Overview

overview

10

Static

static

HESAP BILGISI.PDF.exe

windows7_x64

10

HESAP BILGISI.PDF.exe

windows10_x64

10

Analysis

  • max time kernel
    54s
  • max time network
    147s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    15-01-2021 15:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    HESAP BILGISI.PDF.exe

  • Size

    361KB

  • MD5

    0b3fd095b95a6e7ff50a33e9bd83af8d

  • SHA1

    e8910f1987f3c2b39b37885790aea305c8e09fec

  • SHA256

    a81dc80c4e292405023f9c59504e55045ca754901cd06185d041642ce91a33b2

  • SHA512

    3dda5d4cd455034b8035985e2c783d7f2a8cb084ccf20dea04245c94368aff2053dab688c4512c51a127bce259aef485847ac2ebee86b66b1895e3300fa0c8d9

Score
10/10
remcosrat

Malware Config

Extracted

Family

remcos

C2

72.11.157.241:4445

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Suspicious use of SetThreadContext 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HESAP BILGISI.PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\HESAP BILGISI.PDF.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:64
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      2⤵
        PID:3168
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        2⤵
          PID:3200
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\8aae0b435fd34ae29e083423960fb4e2.xml"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1968
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\8aae0b435fd34ae29e083423960fb4e2.xml"
            3⤵
            • Creates scheduled task(s)
            PID:3604
        • C:\Users\Admin\AppData\Local\Temp\HESAP BILGISI.PDF.exe
          "C:\Users\Admin\AppData\Local\Temp\HESAP BILGISI.PDF.exe"
          2⤵
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2980

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Defense Evasion

      Credential Access

      Discovery

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\8aae0b435fd34ae29e083423960fb4e2.xml
        MD5

        a36564afc14b3eb0849c01a3afdb9944

        SHA1

        4dcee9fae3fde4e46b08529bc0ba067150686f07

        SHA256

        9d4342f763c5d62a06f69aa6fdcb1caa376ff2f2c0972f36b487f73b4d221996

        SHA512

        782082aa36ae056734e90fc079c813dfef59420571a1b70cde4cf15eb6c870f85b2bfe0748ef4db9df3d010c08671bff744d78178ba75bf2ba02b665f044ae89

        Download Submit
      • memory/1968-4-0x0000000000000000-mapping.dmp
        Download
      • memory/2980-5-0x0000000000400000-0x0000000000419000-memory.dmp
        Filesize

        100KB

        Download
      • memory/2980-6-0x00000000004172EC-mapping.dmp
        Download
      • memory/2980-9-0x0000000000400000-0x0000000000419000-memory.dmp
        Filesize

        100KB

        Download
      • memory/2980-10-0x0000000000400000-0x0000000000419000-memory.dmp
        Filesize

        100KB

        Download
      • memory/3168-2-0x0000000000000000-mapping.dmp
        Download
      • memory/3200-3-0x0000000000000000-mapping.dmp
        Download
      • memory/3604-8-0x0000000000000000-mapping.dmp
        Download