Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-01-2021 07:03
Static task
static1
Behavioral task
behavioral1
Sample
77bae1e8054ce3da1f20b43d0040af17.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
77bae1e8054ce3da1f20b43d0040af17.exe
Resource
win10v20201028
General
-
Target
77bae1e8054ce3da1f20b43d0040af17.exe
-
Size
1.3MB
-
MD5
77bae1e8054ce3da1f20b43d0040af17
-
SHA1
6ee8ea745b8afcf7ebd921720964ae8d15443a7b
-
SHA256
9d61a9f459f8981483707df711e575931c3f637ec31b2befffce77d1ee486925
-
SHA512
0dd0f902a274334441435a979041e3fd4ca0a9d44a1acfe3fb1fe0280e65b6e7532dde24243b86164c470f4ce6cf0c1e47363df2a59bfbd06f6252079409cb64
Malware Config
Extracted
remcos
swryijgrvcsgkopnmcdertvgdswbvmophtfdczxs.ydns.eu:2017
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
vlc.exevlc.exepid process 1528 vlc.exe 844 vlc.exe -
Loads dropped DLL 5 IoCs
Processes:
cmd.exeWerFault.exepid process 1664 cmd.exe 1664 cmd.exe 820 WerFault.exe 820 WerFault.exe 820 WerFault.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
77bae1e8054ce3da1f20b43d0040af17.exevlc.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 77bae1e8054ce3da1f20b43d0040af17.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc.exe\"" 77bae1e8054ce3da1f20b43d0040af17.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ vlc.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc.exe\"" vlc.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
Processes:
77bae1e8054ce3da1f20b43d0040af17.exevlc.exepid process 1680 77bae1e8054ce3da1f20b43d0040af17.exe 1680 77bae1e8054ce3da1f20b43d0040af17.exe 1680 77bae1e8054ce3da1f20b43d0040af17.exe 1680 77bae1e8054ce3da1f20b43d0040af17.exe 1680 77bae1e8054ce3da1f20b43d0040af17.exe 1680 77bae1e8054ce3da1f20b43d0040af17.exe 1680 77bae1e8054ce3da1f20b43d0040af17.exe 1528 vlc.exe 1528 vlc.exe 1528 vlc.exe 1528 vlc.exe 1528 vlc.exe 1528 vlc.exe 1528 vlc.exe 1528 vlc.exe 1528 vlc.exe 1528 vlc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
77bae1e8054ce3da1f20b43d0040af17.exevlc.exedescription pid process target process PID 1680 set thread context of 1984 1680 77bae1e8054ce3da1f20b43d0040af17.exe 77bae1e8054ce3da1f20b43d0040af17.exe PID 1528 set thread context of 844 1528 vlc.exe vlc.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 512 1680 WerFault.exe 77bae1e8054ce3da1f20b43d0040af17.exe 820 1528 WerFault.exe vlc.exe -
Delays execution with timeout.exe 6 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 1448 timeout.exe 620 timeout.exe 1616 timeout.exe 1320 timeout.exe 620 timeout.exe 1700 timeout.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
77bae1e8054ce3da1f20b43d0040af17.exeWerFault.exevlc.exeWerFault.exepid process 1680 77bae1e8054ce3da1f20b43d0040af17.exe 1680 77bae1e8054ce3da1f20b43d0040af17.exe 1680 77bae1e8054ce3da1f20b43d0040af17.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 512 WerFault.exe 1528 vlc.exe 1528 vlc.exe 1528 vlc.exe 820 WerFault.exe 820 WerFault.exe 820 WerFault.exe 820 WerFault.exe 820 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 512 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
77bae1e8054ce3da1f20b43d0040af17.exeWerFault.exevlc.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1680 77bae1e8054ce3da1f20b43d0040af17.exe Token: SeDebugPrivilege 512 WerFault.exe Token: SeDebugPrivilege 1528 vlc.exe Token: SeDebugPrivilege 820 WerFault.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 844 vlc.exe -
Suspicious use of WriteProcessMemory 90 IoCs
Processes:
77bae1e8054ce3da1f20b43d0040af17.execmd.execmd.execmd.exe77bae1e8054ce3da1f20b43d0040af17.exeWScript.execmd.exevlc.execmd.execmd.exedescription pid process target process PID 1680 wrote to memory of 2012 1680 77bae1e8054ce3da1f20b43d0040af17.exe cmd.exe PID 1680 wrote to memory of 2012 1680 77bae1e8054ce3da1f20b43d0040af17.exe cmd.exe PID 1680 wrote to memory of 2012 1680 77bae1e8054ce3da1f20b43d0040af17.exe cmd.exe PID 1680 wrote to memory of 2012 1680 77bae1e8054ce3da1f20b43d0040af17.exe cmd.exe PID 2012 wrote to memory of 1700 2012 cmd.exe timeout.exe PID 2012 wrote to memory of 1700 2012 cmd.exe timeout.exe PID 2012 wrote to memory of 1700 2012 cmd.exe timeout.exe PID 2012 wrote to memory of 1700 2012 cmd.exe timeout.exe PID 1680 wrote to memory of 656 1680 77bae1e8054ce3da1f20b43d0040af17.exe cmd.exe PID 1680 wrote to memory of 656 1680 77bae1e8054ce3da1f20b43d0040af17.exe cmd.exe PID 1680 wrote to memory of 656 1680 77bae1e8054ce3da1f20b43d0040af17.exe cmd.exe PID 1680 wrote to memory of 656 1680 77bae1e8054ce3da1f20b43d0040af17.exe cmd.exe PID 656 wrote to memory of 1448 656 cmd.exe timeout.exe PID 656 wrote to memory of 1448 656 cmd.exe timeout.exe PID 656 wrote to memory of 1448 656 cmd.exe timeout.exe PID 656 wrote to memory of 1448 656 cmd.exe timeout.exe PID 1680 wrote to memory of 408 1680 77bae1e8054ce3da1f20b43d0040af17.exe cmd.exe PID 1680 wrote to memory of 408 1680 77bae1e8054ce3da1f20b43d0040af17.exe cmd.exe PID 1680 wrote to memory of 408 1680 77bae1e8054ce3da1f20b43d0040af17.exe cmd.exe PID 1680 wrote to memory of 408 1680 77bae1e8054ce3da1f20b43d0040af17.exe cmd.exe PID 408 wrote to memory of 620 408 cmd.exe timeout.exe PID 408 wrote to memory of 620 408 cmd.exe timeout.exe PID 408 wrote to memory of 620 408 cmd.exe timeout.exe PID 408 wrote to memory of 620 408 cmd.exe timeout.exe PID 1680 wrote to memory of 1984 1680 77bae1e8054ce3da1f20b43d0040af17.exe 77bae1e8054ce3da1f20b43d0040af17.exe PID 1680 wrote to memory of 1984 1680 77bae1e8054ce3da1f20b43d0040af17.exe 77bae1e8054ce3da1f20b43d0040af17.exe PID 1680 wrote to memory of 1984 1680 77bae1e8054ce3da1f20b43d0040af17.exe 77bae1e8054ce3da1f20b43d0040af17.exe PID 1680 wrote to memory of 1984 1680 77bae1e8054ce3da1f20b43d0040af17.exe 77bae1e8054ce3da1f20b43d0040af17.exe PID 1680 wrote to memory of 1984 1680 77bae1e8054ce3da1f20b43d0040af17.exe 77bae1e8054ce3da1f20b43d0040af17.exe PID 1680 wrote to memory of 1984 1680 77bae1e8054ce3da1f20b43d0040af17.exe 77bae1e8054ce3da1f20b43d0040af17.exe PID 1680 wrote to memory of 1984 1680 77bae1e8054ce3da1f20b43d0040af17.exe 77bae1e8054ce3da1f20b43d0040af17.exe PID 1680 wrote to memory of 1984 1680 77bae1e8054ce3da1f20b43d0040af17.exe 77bae1e8054ce3da1f20b43d0040af17.exe PID 1680 wrote to memory of 1984 1680 77bae1e8054ce3da1f20b43d0040af17.exe 77bae1e8054ce3da1f20b43d0040af17.exe PID 1680 wrote to memory of 1984 1680 77bae1e8054ce3da1f20b43d0040af17.exe 77bae1e8054ce3da1f20b43d0040af17.exe PID 1680 wrote to memory of 1984 1680 77bae1e8054ce3da1f20b43d0040af17.exe 77bae1e8054ce3da1f20b43d0040af17.exe PID 1984 wrote to memory of 908 1984 77bae1e8054ce3da1f20b43d0040af17.exe WScript.exe PID 1984 wrote to memory of 908 1984 77bae1e8054ce3da1f20b43d0040af17.exe WScript.exe PID 1984 wrote to memory of 908 1984 77bae1e8054ce3da1f20b43d0040af17.exe WScript.exe PID 1984 wrote to memory of 908 1984 77bae1e8054ce3da1f20b43d0040af17.exe WScript.exe PID 1680 wrote to memory of 512 1680 77bae1e8054ce3da1f20b43d0040af17.exe WerFault.exe PID 1680 wrote to memory of 512 1680 77bae1e8054ce3da1f20b43d0040af17.exe WerFault.exe PID 1680 wrote to memory of 512 1680 77bae1e8054ce3da1f20b43d0040af17.exe WerFault.exe PID 1680 wrote to memory of 512 1680 77bae1e8054ce3da1f20b43d0040af17.exe WerFault.exe PID 908 wrote to memory of 1664 908 WScript.exe cmd.exe PID 908 wrote to memory of 1664 908 WScript.exe cmd.exe PID 908 wrote to memory of 1664 908 WScript.exe cmd.exe PID 908 wrote to memory of 1664 908 WScript.exe cmd.exe PID 1664 wrote to memory of 1528 1664 cmd.exe vlc.exe PID 1664 wrote to memory of 1528 1664 cmd.exe vlc.exe PID 1664 wrote to memory of 1528 1664 cmd.exe vlc.exe PID 1664 wrote to memory of 1528 1664 cmd.exe vlc.exe PID 1528 wrote to memory of 2004 1528 vlc.exe cmd.exe PID 1528 wrote to memory of 2004 1528 vlc.exe cmd.exe PID 1528 wrote to memory of 2004 1528 vlc.exe cmd.exe PID 1528 wrote to memory of 2004 1528 vlc.exe cmd.exe PID 2004 wrote to memory of 1616 2004 cmd.exe timeout.exe PID 2004 wrote to memory of 1616 2004 cmd.exe timeout.exe PID 2004 wrote to memory of 1616 2004 cmd.exe timeout.exe PID 2004 wrote to memory of 1616 2004 cmd.exe timeout.exe PID 1528 wrote to memory of 1648 1528 vlc.exe cmd.exe PID 1528 wrote to memory of 1648 1528 vlc.exe cmd.exe PID 1528 wrote to memory of 1648 1528 vlc.exe cmd.exe PID 1528 wrote to memory of 1648 1528 vlc.exe cmd.exe PID 1648 wrote to memory of 1320 1648 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\77bae1e8054ce3da1f20b43d0040af17.exe"C:\Users\Admin\AppData\Local\Temp\77bae1e8054ce3da1f20b43d0040af17.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\77bae1e8054ce3da1f20b43d0040af17.exe"C:\Users\Admin\AppData\Local\Temp\77bae1e8054ce3da1f20b43d0040af17.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\vlc.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\vlc.exeC:\Users\Admin\AppData\Roaming\vlc.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\vlc.exe"C:\Users\Admin\AppData\Roaming\vlc.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 9846⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 9402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
0fd303b21c1a43c6a9078e6f5280ca85
SHA10db8f1ae34f4e2e72184e337951fde826c0bd26f
SHA2565d8c6cfdf8fc198c4fd279487e5c1620ece89e39781c6337f4cb5e111e606ddc
SHA512be4cdd48940bead0274c7cf08abd9bc75b5db468159cbf883198712d0bb15ad81a069638c628eba62237cfa0a197f845c0d9e1f4727c9608a8d642f7aba38671
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
77bae1e8054ce3da1f20b43d0040af17
SHA16ee8ea745b8afcf7ebd921720964ae8d15443a7b
SHA2569d61a9f459f8981483707df711e575931c3f637ec31b2befffce77d1ee486925
SHA5120dd0f902a274334441435a979041e3fd4ca0a9d44a1acfe3fb1fe0280e65b6e7532dde24243b86164c470f4ce6cf0c1e47363df2a59bfbd06f6252079409cb64
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
77bae1e8054ce3da1f20b43d0040af17
SHA16ee8ea745b8afcf7ebd921720964ae8d15443a7b
SHA2569d61a9f459f8981483707df711e575931c3f637ec31b2befffce77d1ee486925
SHA5120dd0f902a274334441435a979041e3fd4ca0a9d44a1acfe3fb1fe0280e65b6e7532dde24243b86164c470f4ce6cf0c1e47363df2a59bfbd06f6252079409cb64
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
77bae1e8054ce3da1f20b43d0040af17
SHA16ee8ea745b8afcf7ebd921720964ae8d15443a7b
SHA2569d61a9f459f8981483707df711e575931c3f637ec31b2befffce77d1ee486925
SHA5120dd0f902a274334441435a979041e3fd4ca0a9d44a1acfe3fb1fe0280e65b6e7532dde24243b86164c470f4ce6cf0c1e47363df2a59bfbd06f6252079409cb64
-
\Users\Admin\AppData\Roaming\vlc.exeMD5
77bae1e8054ce3da1f20b43d0040af17
SHA16ee8ea745b8afcf7ebd921720964ae8d15443a7b
SHA2569d61a9f459f8981483707df711e575931c3f637ec31b2befffce77d1ee486925
SHA5120dd0f902a274334441435a979041e3fd4ca0a9d44a1acfe3fb1fe0280e65b6e7532dde24243b86164c470f4ce6cf0c1e47363df2a59bfbd06f6252079409cb64
-
\Users\Admin\AppData\Roaming\vlc.exeMD5
77bae1e8054ce3da1f20b43d0040af17
SHA16ee8ea745b8afcf7ebd921720964ae8d15443a7b
SHA2569d61a9f459f8981483707df711e575931c3f637ec31b2befffce77d1ee486925
SHA5120dd0f902a274334441435a979041e3fd4ca0a9d44a1acfe3fb1fe0280e65b6e7532dde24243b86164c470f4ce6cf0c1e47363df2a59bfbd06f6252079409cb64
-
\Users\Admin\AppData\Roaming\vlc.exeMD5
77bae1e8054ce3da1f20b43d0040af17
SHA16ee8ea745b8afcf7ebd921720964ae8d15443a7b
SHA2569d61a9f459f8981483707df711e575931c3f637ec31b2befffce77d1ee486925
SHA5120dd0f902a274334441435a979041e3fd4ca0a9d44a1acfe3fb1fe0280e65b6e7532dde24243b86164c470f4ce6cf0c1e47363df2a59bfbd06f6252079409cb64
-
\Users\Admin\AppData\Roaming\vlc.exeMD5
77bae1e8054ce3da1f20b43d0040af17
SHA16ee8ea745b8afcf7ebd921720964ae8d15443a7b
SHA2569d61a9f459f8981483707df711e575931c3f637ec31b2befffce77d1ee486925
SHA5120dd0f902a274334441435a979041e3fd4ca0a9d44a1acfe3fb1fe0280e65b6e7532dde24243b86164c470f4ce6cf0c1e47363df2a59bfbd06f6252079409cb64
-
\Users\Admin\AppData\Roaming\vlc.exeMD5
77bae1e8054ce3da1f20b43d0040af17
SHA16ee8ea745b8afcf7ebd921720964ae8d15443a7b
SHA2569d61a9f459f8981483707df711e575931c3f637ec31b2befffce77d1ee486925
SHA5120dd0f902a274334441435a979041e3fd4ca0a9d44a1acfe3fb1fe0280e65b6e7532dde24243b86164c470f4ce6cf0c1e47363df2a59bfbd06f6252079409cb64
-
memory/408-19-0x0000000000000000-mapping.dmp
-
memory/512-26-0x00000000022D0000-0x00000000022E1000-memory.dmpFilesize
68KB
-
memory/512-25-0x0000000000000000-mapping.dmp
-
memory/620-44-0x0000000000000000-mapping.dmp
-
memory/620-20-0x0000000000000000-mapping.dmp
-
memory/656-17-0x0000000000000000-mapping.dmp
-
memory/820-49-0x0000000000000000-mapping.dmp
-
memory/820-50-0x00000000022D0000-0x00000000022E1000-memory.dmpFilesize
68KB
-
memory/844-48-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/844-46-0x0000000000413FA4-mapping.dmp
-
memory/908-24-0x0000000000000000-mapping.dmp
-
memory/908-29-0x0000000002860000-0x0000000002864000-memory.dmpFilesize
16KB
-
memory/1320-42-0x0000000000000000-mapping.dmp
-
memory/1396-43-0x0000000000000000-mapping.dmp
-
memory/1448-18-0x0000000000000000-mapping.dmp
-
memory/1528-36-0x0000000000B00000-0x0000000000B01000-memory.dmpFilesize
4KB
-
memory/1528-35-0x0000000074450000-0x0000000074B3E000-memory.dmpFilesize
6.9MB
-
memory/1528-33-0x0000000000000000-mapping.dmp
-
memory/1616-40-0x0000000000000000-mapping.dmp
-
memory/1648-41-0x0000000000000000-mapping.dmp
-
memory/1664-28-0x0000000000000000-mapping.dmp
-
memory/1680-2-0x0000000074450000-0x0000000074B3E000-memory.dmpFilesize
6.9MB
-
memory/1680-14-0x0000000000450000-0x0000000000480000-memory.dmpFilesize
192KB
-
memory/1680-3-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/1700-16-0x0000000000000000-mapping.dmp
-
memory/1984-23-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1984-21-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1984-22-0x0000000000413FA4-mapping.dmp
-
memory/2004-39-0x0000000000000000-mapping.dmp
-
memory/2012-15-0x0000000000000000-mapping.dmp