Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
12-01-2021 07:23
Static task
static1
Behavioral task
behavioral1
Sample
i5TiYkAYkWJy1O8.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
i5TiYkAYkWJy1O8.exe
Resource
win10v20201028
General
-
Target
i5TiYkAYkWJy1O8.exe
-
Size
772KB
-
MD5
e17a0488de5ca3c73672541143ee6927
-
SHA1
8a4c59f81c17710e665fb3e055dc1cbd28bc8ce6
-
SHA256
596479cd77e25e5d6dbf0b421afff049390813cc254ae90f86af00a10bdf6f90
-
SHA512
6766459cca6b6a25902973ca210e274241841e7acd2684ccb3f362040e3dbd568f1b430d305e773e50e0ec1e5e7cd879d8f3aff7d4cc30ce0a786be58555537d
Malware Config
Extracted
remcos
185.244.26.208:29100
Signatures
-
Executes dropped EXE 5 IoCs
Processes:
remcos.exeremcos.exeremcos.exeremcos.exeremcos.exepid process 1748 remcos.exe 2892 remcos.exe 4088 remcos.exe 4064 remcos.exe 3336 remcos.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
i5TiYkAYkWJy1O8.exeremcos.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ i5TiYkAYkWJy1O8.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" i5TiYkAYkWJy1O8.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" remcos.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
i5TiYkAYkWJy1O8.exeremcos.exeremcos.exedescription pid process target process PID 4760 set thread context of 908 4760 i5TiYkAYkWJy1O8.exe i5TiYkAYkWJy1O8.exe PID 1748 set thread context of 2892 1748 remcos.exe remcos.exe PID 2892 set thread context of 4088 2892 remcos.exe remcos.exe PID 2892 set thread context of 4064 2892 remcos.exe remcos.exe PID 2892 set thread context of 3336 2892 remcos.exe remcos.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 1 IoCs
Processes:
i5TiYkAYkWJy1O8.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings i5TiYkAYkWJy1O8.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
i5TiYkAYkWJy1O8.exeremcos.exeremcos.exeremcos.exepid process 4760 i5TiYkAYkWJy1O8.exe 1748 remcos.exe 4088 remcos.exe 4088 remcos.exe 4064 remcos.exe 4064 remcos.exe 4088 remcos.exe 4088 remcos.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
i5TiYkAYkWJy1O8.exeremcos.exeremcos.exedescription pid process Token: SeDebugPrivilege 4760 i5TiYkAYkWJy1O8.exe Token: SeDebugPrivilege 1748 remcos.exe Token: SeDebugPrivilege 4064 remcos.exe -
Suspicious use of WriteProcessMemory 59 IoCs
Processes:
i5TiYkAYkWJy1O8.exei5TiYkAYkWJy1O8.exeWScript.execmd.exeremcos.exeremcos.exedescription pid process target process PID 4760 wrote to memory of 508 4760 i5TiYkAYkWJy1O8.exe schtasks.exe PID 4760 wrote to memory of 508 4760 i5TiYkAYkWJy1O8.exe schtasks.exe PID 4760 wrote to memory of 508 4760 i5TiYkAYkWJy1O8.exe schtasks.exe PID 4760 wrote to memory of 908 4760 i5TiYkAYkWJy1O8.exe i5TiYkAYkWJy1O8.exe PID 4760 wrote to memory of 908 4760 i5TiYkAYkWJy1O8.exe i5TiYkAYkWJy1O8.exe PID 4760 wrote to memory of 908 4760 i5TiYkAYkWJy1O8.exe i5TiYkAYkWJy1O8.exe PID 4760 wrote to memory of 908 4760 i5TiYkAYkWJy1O8.exe i5TiYkAYkWJy1O8.exe PID 4760 wrote to memory of 908 4760 i5TiYkAYkWJy1O8.exe i5TiYkAYkWJy1O8.exe PID 4760 wrote to memory of 908 4760 i5TiYkAYkWJy1O8.exe i5TiYkAYkWJy1O8.exe PID 4760 wrote to memory of 908 4760 i5TiYkAYkWJy1O8.exe i5TiYkAYkWJy1O8.exe PID 4760 wrote to memory of 908 4760 i5TiYkAYkWJy1O8.exe i5TiYkAYkWJy1O8.exe PID 4760 wrote to memory of 908 4760 i5TiYkAYkWJy1O8.exe i5TiYkAYkWJy1O8.exe PID 4760 wrote to memory of 908 4760 i5TiYkAYkWJy1O8.exe i5TiYkAYkWJy1O8.exe PID 908 wrote to memory of 1168 908 i5TiYkAYkWJy1O8.exe WScript.exe PID 908 wrote to memory of 1168 908 i5TiYkAYkWJy1O8.exe WScript.exe PID 908 wrote to memory of 1168 908 i5TiYkAYkWJy1O8.exe WScript.exe PID 1168 wrote to memory of 1468 1168 WScript.exe cmd.exe PID 1168 wrote to memory of 1468 1168 WScript.exe cmd.exe PID 1168 wrote to memory of 1468 1168 WScript.exe cmd.exe PID 1468 wrote to memory of 1748 1468 cmd.exe remcos.exe PID 1468 wrote to memory of 1748 1468 cmd.exe remcos.exe PID 1468 wrote to memory of 1748 1468 cmd.exe remcos.exe PID 1748 wrote to memory of 2388 1748 remcos.exe schtasks.exe PID 1748 wrote to memory of 2388 1748 remcos.exe schtasks.exe PID 1748 wrote to memory of 2388 1748 remcos.exe schtasks.exe PID 1748 wrote to memory of 2892 1748 remcos.exe remcos.exe PID 1748 wrote to memory of 2892 1748 remcos.exe remcos.exe PID 1748 wrote to memory of 2892 1748 remcos.exe remcos.exe PID 1748 wrote to memory of 2892 1748 remcos.exe remcos.exe PID 1748 wrote to memory of 2892 1748 remcos.exe remcos.exe PID 1748 wrote to memory of 2892 1748 remcos.exe remcos.exe PID 1748 wrote to memory of 2892 1748 remcos.exe remcos.exe PID 1748 wrote to memory of 2892 1748 remcos.exe remcos.exe PID 1748 wrote to memory of 2892 1748 remcos.exe remcos.exe PID 1748 wrote to memory of 2892 1748 remcos.exe remcos.exe PID 2892 wrote to memory of 4088 2892 remcos.exe remcos.exe PID 2892 wrote to memory of 4088 2892 remcos.exe remcos.exe PID 2892 wrote to memory of 4088 2892 remcos.exe remcos.exe PID 2892 wrote to memory of 4088 2892 remcos.exe remcos.exe PID 2892 wrote to memory of 4088 2892 remcos.exe remcos.exe PID 2892 wrote to memory of 4088 2892 remcos.exe remcos.exe PID 2892 wrote to memory of 4088 2892 remcos.exe remcos.exe PID 2892 wrote to memory of 4088 2892 remcos.exe remcos.exe PID 2892 wrote to memory of 4064 2892 remcos.exe remcos.exe PID 2892 wrote to memory of 4064 2892 remcos.exe remcos.exe PID 2892 wrote to memory of 4064 2892 remcos.exe remcos.exe PID 2892 wrote to memory of 4064 2892 remcos.exe remcos.exe PID 2892 wrote to memory of 4064 2892 remcos.exe remcos.exe PID 2892 wrote to memory of 4064 2892 remcos.exe remcos.exe PID 2892 wrote to memory of 4064 2892 remcos.exe remcos.exe PID 2892 wrote to memory of 4064 2892 remcos.exe remcos.exe PID 2892 wrote to memory of 3336 2892 remcos.exe remcos.exe PID 2892 wrote to memory of 3336 2892 remcos.exe remcos.exe PID 2892 wrote to memory of 3336 2892 remcos.exe remcos.exe PID 2892 wrote to memory of 3336 2892 remcos.exe remcos.exe PID 2892 wrote to memory of 3336 2892 remcos.exe remcos.exe PID 2892 wrote to memory of 3336 2892 remcos.exe remcos.exe PID 2892 wrote to memory of 3336 2892 remcos.exe remcos.exe PID 2892 wrote to memory of 3336 2892 remcos.exe remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\i5TiYkAYkWJy1O8.exe"C:\Users\Admin\AppData\Local\Temp\i5TiYkAYkWJy1O8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LChCpmvhHgIatd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3D19.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\i5TiYkAYkWJy1O8.exe"C:\Users\Admin\AppData\Local\Temp\i5TiYkAYkWJy1O8.exe"2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LChCpmvhHgIatd" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1180.tmp"6⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\urfwampmozgnjgdmhfydn"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\xlkobfaobhysmurqqqlfyezt"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\hfpzcxlhppqxwanuasyybjtcjqn"7⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
b92d64fe5b1d1f59df4b738262aea8df
SHA1c8fb1981759c2d9bb2ec91b705985fba5fc7af63
SHA256fa20e9aab03dc8e9f1910aaf0cf42662379fa16ae3a22642084fb97fa3d4f83a
SHA5122566248b93c0cfb0414f033b8dd18bbd4f88180093eac2861107289bcb4ee160f9593706ff1f7d1f2e4ecea430d67a5a2897551a4f9ebd82b707243e300520e2
-
C:\Users\Admin\AppData\Local\Temp\tmp1180.tmpMD5
93d196cf8fb190a168daa534c7ec1260
SHA194b808aadb78297ee4cde62fadf10889a2f8d36e
SHA2565e1405be4760de4b0982f1ecbaea1bce3a6ee1ecbd66dcfa1e639714805016d2
SHA5122a03acf4706d761b708279191533b60beebb3a02a867e79932afe7daa20c8d8e9049365a8c9165f32ca02e21a3158508f17e98ab2dc2e7503f3f9cd9fabad42e
-
C:\Users\Admin\AppData\Local\Temp\tmp3D19.tmpMD5
93d196cf8fb190a168daa534c7ec1260
SHA194b808aadb78297ee4cde62fadf10889a2f8d36e
SHA2565e1405be4760de4b0982f1ecbaea1bce3a6ee1ecbd66dcfa1e639714805016d2
SHA5122a03acf4706d761b708279191533b60beebb3a02a867e79932afe7daa20c8d8e9049365a8c9165f32ca02e21a3158508f17e98ab2dc2e7503f3f9cd9fabad42e
-
C:\Users\Admin\AppData\Local\Temp\urfwampmozgnjgdmhfydnMD5
1e69b6d630e694119f4f8c448a430b60
SHA1b118feca7d85ec706b54279a1dafc71673fe6e54
SHA2562f7eedbe9e3b0a3aa08df4fa2dc27de189484a8da8925cc6056513d744b7c00e
SHA51219924161f75cbbcf7bdf122f3aecb43d813186a6693413ccc15bb2945d48401c8f058edf034cc641cedc97ae5e328d88fabfab1b5f324014b83671b3ebd78822
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
e17a0488de5ca3c73672541143ee6927
SHA18a4c59f81c17710e665fb3e055dc1cbd28bc8ce6
SHA256596479cd77e25e5d6dbf0b421afff049390813cc254ae90f86af00a10bdf6f90
SHA5126766459cca6b6a25902973ca210e274241841e7acd2684ccb3f362040e3dbd568f1b430d305e773e50e0ec1e5e7cd879d8f3aff7d4cc30ce0a786be58555537d
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
e17a0488de5ca3c73672541143ee6927
SHA18a4c59f81c17710e665fb3e055dc1cbd28bc8ce6
SHA256596479cd77e25e5d6dbf0b421afff049390813cc254ae90f86af00a10bdf6f90
SHA5126766459cca6b6a25902973ca210e274241841e7acd2684ccb3f362040e3dbd568f1b430d305e773e50e0ec1e5e7cd879d8f3aff7d4cc30ce0a786be58555537d
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
e17a0488de5ca3c73672541143ee6927
SHA18a4c59f81c17710e665fb3e055dc1cbd28bc8ce6
SHA256596479cd77e25e5d6dbf0b421afff049390813cc254ae90f86af00a10bdf6f90
SHA5126766459cca6b6a25902973ca210e274241841e7acd2684ccb3f362040e3dbd568f1b430d305e773e50e0ec1e5e7cd879d8f3aff7d4cc30ce0a786be58555537d
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
e17a0488de5ca3c73672541143ee6927
SHA18a4c59f81c17710e665fb3e055dc1cbd28bc8ce6
SHA256596479cd77e25e5d6dbf0b421afff049390813cc254ae90f86af00a10bdf6f90
SHA5126766459cca6b6a25902973ca210e274241841e7acd2684ccb3f362040e3dbd568f1b430d305e773e50e0ec1e5e7cd879d8f3aff7d4cc30ce0a786be58555537d
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
e17a0488de5ca3c73672541143ee6927
SHA18a4c59f81c17710e665fb3e055dc1cbd28bc8ce6
SHA256596479cd77e25e5d6dbf0b421afff049390813cc254ae90f86af00a10bdf6f90
SHA5126766459cca6b6a25902973ca210e274241841e7acd2684ccb3f362040e3dbd568f1b430d305e773e50e0ec1e5e7cd879d8f3aff7d4cc30ce0a786be58555537d
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
e17a0488de5ca3c73672541143ee6927
SHA18a4c59f81c17710e665fb3e055dc1cbd28bc8ce6
SHA256596479cd77e25e5d6dbf0b421afff049390813cc254ae90f86af00a10bdf6f90
SHA5126766459cca6b6a25902973ca210e274241841e7acd2684ccb3f362040e3dbd568f1b430d305e773e50e0ec1e5e7cd879d8f3aff7d4cc30ce0a786be58555537d
-
memory/508-12-0x0000000000000000-mapping.dmp
-
memory/908-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/908-15-0x0000000000413FA4-mapping.dmp
-
memory/908-16-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1168-17-0x0000000000000000-mapping.dmp
-
memory/1468-19-0x0000000000000000-mapping.dmp
-
memory/1748-23-0x00000000732D0000-0x00000000739BE000-memory.dmpFilesize
6.9MB
-
memory/1748-20-0x0000000000000000-mapping.dmp
-
memory/2388-33-0x0000000000000000-mapping.dmp
-
memory/2892-38-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2892-36-0x0000000000413FA4-mapping.dmp
-
memory/3336-52-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/3336-53-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/3336-49-0x0000000000455238-mapping.dmp
-
memory/3336-48-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/4064-44-0x0000000000422206-mapping.dmp
-
memory/4064-50-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/4064-42-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/4064-47-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/4088-39-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4088-40-0x0000000000476274-mapping.dmp
-
memory/4088-43-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4088-45-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4760-6-0x0000000004FB0000-0x0000000004FB1000-memory.dmpFilesize
4KB
-
memory/4760-8-0x00000000049A0000-0x00000000049A1000-memory.dmpFilesize
4KB
-
memory/4760-9-0x0000000004C70000-0x0000000004C71000-memory.dmpFilesize
4KB
-
memory/4760-7-0x0000000004AB0000-0x0000000004AB1000-memory.dmpFilesize
4KB
-
memory/4760-2-0x00000000732D0000-0x00000000739BE000-memory.dmpFilesize
6.9MB
-
memory/4760-5-0x0000000004A10000-0x0000000004A11000-memory.dmpFilesize
4KB
-
memory/4760-10-0x00000000049F0000-0x0000000004A02000-memory.dmpFilesize
72KB
-
memory/4760-11-0x0000000005810000-0x000000000586F000-memory.dmpFilesize
380KB
-
memory/4760-3-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB