Analysis
-
max time kernel
148s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
21-11-2020 07:51
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION 21 11 2020.exe
Resource
win7v20201028
General
-
Target
QUOTATION 21 11 2020.exe
-
Size
906KB
-
MD5
be2f5670427369fb1d7bf50e32e60f06
-
SHA1
88412c7f107c686619ec61cec8662861744e455d
-
SHA256
61248c209119bd790c6ad906dd9d12e7a03455c2b2f6e4b7d1432aed6ae92439
-
SHA512
d556aebfb5e9d6225ef2d5e08e6ce7310e40895bf9b08f38df95e1a96e4cc4a01f0d087cacddbb3e067abc8b5296b11793ce6ae77dc48f4a924754bd06f71ef8
Malware Config
Extracted
remcos
185.140.53.197:1011
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
QUOTATION 21 11 2020.exevbc.exedescription pid process target process PID 3636 set thread context of 3888 3636 QUOTATION 21 11 2020.exe vbc.exe PID 3888 set thread context of 984 3888 vbc.exe vbc.exe PID 3888 set thread context of 1524 3888 vbc.exe vbc.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
vbc.exepid process 984 vbc.exe 984 vbc.exe 984 vbc.exe 984 vbc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vbc.exepid process 3888 vbc.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
QUOTATION 21 11 2020.exevbc.exedescription pid process target process PID 3636 wrote to memory of 208 3636 QUOTATION 21 11 2020.exe schtasks.exe PID 3636 wrote to memory of 208 3636 QUOTATION 21 11 2020.exe schtasks.exe PID 3636 wrote to memory of 208 3636 QUOTATION 21 11 2020.exe schtasks.exe PID 3636 wrote to memory of 3888 3636 QUOTATION 21 11 2020.exe vbc.exe PID 3636 wrote to memory of 3888 3636 QUOTATION 21 11 2020.exe vbc.exe PID 3636 wrote to memory of 3888 3636 QUOTATION 21 11 2020.exe vbc.exe PID 3636 wrote to memory of 3888 3636 QUOTATION 21 11 2020.exe vbc.exe PID 3636 wrote to memory of 3888 3636 QUOTATION 21 11 2020.exe vbc.exe PID 3636 wrote to memory of 3888 3636 QUOTATION 21 11 2020.exe vbc.exe PID 3636 wrote to memory of 3888 3636 QUOTATION 21 11 2020.exe vbc.exe PID 3636 wrote to memory of 3888 3636 QUOTATION 21 11 2020.exe vbc.exe PID 3636 wrote to memory of 3888 3636 QUOTATION 21 11 2020.exe vbc.exe PID 3636 wrote to memory of 3888 3636 QUOTATION 21 11 2020.exe vbc.exe PID 3888 wrote to memory of 984 3888 vbc.exe vbc.exe PID 3888 wrote to memory of 984 3888 vbc.exe vbc.exe PID 3888 wrote to memory of 984 3888 vbc.exe vbc.exe PID 3888 wrote to memory of 984 3888 vbc.exe vbc.exe PID 3888 wrote to memory of 984 3888 vbc.exe vbc.exe PID 3888 wrote to memory of 984 3888 vbc.exe vbc.exe PID 3888 wrote to memory of 984 3888 vbc.exe vbc.exe PID 3888 wrote to memory of 984 3888 vbc.exe vbc.exe PID 3888 wrote to memory of 3464 3888 vbc.exe vbc.exe PID 3888 wrote to memory of 3464 3888 vbc.exe vbc.exe PID 3888 wrote to memory of 3464 3888 vbc.exe vbc.exe PID 3888 wrote to memory of 1524 3888 vbc.exe vbc.exe PID 3888 wrote to memory of 1524 3888 vbc.exe vbc.exe PID 3888 wrote to memory of 1524 3888 vbc.exe vbc.exe PID 3888 wrote to memory of 1524 3888 vbc.exe vbc.exe PID 3888 wrote to memory of 1524 3888 vbc.exe vbc.exe PID 3888 wrote to memory of 1524 3888 vbc.exe vbc.exe PID 3888 wrote to memory of 1524 3888 vbc.exe vbc.exe PID 3888 wrote to memory of 1524 3888 vbc.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION 21 11 2020.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION 21 11 2020.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jgbZza" /XML "C:\Users\Admin\AppData\Local\Temp\tmp38B.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\oxckak"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\rrhubdbovo"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\bunnbvmqjwgdp"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\oxckakMD5
1e69b6d630e694119f4f8c448a430b60
SHA1b118feca7d85ec706b54279a1dafc71673fe6e54
SHA2562f7eedbe9e3b0a3aa08df4fa2dc27de189484a8da8925cc6056513d744b7c00e
SHA51219924161f75cbbcf7bdf122f3aecb43d813186a6693413ccc15bb2945d48401c8f058edf034cc641cedc97ae5e328d88fabfab1b5f324014b83671b3ebd78822
-
C:\Users\Admin\AppData\Local\Temp\tmp38B.tmpMD5
4395fdc4466e646529a0188839ac357d
SHA1842f1c024e4d35483a225397e2f3b647d8749e82
SHA2562802f0899825977e9bd8f7fae03d69d4d70604a6f9c44d7ea4d84cfba4840a4a
SHA512ff717b9f76596f95528ab85464e87c24039f730f079b5517f4cf04e8bff2655870056a92746b193667aef34be12901dfa069e0545142b43b10d06244c53a130a
-
memory/208-12-0x0000000000000000-mapping.dmp
-
memory/984-20-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/984-18-0x0000000000476274-mapping.dmp
-
memory/984-23-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/984-17-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1524-24-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1524-19-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1524-22-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1524-21-0x0000000000455238-mapping.dmp
-
memory/3636-10-0x0000000006220000-0x0000000006226000-memory.dmpFilesize
24KB
-
memory/3636-8-0x0000000005670000-0x0000000005684000-memory.dmpFilesize
80KB
-
memory/3636-1-0x0000000000B70000-0x0000000000B71000-memory.dmpFilesize
4KB
-
memory/3636-6-0x0000000005470000-0x0000000005471000-memory.dmpFilesize
4KB
-
memory/3636-7-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB
-
memory/3636-4-0x0000000005A50000-0x0000000005A51000-memory.dmpFilesize
4KB
-
memory/3636-11-0x0000000006230000-0x0000000006253000-memory.dmpFilesize
140KB
-
memory/3636-0-0x0000000073CA0000-0x000000007438E000-memory.dmpFilesize
6.9MB
-
memory/3636-5-0x0000000005550000-0x0000000005551000-memory.dmpFilesize
4KB
-
memory/3636-9-0x00000000061B0000-0x0000000006206000-memory.dmpFilesize
344KB
-
memory/3636-3-0x00000000054B0000-0x00000000054B1000-memory.dmpFilesize
4KB
-
memory/3888-16-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3888-15-0x0000000000413FA4-mapping.dmp
-
memory/3888-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB