Analysis
-
max time kernel
63s -
max time network
9s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
12-01-2021 14:12
Static task
static1
Behavioral task
behavioral1
Sample
i5TiYkAYkWJy1O8.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
i5TiYkAYkWJy1O8.exe
Resource
win10v20201028
General
-
Target
i5TiYkAYkWJy1O8.exe
-
Size
772KB
-
MD5
e17a0488de5ca3c73672541143ee6927
-
SHA1
8a4c59f81c17710e665fb3e055dc1cbd28bc8ce6
-
SHA256
596479cd77e25e5d6dbf0b421afff049390813cc254ae90f86af00a10bdf6f90
-
SHA512
6766459cca6b6a25902973ca210e274241841e7acd2684ccb3f362040e3dbd568f1b430d305e773e50e0ec1e5e7cd879d8f3aff7d4cc30ce0a786be58555537d
Malware Config
Extracted
remcos
185.244.26.208:29100
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
remcos.exepid process 772 remcos.exe -
Loads dropped DLL 6 IoCs
Processes:
cmd.exeWerFault.exepid process 1028 cmd.exe 2020 WerFault.exe 2020 WerFault.exe 2020 WerFault.exe 2020 WerFault.exe 2020 WerFault.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
i5TiYkAYkWJy1O8.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ i5TiYkAYkWJy1O8.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" i5TiYkAYkWJy1O8.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
i5TiYkAYkWJy1O8.exedescription pid process target process PID 1068 set thread context of 760 1068 i5TiYkAYkWJy1O8.exe i5TiYkAYkWJy1O8.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2020 772 WerFault.exe remcos.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
WerFault.exepid process 2020 WerFault.exe 2020 WerFault.exe 2020 WerFault.exe 2020 WerFault.exe 2020 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
WerFault.exedescription pid process Token: SeDebugPrivilege 2020 WerFault.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
i5TiYkAYkWJy1O8.exei5TiYkAYkWJy1O8.exeWScript.execmd.exeremcos.exedescription pid process target process PID 1068 wrote to memory of 2008 1068 i5TiYkAYkWJy1O8.exe schtasks.exe PID 1068 wrote to memory of 2008 1068 i5TiYkAYkWJy1O8.exe schtasks.exe PID 1068 wrote to memory of 2008 1068 i5TiYkAYkWJy1O8.exe schtasks.exe PID 1068 wrote to memory of 2008 1068 i5TiYkAYkWJy1O8.exe schtasks.exe PID 1068 wrote to memory of 760 1068 i5TiYkAYkWJy1O8.exe i5TiYkAYkWJy1O8.exe PID 1068 wrote to memory of 760 1068 i5TiYkAYkWJy1O8.exe i5TiYkAYkWJy1O8.exe PID 1068 wrote to memory of 760 1068 i5TiYkAYkWJy1O8.exe i5TiYkAYkWJy1O8.exe PID 1068 wrote to memory of 760 1068 i5TiYkAYkWJy1O8.exe i5TiYkAYkWJy1O8.exe PID 1068 wrote to memory of 760 1068 i5TiYkAYkWJy1O8.exe i5TiYkAYkWJy1O8.exe PID 1068 wrote to memory of 760 1068 i5TiYkAYkWJy1O8.exe i5TiYkAYkWJy1O8.exe PID 1068 wrote to memory of 760 1068 i5TiYkAYkWJy1O8.exe i5TiYkAYkWJy1O8.exe PID 1068 wrote to memory of 760 1068 i5TiYkAYkWJy1O8.exe i5TiYkAYkWJy1O8.exe PID 1068 wrote to memory of 760 1068 i5TiYkAYkWJy1O8.exe i5TiYkAYkWJy1O8.exe PID 1068 wrote to memory of 760 1068 i5TiYkAYkWJy1O8.exe i5TiYkAYkWJy1O8.exe PID 1068 wrote to memory of 760 1068 i5TiYkAYkWJy1O8.exe i5TiYkAYkWJy1O8.exe PID 760 wrote to memory of 1744 760 i5TiYkAYkWJy1O8.exe WScript.exe PID 760 wrote to memory of 1744 760 i5TiYkAYkWJy1O8.exe WScript.exe PID 760 wrote to memory of 1744 760 i5TiYkAYkWJy1O8.exe WScript.exe PID 760 wrote to memory of 1744 760 i5TiYkAYkWJy1O8.exe WScript.exe PID 1744 wrote to memory of 1028 1744 WScript.exe cmd.exe PID 1744 wrote to memory of 1028 1744 WScript.exe cmd.exe PID 1744 wrote to memory of 1028 1744 WScript.exe cmd.exe PID 1744 wrote to memory of 1028 1744 WScript.exe cmd.exe PID 1028 wrote to memory of 772 1028 cmd.exe remcos.exe PID 1028 wrote to memory of 772 1028 cmd.exe remcos.exe PID 1028 wrote to memory of 772 1028 cmd.exe remcos.exe PID 1028 wrote to memory of 772 1028 cmd.exe remcos.exe PID 772 wrote to memory of 2020 772 remcos.exe WerFault.exe PID 772 wrote to memory of 2020 772 remcos.exe WerFault.exe PID 772 wrote to memory of 2020 772 remcos.exe WerFault.exe PID 772 wrote to memory of 2020 772 remcos.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\i5TiYkAYkWJy1O8.exe"C:\Users\Admin\AppData\Local\Temp\i5TiYkAYkWJy1O8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LChCpmvhHgIatd" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDBDE.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\i5TiYkAYkWJy1O8.exe"C:\Users\Admin\AppData\Local\Temp\i5TiYkAYkWJy1O8.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 7806⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
b92d64fe5b1d1f59df4b738262aea8df
SHA1c8fb1981759c2d9bb2ec91b705985fba5fc7af63
SHA256fa20e9aab03dc8e9f1910aaf0cf42662379fa16ae3a22642084fb97fa3d4f83a
SHA5122566248b93c0cfb0414f033b8dd18bbd4f88180093eac2861107289bcb4ee160f9593706ff1f7d1f2e4ecea430d67a5a2897551a4f9ebd82b707243e300520e2
-
C:\Users\Admin\AppData\Local\Temp\tmpDBDE.tmpMD5
a68e94943cccc84bef9bd11324e9a050
SHA1ef5870d486eef245699ccd804bd364b291bd428a
SHA25639316e3f9f6bcd20112308830da5095324075ad989cd01c3053cb59a7c678bac
SHA51222a831aee4a84958ca234159a078bb3117b78ebe2a92c452d44445452cbe6a052ed588088b320af2490ead172fe612de676a700a7c648f4f7fd196ada95e6c8e
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
e17a0488de5ca3c73672541143ee6927
SHA18a4c59f81c17710e665fb3e055dc1cbd28bc8ce6
SHA256596479cd77e25e5d6dbf0b421afff049390813cc254ae90f86af00a10bdf6f90
SHA5126766459cca6b6a25902973ca210e274241841e7acd2684ccb3f362040e3dbd568f1b430d305e773e50e0ec1e5e7cd879d8f3aff7d4cc30ce0a786be58555537d
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
e17a0488de5ca3c73672541143ee6927
SHA18a4c59f81c17710e665fb3e055dc1cbd28bc8ce6
SHA256596479cd77e25e5d6dbf0b421afff049390813cc254ae90f86af00a10bdf6f90
SHA5126766459cca6b6a25902973ca210e274241841e7acd2684ccb3f362040e3dbd568f1b430d305e773e50e0ec1e5e7cd879d8f3aff7d4cc30ce0a786be58555537d
-
\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
e17a0488de5ca3c73672541143ee6927
SHA18a4c59f81c17710e665fb3e055dc1cbd28bc8ce6
SHA256596479cd77e25e5d6dbf0b421afff049390813cc254ae90f86af00a10bdf6f90
SHA5126766459cca6b6a25902973ca210e274241841e7acd2684ccb3f362040e3dbd568f1b430d305e773e50e0ec1e5e7cd879d8f3aff7d4cc30ce0a786be58555537d
-
\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
e17a0488de5ca3c73672541143ee6927
SHA18a4c59f81c17710e665fb3e055dc1cbd28bc8ce6
SHA256596479cd77e25e5d6dbf0b421afff049390813cc254ae90f86af00a10bdf6f90
SHA5126766459cca6b6a25902973ca210e274241841e7acd2684ccb3f362040e3dbd568f1b430d305e773e50e0ec1e5e7cd879d8f3aff7d4cc30ce0a786be58555537d
-
\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
e17a0488de5ca3c73672541143ee6927
SHA18a4c59f81c17710e665fb3e055dc1cbd28bc8ce6
SHA256596479cd77e25e5d6dbf0b421afff049390813cc254ae90f86af00a10bdf6f90
SHA5126766459cca6b6a25902973ca210e274241841e7acd2684ccb3f362040e3dbd568f1b430d305e773e50e0ec1e5e7cd879d8f3aff7d4cc30ce0a786be58555537d
-
\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
e17a0488de5ca3c73672541143ee6927
SHA18a4c59f81c17710e665fb3e055dc1cbd28bc8ce6
SHA256596479cd77e25e5d6dbf0b421afff049390813cc254ae90f86af00a10bdf6f90
SHA5126766459cca6b6a25902973ca210e274241841e7acd2684ccb3f362040e3dbd568f1b430d305e773e50e0ec1e5e7cd879d8f3aff7d4cc30ce0a786be58555537d
-
\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
e17a0488de5ca3c73672541143ee6927
SHA18a4c59f81c17710e665fb3e055dc1cbd28bc8ce6
SHA256596479cd77e25e5d6dbf0b421afff049390813cc254ae90f86af00a10bdf6f90
SHA5126766459cca6b6a25902973ca210e274241841e7acd2684ccb3f362040e3dbd568f1b430d305e773e50e0ec1e5e7cd879d8f3aff7d4cc30ce0a786be58555537d
-
\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
e17a0488de5ca3c73672541143ee6927
SHA18a4c59f81c17710e665fb3e055dc1cbd28bc8ce6
SHA256596479cd77e25e5d6dbf0b421afff049390813cc254ae90f86af00a10bdf6f90
SHA5126766459cca6b6a25902973ca210e274241841e7acd2684ccb3f362040e3dbd568f1b430d305e773e50e0ec1e5e7cd879d8f3aff7d4cc30ce0a786be58555537d
-
memory/760-11-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/760-10-0x0000000000413FA4-mapping.dmp
-
memory/760-9-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/772-21-0x0000000000E70000-0x0000000000E71000-memory.dmpFilesize
4KB
-
memory/772-18-0x0000000000000000-mapping.dmp
-
memory/772-20-0x0000000074EE0000-0x00000000755CE000-memory.dmpFilesize
6.9MB
-
memory/1028-14-0x0000000000000000-mapping.dmp
-
memory/1068-2-0x0000000074EE0000-0x00000000755CE000-memory.dmpFilesize
6.9MB
-
memory/1068-6-0x00000000050F0000-0x000000000514F000-memory.dmpFilesize
380KB
-
memory/1068-5-0x0000000000410000-0x0000000000422000-memory.dmpFilesize
72KB
-
memory/1068-3-0x0000000000FF0000-0x0000000000FF1000-memory.dmpFilesize
4KB
-
memory/1744-15-0x00000000027C0000-0x00000000027C4000-memory.dmpFilesize
16KB
-
memory/1744-12-0x0000000000000000-mapping.dmp
-
memory/2008-7-0x0000000000000000-mapping.dmp
-
memory/2020-23-0x0000000000000000-mapping.dmp
-
memory/2020-24-0x00000000020C0000-0x00000000020D1000-memory.dmpFilesize
68KB