Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-01-2021 06:01
General
-
Target
Shipping Document PL& BL 960.exe
-
Size
1001KB
-
MD5
eb305d3d7f3a4b7fe158d41522458d27
-
SHA1
20916b0fbaee03bdb6da50b8d1c75a1b77eeaa0c
-
SHA256
3dde92f19924860f0874ee0fe3fab80a1112c20e18d9782528bd7c471f0f2344
-
SHA512
e81c7710556d79a5d60aeb7488408087cb8450599f483c1d4875da7487bebc88225515763f77e74eabda98c6e1fe364e54a9cdece966616a2d1a9dabc1255614
Malware Config
Extracted
remcos
favour2021.ddns.net:1990
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Suspicious use of SetThreadContext 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipping Document PL& BL 960.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Document PL& BL 960.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zkjAtOCJCxw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp45A5.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Shipping Document PL& BL 960.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Document PL& BL 960.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp45A5.tmpMD5
8bf08adb94057f5b53d39db2cc8abec1
SHA1938e2b44632295145d9cb03c4202da2b2b3e06b0
SHA2563eade89534ee27a532932ae04c97a86cd2445afd030b898ba76a674537937dd3
SHA5126aec98c21705a2abf4feab345ef631c8ec404132f2bf9eaaaab4e3eee9cbcf991a45ddf5d8b58e04ae44c4b1dd2e45d6b6d51b73394dbb88b2f3d9abc08801b3
-
memory/428-16-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/428-15-0x0000000000413FA4-mapping.dmp
-
memory/428-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3092-12-0x0000000000000000-mapping.dmp
-
memory/4700-6-0x00000000050C0000-0x00000000050C1000-memory.dmpFilesize
4KB
-
memory/4700-9-0x0000000004E20000-0x0000000004E21000-memory.dmpFilesize
4KB
-
memory/4700-10-0x0000000004C40000-0x0000000004C52000-memory.dmpFilesize
72KB
-
memory/4700-11-0x00000000058E0000-0x000000000593D000-memory.dmpFilesize
372KB
-
memory/4700-8-0x0000000004C00000-0x0000000004C01000-memory.dmpFilesize
4KB
-
memory/4700-7-0x0000000004C60000-0x0000000004C61000-memory.dmpFilesize
4KB
-
memory/4700-2-0x0000000073CE0000-0x00000000743CE000-memory.dmpFilesize
6.9MB
-
memory/4700-5-0x0000000004B20000-0x0000000004B21000-memory.dmpFilesize
4KB
-
memory/4700-3-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB