Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
08-01-2021 09:51
General
-
Target
SecuriteInfo.com.generic.ml.32161.exe
-
Size
72KB
-
MD5
0640f43c412f8f2c3bf6e1b9139db1d0
-
SHA1
f07e9e5e618b14b0dd5478cb2a26f42096a10e1d
-
SHA256
1664c6a330c5b318458518ea71b2a9995a91c79281a050278c3aa2388663a986
-
SHA512
753029891e9db39d072cce14dd552ef313479ea0cff2e4c3a5591bbf045174ea474e2651c8bdbed5ca30429852f4d28a5126fe99bfcaf9aa9daec30ac46f0a05
Score
10/10
Malware Config
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.generic.ml.32161.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.generic.ml.32161.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.generic.ml.32161.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1964-5-0x0000000002C00000-mapping.dmp
-
memory/1964-4-0x0000000002C00000-0x0000000002D00000-memory.dmpFilesize
1024KB