Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-01-2021 07:10
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Quotation.exe
Resource
win10v20201028
General
-
Target
Quotation.exe
-
Size
163KB
-
MD5
5d3efb4803c5ec263edc87d268c6035b
-
SHA1
d16a17af079d759e90f6fbb955455e00dd5d6df6
-
SHA256
6a9beed2218eb04e929a87b8e1e1fb1f5d3197136c96b434e82f9dd62e71233c
-
SHA512
1ed1da2650690e98aa10c498f8bba6562169a54bcb28a7cad53818c1f077de777de7d4888a4da8ef7a4c5a0b31d11b52357f01749ec51f391f46e17fc2045913
Malware Config
Extracted
remcos
whatgodcannotdodoestnotexist.duckdns.org:2889
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
remcos.exeremcos.exepid process 1108 remcos.exe 1092 remcos.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 1508 cmd.exe 1508 cmd.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
Quotation.exeremcos.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Quotation.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" Quotation.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" remcos.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Quotation.exeremcos.exedescription pid process target process PID 1676 set thread context of 2028 1676 Quotation.exe Quotation.exe PID 1108 set thread context of 1092 1108 remcos.exe remcos.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Quotation.exeremcos.exepid process 1676 Quotation.exe 1108 remcos.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
remcos.exepid process 1092 remcos.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
Quotation.execmd.exeQuotation.exeWScript.execmd.exeremcos.exedescription pid process target process PID 1676 wrote to memory of 1212 1676 Quotation.exe cmd.exe PID 1676 wrote to memory of 1212 1676 Quotation.exe cmd.exe PID 1676 wrote to memory of 1212 1676 Quotation.exe cmd.exe PID 1676 wrote to memory of 1212 1676 Quotation.exe cmd.exe PID 1676 wrote to memory of 2028 1676 Quotation.exe Quotation.exe PID 1676 wrote to memory of 2028 1676 Quotation.exe Quotation.exe PID 1676 wrote to memory of 2028 1676 Quotation.exe Quotation.exe PID 1676 wrote to memory of 2028 1676 Quotation.exe Quotation.exe PID 1676 wrote to memory of 2028 1676 Quotation.exe Quotation.exe PID 1212 wrote to memory of 2032 1212 cmd.exe schtasks.exe PID 1212 wrote to memory of 2032 1212 cmd.exe schtasks.exe PID 1212 wrote to memory of 2032 1212 cmd.exe schtasks.exe PID 1212 wrote to memory of 2032 1212 cmd.exe schtasks.exe PID 2028 wrote to memory of 788 2028 Quotation.exe WScript.exe PID 2028 wrote to memory of 788 2028 Quotation.exe WScript.exe PID 2028 wrote to memory of 788 2028 Quotation.exe WScript.exe PID 2028 wrote to memory of 788 2028 Quotation.exe WScript.exe PID 788 wrote to memory of 1508 788 WScript.exe cmd.exe PID 788 wrote to memory of 1508 788 WScript.exe cmd.exe PID 788 wrote to memory of 1508 788 WScript.exe cmd.exe PID 788 wrote to memory of 1508 788 WScript.exe cmd.exe PID 1508 wrote to memory of 1108 1508 cmd.exe remcos.exe PID 1508 wrote to memory of 1108 1508 cmd.exe remcos.exe PID 1508 wrote to memory of 1108 1508 cmd.exe remcos.exe PID 1508 wrote to memory of 1108 1508 cmd.exe remcos.exe PID 1108 wrote to memory of 1092 1108 remcos.exe remcos.exe PID 1108 wrote to memory of 1092 1108 remcos.exe remcos.exe PID 1108 wrote to memory of 1092 1108 remcos.exe remcos.exe PID 1108 wrote to memory of 1092 1108 remcos.exe remcos.exe PID 1108 wrote to memory of 1092 1108 remcos.exe remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\1f3091a968c34196a6722074c331f0f3.xml"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\1f3091a968c34196a6722074c331f0f3.xml"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1f3091a968c34196a6722074c331f0f3.xmlMD5
9313352a59e3b368ab4eb8173567c406
SHA1fc776c28e3ae9bd5e68f25c2a4f6248126731370
SHA256469d4994320f37196faca4de8ada85161a43dd42c9405b283bea5e4ea84c9a8d
SHA512000f6edf387b4ea0f244003fad3f66be5eb1920012838ba3a19c3f2dcde973fce8450c8e556c22cc20f7a3a0980d735fb169ecfafd440993c9fe5b8875fc7462
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
b92d64fe5b1d1f59df4b738262aea8df
SHA1c8fb1981759c2d9bb2ec91b705985fba5fc7af63
SHA256fa20e9aab03dc8e9f1910aaf0cf42662379fa16ae3a22642084fb97fa3d4f83a
SHA5122566248b93c0cfb0414f033b8dd18bbd4f88180093eac2861107289bcb4ee160f9593706ff1f7d1f2e4ecea430d67a5a2897551a4f9ebd82b707243e300520e2
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
5d3efb4803c5ec263edc87d268c6035b
SHA1d16a17af079d759e90f6fbb955455e00dd5d6df6
SHA2566a9beed2218eb04e929a87b8e1e1fb1f5d3197136c96b434e82f9dd62e71233c
SHA5121ed1da2650690e98aa10c498f8bba6562169a54bcb28a7cad53818c1f077de777de7d4888a4da8ef7a4c5a0b31d11b52357f01749ec51f391f46e17fc2045913
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
5d3efb4803c5ec263edc87d268c6035b
SHA1d16a17af079d759e90f6fbb955455e00dd5d6df6
SHA2566a9beed2218eb04e929a87b8e1e1fb1f5d3197136c96b434e82f9dd62e71233c
SHA5121ed1da2650690e98aa10c498f8bba6562169a54bcb28a7cad53818c1f077de777de7d4888a4da8ef7a4c5a0b31d11b52357f01749ec51f391f46e17fc2045913
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
5d3efb4803c5ec263edc87d268c6035b
SHA1d16a17af079d759e90f6fbb955455e00dd5d6df6
SHA2566a9beed2218eb04e929a87b8e1e1fb1f5d3197136c96b434e82f9dd62e71233c
SHA5121ed1da2650690e98aa10c498f8bba6562169a54bcb28a7cad53818c1f077de777de7d4888a4da8ef7a4c5a0b31d11b52357f01749ec51f391f46e17fc2045913
-
\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
5d3efb4803c5ec263edc87d268c6035b
SHA1d16a17af079d759e90f6fbb955455e00dd5d6df6
SHA2566a9beed2218eb04e929a87b8e1e1fb1f5d3197136c96b434e82f9dd62e71233c
SHA5121ed1da2650690e98aa10c498f8bba6562169a54bcb28a7cad53818c1f077de777de7d4888a4da8ef7a4c5a0b31d11b52357f01749ec51f391f46e17fc2045913
-
\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
5d3efb4803c5ec263edc87d268c6035b
SHA1d16a17af079d759e90f6fbb955455e00dd5d6df6
SHA2566a9beed2218eb04e929a87b8e1e1fb1f5d3197136c96b434e82f9dd62e71233c
SHA5121ed1da2650690e98aa10c498f8bba6562169a54bcb28a7cad53818c1f077de777de7d4888a4da8ef7a4c5a0b31d11b52357f01749ec51f391f46e17fc2045913
-
memory/788-11-0x0000000002760000-0x0000000002764000-memory.dmpFilesize
16KB
-
memory/788-8-0x0000000000000000-mapping.dmp
-
memory/1092-18-0x0000000000413FA4-mapping.dmp
-
memory/1108-20-0x0000000000460000-0x0000000000481000-memory.dmpFilesize
132KB
-
memory/1108-15-0x0000000000000000-mapping.dmp
-
memory/1212-2-0x0000000000000000-mapping.dmp
-
memory/1508-10-0x0000000000000000-mapping.dmp
-
memory/2028-6-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2028-4-0x0000000000413FA4-mapping.dmp
-
memory/2028-3-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2032-5-0x0000000000000000-mapping.dmp