Analysis
- max time kernel
150s - max time network
150s - platform
windows10_x64 - resource
win10v20201028 - submitted
27/11/2020, 14:25
General
- Target PO983767467.exe
- Size 5.0MB
- Sample201127-d2n2h244f2
- SHA256 3b463cccd70c11b6e8eb2be3e16113db9fc9268367c70210c49b7ef80e29d3d1
Malware Config
Extracted
-
remcos
-
finishfarm.duckdns.org:8760
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO983767467.exe"C:\Users\Admin\AppData\Local\Temp\PO983767467.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO983767467.exe"C:\Users\Admin\AppData\Local\Temp\PO983767467.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/212-12-0x0000000000400000-0x0000000000421000-memory.dmp
memory/212-14-0x0000000000400000-0x0000000000421000-memory.dmp
memory/4076-2-0x00000000739A0000-0x000000007408E000-memory.dmp
memory/4076-3-0x00000000009F0000-0x00000000009F1000-memory.dmp
memory/4076-5-0x0000000005820000-0x0000000005821000-memory.dmp
memory/4076-6-0x0000000005320000-0x0000000005321000-memory.dmp
memory/4076-7-0x0000000005250000-0x0000000005251000-memory.dmp
memory/4076-8-0x0000000006D20000-0x0000000006D21000-memory.dmp
memory/4076-9-0x0000000006DA0000-0x0000000006DEA000-memory.dmp
memory/4076-10-0x0000000006E10000-0x0000000006E11000-memory.dmp
memory/4076-11-0x0000000006EB0000-0x0000000006EC6000-memory.dmp