Overview

overview

10

Static

static

GREEN_MEKO...ST.exe

windows7_x64

10

GREEN_MEKO...ST.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    12-01-2021 18:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    GREEN_MEKONG-INQUIRY_LIST.exe

  • Size

    162KB

  • MD5

    42f7af3da7bc34f4c1e1a95ff617dfaa

  • SHA1

    554b5dd09a183b8a69d0be0568ed036036caae2d

  • SHA256

    0854f5df5291e4abbcf7cc57f29b3148007ede15c53f61244f9dfefb9669dc96

  • SHA512

    05d7af43ea27a89195fb6b852b57a06e8990aa95a4d321c709e9ba456c2656ad76d3d81fdc3834a6e56314141683873420f231098d12a5749fb1501029b9a4ef

Score
10/10
remcosrat

Malware Config

Extracted

Family

remcos

C2

212.83.46.26:4045

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Suspicious use of SetThreadContext 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\GREEN_MEKONG-INQUIRY_LIST.exe
    "C:\Users\Admin\AppData\Local\Temp\GREEN_MEKONG-INQUIRY_LIST.exe"
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3304
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\22ad41102e2a4e109ee128208bcedcac.xml"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3412
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\22ad41102e2a4e109ee128208bcedcac.xml"
        3⤵
        • Creates scheduled task(s)
        PID:3148
    • C:\Users\Admin\AppData\Local\Temp\GREEN_MEKONG-INQUIRY_LIST.exe
      "C:\Users\Admin\AppData\Local\Temp\GREEN_MEKONG-INQUIRY_LIST.exe"
      2⤵
        PID:3244
      • C:\Users\Admin\AppData\Local\Temp\GREEN_MEKONG-INQUIRY_LIST.exe
        "C:\Users\Admin\AppData\Local\Temp\GREEN_MEKONG-INQUIRY_LIST.exe"
        2⤵
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:3420
        • C:\Users\Admin\AppData\Local\Temp\GREEN_MEKONG-INQUIRY_LIST.exe
          "C:\Users\Admin\AppData\Local\Temp\GREEN_MEKONG-INQUIRY_LIST.exe"
          3⤵
            PID:712
          • C:\Users\Admin\AppData\Local\Temp\GREEN_MEKONG-INQUIRY_LIST.exe
            "C:\Users\Admin\AppData\Local\Temp\GREEN_MEKONG-INQUIRY_LIST.exe"
            3⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:752
            • C:\Users\Admin\AppData\Local\Temp\GREEN_MEKONG-INQUIRY_LIST.exe
              "C:\Users\Admin\AppData\Local\Temp\GREEN_MEKONG-INQUIRY_LIST.exe"
              4⤵
                PID:2976

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\22ad41102e2a4e109ee128208bcedcac.xml
          MD5

          a36564afc14b3eb0849c01a3afdb9944

          SHA1

          4dcee9fae3fde4e46b08529bc0ba067150686f07

          SHA256

          9d4342f763c5d62a06f69aa6fdcb1caa376ff2f2c0972f36b487f73b4d221996

          SHA512

          782082aa36ae056734e90fc079c813dfef59420571a1b70cde4cf15eb6c870f85b2bfe0748ef4db9df3d010c08671bff744d78178ba75bf2ba02b665f044ae89

          Download Submit

        • memory/752-5-0x0000000000000000-mapping.dmp

          Download

        • memory/2976-7-0x0000000000400000-0x0000000000417000-memory.dmp

          Filesize

          92KB

          Download

        • memory/2976-8-0x000000000040FD88-mapping.dmp

          Download

        • memory/2976-10-0x0000000000400000-0x0000000000417000-memory.dmp

          Filesize

          92KB

          Download

        • memory/3148-4-0x0000000000000000-mapping.dmp

          Download

        • memory/3412-2-0x0000000000000000-mapping.dmp

          Download

        • memory/3420-3-0x0000000000000000-mapping.dmp

          Download