Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
15-01-2021 07:10
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Quotation.exe
Resource
win10v20201028
General
-
Target
Quotation.exe
-
Size
163KB
-
MD5
5d3efb4803c5ec263edc87d268c6035b
-
SHA1
d16a17af079d759e90f6fbb955455e00dd5d6df6
-
SHA256
6a9beed2218eb04e929a87b8e1e1fb1f5d3197136c96b434e82f9dd62e71233c
-
SHA512
1ed1da2650690e98aa10c498f8bba6562169a54bcb28a7cad53818c1f077de777de7d4888a4da8ef7a4c5a0b31d11b52357f01749ec51f391f46e17fc2045913
Malware Config
Extracted
remcos
whatgodcannotdodoestnotexist.duckdns.org:2889
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
remcos.exeremcos.exepid process 852 remcos.exe 1172 remcos.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
Quotation.exeremcos.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" Quotation.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" remcos.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Quotation.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Quotation.exeremcos.exedescription pid process target process PID 4804 set thread context of 820 4804 Quotation.exe Quotation.exe PID 852 set thread context of 1172 852 remcos.exe remcos.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 1 IoCs
Processes:
Quotation.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings Quotation.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
remcos.exepid process 1172 remcos.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Quotation.exeremcos.exepid process 4804 Quotation.exe 852 remcos.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
remcos.exepid process 1172 remcos.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
Quotation.execmd.exeQuotation.exeWScript.execmd.exeremcos.exedescription pid process target process PID 4804 wrote to memory of 788 4804 Quotation.exe cmd.exe PID 4804 wrote to memory of 788 4804 Quotation.exe cmd.exe PID 4804 wrote to memory of 788 4804 Quotation.exe cmd.exe PID 4804 wrote to memory of 820 4804 Quotation.exe Quotation.exe PID 4804 wrote to memory of 820 4804 Quotation.exe Quotation.exe PID 4804 wrote to memory of 820 4804 Quotation.exe Quotation.exe PID 4804 wrote to memory of 820 4804 Quotation.exe Quotation.exe PID 788 wrote to memory of 4396 788 cmd.exe schtasks.exe PID 788 wrote to memory of 4396 788 cmd.exe schtasks.exe PID 788 wrote to memory of 4396 788 cmd.exe schtasks.exe PID 820 wrote to memory of 3924 820 Quotation.exe WScript.exe PID 820 wrote to memory of 3924 820 Quotation.exe WScript.exe PID 820 wrote to memory of 3924 820 Quotation.exe WScript.exe PID 3924 wrote to memory of 452 3924 WScript.exe cmd.exe PID 3924 wrote to memory of 452 3924 WScript.exe cmd.exe PID 3924 wrote to memory of 452 3924 WScript.exe cmd.exe PID 452 wrote to memory of 852 452 cmd.exe remcos.exe PID 452 wrote to memory of 852 452 cmd.exe remcos.exe PID 452 wrote to memory of 852 452 cmd.exe remcos.exe PID 852 wrote to memory of 1172 852 remcos.exe remcos.exe PID 852 wrote to memory of 1172 852 remcos.exe remcos.exe PID 852 wrote to memory of 1172 852 remcos.exe remcos.exe PID 852 wrote to memory of 1172 852 remcos.exe remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\1f3091a968c34196a6722074c331f0f3.xml"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\1f3091a968c34196a6722074c331f0f3.xml"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1f3091a968c34196a6722074c331f0f3.xmlMD5
aa2f6636e997aaa0b01fbc78b1dabe52
SHA1fd462100fc91975dcbea8e361cf1eb8a70f6ad54
SHA256d710b6eda22285684579d8b547e5be2f48883c4bf8db39993b00df30f9dc8723
SHA5126540a3bbdbd3ab51679d5b32380e6c288bf6eba2777d067d40bfe65642ccafecd18028b102dfa46ac189d84282da2b6cb202a4f307587c5639f86834788f5104
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
b92d64fe5b1d1f59df4b738262aea8df
SHA1c8fb1981759c2d9bb2ec91b705985fba5fc7af63
SHA256fa20e9aab03dc8e9f1910aaf0cf42662379fa16ae3a22642084fb97fa3d4f83a
SHA5122566248b93c0cfb0414f033b8dd18bbd4f88180093eac2861107289bcb4ee160f9593706ff1f7d1f2e4ecea430d67a5a2897551a4f9ebd82b707243e300520e2
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
5d3efb4803c5ec263edc87d268c6035b
SHA1d16a17af079d759e90f6fbb955455e00dd5d6df6
SHA2566a9beed2218eb04e929a87b8e1e1fb1f5d3197136c96b434e82f9dd62e71233c
SHA5121ed1da2650690e98aa10c498f8bba6562169a54bcb28a7cad53818c1f077de777de7d4888a4da8ef7a4c5a0b31d11b52357f01749ec51f391f46e17fc2045913
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
5d3efb4803c5ec263edc87d268c6035b
SHA1d16a17af079d759e90f6fbb955455e00dd5d6df6
SHA2566a9beed2218eb04e929a87b8e1e1fb1f5d3197136c96b434e82f9dd62e71233c
SHA5121ed1da2650690e98aa10c498f8bba6562169a54bcb28a7cad53818c1f077de777de7d4888a4da8ef7a4c5a0b31d11b52357f01749ec51f391f46e17fc2045913
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
5d3efb4803c5ec263edc87d268c6035b
SHA1d16a17af079d759e90f6fbb955455e00dd5d6df6
SHA2566a9beed2218eb04e929a87b8e1e1fb1f5d3197136c96b434e82f9dd62e71233c
SHA5121ed1da2650690e98aa10c498f8bba6562169a54bcb28a7cad53818c1f077de777de7d4888a4da8ef7a4c5a0b31d11b52357f01749ec51f391f46e17fc2045913
-
memory/452-11-0x0000000000000000-mapping.dmp
-
memory/788-2-0x0000000000000000-mapping.dmp
-
memory/820-6-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/820-3-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/820-4-0x0000000000413FA4-mapping.dmp
-
memory/852-12-0x0000000000000000-mapping.dmp
-
memory/852-18-0x0000000000A60000-0x0000000000A81000-memory.dmpFilesize
132KB
-
memory/1172-16-0x0000000000413FA4-mapping.dmp
-
memory/3924-8-0x0000000000000000-mapping.dmp
-
memory/4396-7-0x0000000000000000-mapping.dmp