Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-01-2021 07:26
Static task
static1
Behavioral task
behavioral1
Sample
2CBPOfVTs5QeG8Z.exe
Resource
win7v20201028
General
-
Target
2CBPOfVTs5QeG8Z.exe
-
Size
725KB
-
MD5
7b709e3928fa5d957244a6620d546a7e
-
SHA1
fd6f4702fe9bcdcfc9555f50b2917ff6ca00ba12
-
SHA256
4e9dc740909974e7e5c1f5618bfba6192ada1ab988173685a50280bb4d232a5f
-
SHA512
4ecfad7f2221a1d37997aa40fc45bfb88a2630021cc3506b1c641a18913fb5944508f31f80f6b0d297031e3349d6a5034bb72c2a5ece181ce841576326faf970
Malware Config
Extracted
remcos
185.244.26.208:29100
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
remcos.exeremcos.exepid process 3060 remcos.exe 3996 remcos.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
2CBPOfVTs5QeG8Z.exeremcos.exeremcos.exedescription pid process target process PID 816 set thread context of 1432 816 2CBPOfVTs5QeG8Z.exe 2CBPOfVTs5QeG8Z.exe PID 3060 set thread context of 3996 3060 remcos.exe remcos.exe PID 3996 set thread context of 2916 3996 remcos.exe svchost.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 1 IoCs
Processes:
2CBPOfVTs5QeG8Z.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings 2CBPOfVTs5QeG8Z.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
2CBPOfVTs5QeG8Z.exeremcos.exepid process 816 2CBPOfVTs5QeG8Z.exe 3060 remcos.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2CBPOfVTs5QeG8Z.exeremcos.exedescription pid process Token: SeDebugPrivilege 816 2CBPOfVTs5QeG8Z.exe Token: SeDebugPrivilege 3060 remcos.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
remcos.exepid process 3996 remcos.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
2CBPOfVTs5QeG8Z.exe2CBPOfVTs5QeG8Z.exeWScript.execmd.exeremcos.exeremcos.exedescription pid process target process PID 816 wrote to memory of 424 816 2CBPOfVTs5QeG8Z.exe schtasks.exe PID 816 wrote to memory of 424 816 2CBPOfVTs5QeG8Z.exe schtasks.exe PID 816 wrote to memory of 424 816 2CBPOfVTs5QeG8Z.exe schtasks.exe PID 816 wrote to memory of 1432 816 2CBPOfVTs5QeG8Z.exe 2CBPOfVTs5QeG8Z.exe PID 816 wrote to memory of 1432 816 2CBPOfVTs5QeG8Z.exe 2CBPOfVTs5QeG8Z.exe PID 816 wrote to memory of 1432 816 2CBPOfVTs5QeG8Z.exe 2CBPOfVTs5QeG8Z.exe PID 816 wrote to memory of 1432 816 2CBPOfVTs5QeG8Z.exe 2CBPOfVTs5QeG8Z.exe PID 816 wrote to memory of 1432 816 2CBPOfVTs5QeG8Z.exe 2CBPOfVTs5QeG8Z.exe PID 816 wrote to memory of 1432 816 2CBPOfVTs5QeG8Z.exe 2CBPOfVTs5QeG8Z.exe PID 816 wrote to memory of 1432 816 2CBPOfVTs5QeG8Z.exe 2CBPOfVTs5QeG8Z.exe PID 816 wrote to memory of 1432 816 2CBPOfVTs5QeG8Z.exe 2CBPOfVTs5QeG8Z.exe PID 816 wrote to memory of 1432 816 2CBPOfVTs5QeG8Z.exe 2CBPOfVTs5QeG8Z.exe PID 816 wrote to memory of 1432 816 2CBPOfVTs5QeG8Z.exe 2CBPOfVTs5QeG8Z.exe PID 1432 wrote to memory of 1344 1432 2CBPOfVTs5QeG8Z.exe WScript.exe PID 1432 wrote to memory of 1344 1432 2CBPOfVTs5QeG8Z.exe WScript.exe PID 1432 wrote to memory of 1344 1432 2CBPOfVTs5QeG8Z.exe WScript.exe PID 1344 wrote to memory of 3028 1344 WScript.exe cmd.exe PID 1344 wrote to memory of 3028 1344 WScript.exe cmd.exe PID 1344 wrote to memory of 3028 1344 WScript.exe cmd.exe PID 3028 wrote to memory of 3060 3028 cmd.exe remcos.exe PID 3028 wrote to memory of 3060 3028 cmd.exe remcos.exe PID 3028 wrote to memory of 3060 3028 cmd.exe remcos.exe PID 3060 wrote to memory of 3188 3060 remcos.exe schtasks.exe PID 3060 wrote to memory of 3188 3060 remcos.exe schtasks.exe PID 3060 wrote to memory of 3188 3060 remcos.exe schtasks.exe PID 3060 wrote to memory of 3996 3060 remcos.exe remcos.exe PID 3060 wrote to memory of 3996 3060 remcos.exe remcos.exe PID 3060 wrote to memory of 3996 3060 remcos.exe remcos.exe PID 3060 wrote to memory of 3996 3060 remcos.exe remcos.exe PID 3060 wrote to memory of 3996 3060 remcos.exe remcos.exe PID 3060 wrote to memory of 3996 3060 remcos.exe remcos.exe PID 3060 wrote to memory of 3996 3060 remcos.exe remcos.exe PID 3060 wrote to memory of 3996 3060 remcos.exe remcos.exe PID 3060 wrote to memory of 3996 3060 remcos.exe remcos.exe PID 3060 wrote to memory of 3996 3060 remcos.exe remcos.exe PID 3996 wrote to memory of 2916 3996 remcos.exe svchost.exe PID 3996 wrote to memory of 2916 3996 remcos.exe svchost.exe PID 3996 wrote to memory of 2916 3996 remcos.exe svchost.exe PID 3996 wrote to memory of 2916 3996 remcos.exe svchost.exe PID 3996 wrote to memory of 2916 3996 remcos.exe svchost.exe PID 3996 wrote to memory of 2916 3996 remcos.exe svchost.exe PID 3996 wrote to memory of 2916 3996 remcos.exe svchost.exe PID 3996 wrote to memory of 2916 3996 remcos.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2CBPOfVTs5QeG8Z.exe"C:\Users\Admin\AppData\Local\Temp\2CBPOfVTs5QeG8Z.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ERojaNssrIHFaE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp329A.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\2CBPOfVTs5QeG8Z.exe"C:\Users\Admin\AppData\Local\Temp\2CBPOfVTs5QeG8Z.exe"2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ERojaNssrIHFaE" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDD7.tmp"6⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe7⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
b92d64fe5b1d1f59df4b738262aea8df
SHA1c8fb1981759c2d9bb2ec91b705985fba5fc7af63
SHA256fa20e9aab03dc8e9f1910aaf0cf42662379fa16ae3a22642084fb97fa3d4f83a
SHA5122566248b93c0cfb0414f033b8dd18bbd4f88180093eac2861107289bcb4ee160f9593706ff1f7d1f2e4ecea430d67a5a2897551a4f9ebd82b707243e300520e2
-
C:\Users\Admin\AppData\Local\Temp\tmp329A.tmpMD5
5180e20a9de7deb876b615320d51a84f
SHA1d114b5ebed9e8ce7e02a7c6fc8d919e2ea3cda63
SHA256b264e2ea7400da07158b381c61aa1b07d7f41ba84295d739684876f8d5a1917c
SHA512e2904c167ad1fba4176a75d60be7489b4479ee3d4fee085a02be6a55316c706eac88a5e6ffc8c5d25947b0b5b76e136f1dd35366f946ba2740a4b028eacc2a45
-
C:\Users\Admin\AppData\Local\Temp\tmpDD7.tmpMD5
5180e20a9de7deb876b615320d51a84f
SHA1d114b5ebed9e8ce7e02a7c6fc8d919e2ea3cda63
SHA256b264e2ea7400da07158b381c61aa1b07d7f41ba84295d739684876f8d5a1917c
SHA512e2904c167ad1fba4176a75d60be7489b4479ee3d4fee085a02be6a55316c706eac88a5e6ffc8c5d25947b0b5b76e136f1dd35366f946ba2740a4b028eacc2a45
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
7b709e3928fa5d957244a6620d546a7e
SHA1fd6f4702fe9bcdcfc9555f50b2917ff6ca00ba12
SHA2564e9dc740909974e7e5c1f5618bfba6192ada1ab988173685a50280bb4d232a5f
SHA5124ecfad7f2221a1d37997aa40fc45bfb88a2630021cc3506b1c641a18913fb5944508f31f80f6b0d297031e3349d6a5034bb72c2a5ece181ce841576326faf970
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
7b709e3928fa5d957244a6620d546a7e
SHA1fd6f4702fe9bcdcfc9555f50b2917ff6ca00ba12
SHA2564e9dc740909974e7e5c1f5618bfba6192ada1ab988173685a50280bb4d232a5f
SHA5124ecfad7f2221a1d37997aa40fc45bfb88a2630021cc3506b1c641a18913fb5944508f31f80f6b0d297031e3349d6a5034bb72c2a5ece181ce841576326faf970
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
7b709e3928fa5d957244a6620d546a7e
SHA1fd6f4702fe9bcdcfc9555f50b2917ff6ca00ba12
SHA2564e9dc740909974e7e5c1f5618bfba6192ada1ab988173685a50280bb4d232a5f
SHA5124ecfad7f2221a1d37997aa40fc45bfb88a2630021cc3506b1c641a18913fb5944508f31f80f6b0d297031e3349d6a5034bb72c2a5ece181ce841576326faf970
-
memory/424-12-0x0000000000000000-mapping.dmp
-
memory/816-7-0x0000000004D80000-0x0000000004D81000-memory.dmpFilesize
4KB
-
memory/816-11-0x0000000005A00000-0x0000000005A5E000-memory.dmpFilesize
376KB
-
memory/816-10-0x0000000004D30000-0x0000000004D42000-memory.dmpFilesize
72KB
-
memory/816-9-0x0000000004F70000-0x0000000004F71000-memory.dmpFilesize
4KB
-
memory/816-8-0x0000000004C40000-0x0000000004C41000-memory.dmpFilesize
4KB
-
memory/816-6-0x0000000005280000-0x0000000005281000-memory.dmpFilesize
4KB
-
memory/816-5-0x0000000004C90000-0x0000000004C91000-memory.dmpFilesize
4KB
-
memory/816-2-0x0000000074070000-0x000000007475E000-memory.dmpFilesize
6.9MB
-
memory/816-3-0x0000000000380000-0x0000000000381000-memory.dmpFilesize
4KB
-
memory/1344-17-0x0000000000000000-mapping.dmp
-
memory/1432-16-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1432-15-0x0000000000413FA4-mapping.dmp
-
memory/1432-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2916-39-0x0000000000400000-0x00000000004BC000-memory.dmpFilesize
752KB
-
memory/2916-40-0x00000000004B6846-mapping.dmp
-
memory/3028-19-0x0000000000000000-mapping.dmp
-
memory/3060-20-0x0000000000000000-mapping.dmp
-
memory/3060-23-0x0000000074070000-0x000000007475E000-memory.dmpFilesize
6.9MB
-
memory/3188-33-0x0000000000000000-mapping.dmp
-
memory/3996-36-0x0000000000413FA4-mapping.dmp
-
memory/3996-38-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB