Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-01-2021 05:59
General
-
Target
DHL Delivery Shipping, PDF.exe
-
Size
991KB
-
MD5
43df80ded0aa1f92951742b2dc2b916e
-
SHA1
0d37d5f1876431cd0345f72770e38302d07b194b
-
SHA256
3f416eb40a2f3043bb0e16cc684a3cecdae3fee9f340e4adf9ddb700e4bf2cfd
-
SHA512
16216eaa505ffb11ecd0b61b50387fe242079dcc17158dc783df6c08d9884eeac4612a6586450a7957c2d425e1957905ca023d0733137844615577205e6ed338
Malware Config
Extracted
remcos
mikegrace2021.ddns.net:1999
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Suspicious use of SetThreadContext 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL Delivery Shipping, PDF.exe"C:\Users\Admin\AppData\Local\Temp\DHL Delivery Shipping, PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iJFAuLr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2D79.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\DHL Delivery Shipping, PDF.exe"C:\Users\Admin\AppData\Local\Temp\DHL Delivery Shipping, PDF.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
87eca2b66cd43417007d96477b68e169
SHA194b913308874981ed0d7d4ec38c79767de608a67
SHA256a87be6dc440199e57dc1291f8b3d195431e147b67c76900a8dc62be7dfbe141e
SHA512e67b9c9780ef9f19399a5f603e01f150c6204ca7b9996752efc81a0e9b91e9a9f2b5647942d5a7d6f1564c807806ef82878c4fe9b26bd0a6bc840b6bc5ccc379
-
-
Filesize
132KB
-
-
Filesize
132KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
376KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB