc.exe 100 PID 3148 wrote to memory of 3296 3148 sfc.exe 100 PID 3148 wrote to memory of 3296 3148 sfc.exe 100 PID 3148 wrote to memory of 3296 3148 sfc.exe 100 PID 3148 wrote to memory of 3296 3148 sfc.exe 100 PID 3148 wrote to memory of 1836 3148 sfc.exe 101 PID 3148 wrote to memory of 1836 3148 sfc.exe 101 PID 3148 wrote to memory of 1836 3148 sfc.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634.exe"C:\Users\Admin\AppData\Local\Temp\359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634.exe"C:\Users\Admin\AppData\Local\Temp\359ac8bb415a9af23c0ff8b6e39a868d32db5ad817cd7e577c85ab665709e634.exe"2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Roaming\remcos\remcos.exeC:\Users\Admin\AppData\Roaming\remcos\remcos.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵PID:1816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 5648⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F6⤵
- Creates scheduled task(s)
PID:3856
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4072
-
-
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exeC:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"2⤵
- Executes dropped EXE
PID:3348
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4024
-
-
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exeC:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"2⤵
- Executes dropped EXE
PID:2172
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:3076
-
-
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exeC:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe"2⤵
- Executes dropped EXE
PID:3296
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn setx /tr "C:\Users\Admin\AppData\Roaming\CapabilityAccessHandlers\sfc.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:1836
-