Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
15-01-2021 07:03
Static task
static1
Behavioral task
behavioral1
Sample
77bae1e8054ce3da1f20b43d0040af17.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
77bae1e8054ce3da1f20b43d0040af17.exe
Resource
win10v20201028
General
-
Target
77bae1e8054ce3da1f20b43d0040af17.exe
-
Size
1.3MB
-
MD5
77bae1e8054ce3da1f20b43d0040af17
-
SHA1
6ee8ea745b8afcf7ebd921720964ae8d15443a7b
-
SHA256
9d61a9f459f8981483707df711e575931c3f637ec31b2befffce77d1ee486925
-
SHA512
0dd0f902a274334441435a979041e3fd4ca0a9d44a1acfe3fb1fe0280e65b6e7532dde24243b86164c470f4ce6cf0c1e47363df2a59bfbd06f6252079409cb64
Malware Config
Extracted
remcos
swryijgrvcsgkopnmcdertvgdswbvmophtfdczxs.ydns.eu:2017
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
vlc.exevlc.exepid process 576 vlc.exe 652 vlc.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
vlc.exe77bae1e8054ce3da1f20b43d0040af17.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc.exe\"" vlc.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 77bae1e8054ce3da1f20b43d0040af17.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\win = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc.exe\"" 77bae1e8054ce3da1f20b43d0040af17.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ vlc.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
Processes:
77bae1e8054ce3da1f20b43d0040af17.exevlc.exepid process 988 77bae1e8054ce3da1f20b43d0040af17.exe 988 77bae1e8054ce3da1f20b43d0040af17.exe 988 77bae1e8054ce3da1f20b43d0040af17.exe 988 77bae1e8054ce3da1f20b43d0040af17.exe 988 77bae1e8054ce3da1f20b43d0040af17.exe 988 77bae1e8054ce3da1f20b43d0040af17.exe 988 77bae1e8054ce3da1f20b43d0040af17.exe 988 77bae1e8054ce3da1f20b43d0040af17.exe 988 77bae1e8054ce3da1f20b43d0040af17.exe 988 77bae1e8054ce3da1f20b43d0040af17.exe 988 77bae1e8054ce3da1f20b43d0040af17.exe 988 77bae1e8054ce3da1f20b43d0040af17.exe 576 vlc.exe 576 vlc.exe 576 vlc.exe 576 vlc.exe 576 vlc.exe 576 vlc.exe 576 vlc.exe 576 vlc.exe 576 vlc.exe 576 vlc.exe 576 vlc.exe 576 vlc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
77bae1e8054ce3da1f20b43d0040af17.exevlc.exedescription pid process target process PID 988 set thread context of 2688 988 77bae1e8054ce3da1f20b43d0040af17.exe 77bae1e8054ce3da1f20b43d0040af17.exe PID 576 set thread context of 652 576 vlc.exe vlc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2092 988 WerFault.exe 77bae1e8054ce3da1f20b43d0040af17.exe -
Delays execution with timeout.exe 6 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 860 timeout.exe 196 timeout.exe 2736 timeout.exe 3256 timeout.exe 312 timeout.exe 3840 timeout.exe -
Modifies registry class 1 IoCs
Processes:
77bae1e8054ce3da1f20b43d0040af17.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings 77bae1e8054ce3da1f20b43d0040af17.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
77bae1e8054ce3da1f20b43d0040af17.exeWerFault.exevlc.exepid process 988 77bae1e8054ce3da1f20b43d0040af17.exe 988 77bae1e8054ce3da1f20b43d0040af17.exe 988 77bae1e8054ce3da1f20b43d0040af17.exe 988 77bae1e8054ce3da1f20b43d0040af17.exe 988 77bae1e8054ce3da1f20b43d0040af17.exe 2092 WerFault.exe 2092 WerFault.exe 2092 WerFault.exe 2092 WerFault.exe 2092 WerFault.exe 2092 WerFault.exe 2092 WerFault.exe 2092 WerFault.exe 2092 WerFault.exe 2092 WerFault.exe 2092 WerFault.exe 2092 WerFault.exe 2092 WerFault.exe 2092 WerFault.exe 576 vlc.exe 576 vlc.exe 576 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 652 vlc.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
77bae1e8054ce3da1f20b43d0040af17.exeWerFault.exevlc.exedescription pid process Token: SeDebugPrivilege 988 77bae1e8054ce3da1f20b43d0040af17.exe Token: SeRestorePrivilege 2092 WerFault.exe Token: SeBackupPrivilege 2092 WerFault.exe Token: SeDebugPrivilege 2092 WerFault.exe Token: SeDebugPrivilege 576 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 652 vlc.exe -
Suspicious use of WriteProcessMemory 68 IoCs
Processes:
77bae1e8054ce3da1f20b43d0040af17.execmd.execmd.execmd.exe77bae1e8054ce3da1f20b43d0040af17.exeWScript.execmd.exevlc.execmd.execmd.execmd.exedescription pid process target process PID 988 wrote to memory of 3644 988 77bae1e8054ce3da1f20b43d0040af17.exe cmd.exe PID 988 wrote to memory of 3644 988 77bae1e8054ce3da1f20b43d0040af17.exe cmd.exe PID 988 wrote to memory of 3644 988 77bae1e8054ce3da1f20b43d0040af17.exe cmd.exe PID 3644 wrote to memory of 860 3644 cmd.exe timeout.exe PID 3644 wrote to memory of 860 3644 cmd.exe timeout.exe PID 3644 wrote to memory of 860 3644 cmd.exe timeout.exe PID 988 wrote to memory of 828 988 77bae1e8054ce3da1f20b43d0040af17.exe cmd.exe PID 988 wrote to memory of 828 988 77bae1e8054ce3da1f20b43d0040af17.exe cmd.exe PID 988 wrote to memory of 828 988 77bae1e8054ce3da1f20b43d0040af17.exe cmd.exe PID 828 wrote to memory of 196 828 cmd.exe timeout.exe PID 828 wrote to memory of 196 828 cmd.exe timeout.exe PID 828 wrote to memory of 196 828 cmd.exe timeout.exe PID 988 wrote to memory of 760 988 77bae1e8054ce3da1f20b43d0040af17.exe cmd.exe PID 988 wrote to memory of 760 988 77bae1e8054ce3da1f20b43d0040af17.exe cmd.exe PID 988 wrote to memory of 760 988 77bae1e8054ce3da1f20b43d0040af17.exe cmd.exe PID 760 wrote to memory of 2736 760 cmd.exe timeout.exe PID 760 wrote to memory of 2736 760 cmd.exe timeout.exe PID 760 wrote to memory of 2736 760 cmd.exe timeout.exe PID 988 wrote to memory of 2612 988 77bae1e8054ce3da1f20b43d0040af17.exe 77bae1e8054ce3da1f20b43d0040af17.exe PID 988 wrote to memory of 2612 988 77bae1e8054ce3da1f20b43d0040af17.exe 77bae1e8054ce3da1f20b43d0040af17.exe PID 988 wrote to memory of 2612 988 77bae1e8054ce3da1f20b43d0040af17.exe 77bae1e8054ce3da1f20b43d0040af17.exe PID 988 wrote to memory of 2688 988 77bae1e8054ce3da1f20b43d0040af17.exe 77bae1e8054ce3da1f20b43d0040af17.exe PID 988 wrote to memory of 2688 988 77bae1e8054ce3da1f20b43d0040af17.exe 77bae1e8054ce3da1f20b43d0040af17.exe PID 988 wrote to memory of 2688 988 77bae1e8054ce3da1f20b43d0040af17.exe 77bae1e8054ce3da1f20b43d0040af17.exe PID 988 wrote to memory of 2688 988 77bae1e8054ce3da1f20b43d0040af17.exe 77bae1e8054ce3da1f20b43d0040af17.exe PID 988 wrote to memory of 2688 988 77bae1e8054ce3da1f20b43d0040af17.exe 77bae1e8054ce3da1f20b43d0040af17.exe PID 988 wrote to memory of 2688 988 77bae1e8054ce3da1f20b43d0040af17.exe 77bae1e8054ce3da1f20b43d0040af17.exe PID 988 wrote to memory of 2688 988 77bae1e8054ce3da1f20b43d0040af17.exe 77bae1e8054ce3da1f20b43d0040af17.exe PID 988 wrote to memory of 2688 988 77bae1e8054ce3da1f20b43d0040af17.exe 77bae1e8054ce3da1f20b43d0040af17.exe PID 988 wrote to memory of 2688 988 77bae1e8054ce3da1f20b43d0040af17.exe 77bae1e8054ce3da1f20b43d0040af17.exe PID 988 wrote to memory of 2688 988 77bae1e8054ce3da1f20b43d0040af17.exe 77bae1e8054ce3da1f20b43d0040af17.exe PID 2688 wrote to memory of 1620 2688 77bae1e8054ce3da1f20b43d0040af17.exe WScript.exe PID 2688 wrote to memory of 1620 2688 77bae1e8054ce3da1f20b43d0040af17.exe WScript.exe PID 2688 wrote to memory of 1620 2688 77bae1e8054ce3da1f20b43d0040af17.exe WScript.exe PID 1620 wrote to memory of 188 1620 WScript.exe cmd.exe PID 1620 wrote to memory of 188 1620 WScript.exe cmd.exe PID 1620 wrote to memory of 188 1620 WScript.exe cmd.exe PID 188 wrote to memory of 576 188 cmd.exe vlc.exe PID 188 wrote to memory of 576 188 cmd.exe vlc.exe PID 188 wrote to memory of 576 188 cmd.exe vlc.exe PID 576 wrote to memory of 1784 576 vlc.exe cmd.exe PID 576 wrote to memory of 1784 576 vlc.exe cmd.exe PID 576 wrote to memory of 1784 576 vlc.exe cmd.exe PID 1784 wrote to memory of 3256 1784 cmd.exe timeout.exe PID 1784 wrote to memory of 3256 1784 cmd.exe timeout.exe PID 1784 wrote to memory of 3256 1784 cmd.exe timeout.exe PID 576 wrote to memory of 2432 576 vlc.exe cmd.exe PID 576 wrote to memory of 2432 576 vlc.exe cmd.exe PID 576 wrote to memory of 2432 576 vlc.exe cmd.exe PID 2432 wrote to memory of 312 2432 cmd.exe timeout.exe PID 2432 wrote to memory of 312 2432 cmd.exe timeout.exe PID 2432 wrote to memory of 312 2432 cmd.exe timeout.exe PID 576 wrote to memory of 2396 576 vlc.exe cmd.exe PID 576 wrote to memory of 2396 576 vlc.exe cmd.exe PID 576 wrote to memory of 2396 576 vlc.exe cmd.exe PID 2396 wrote to memory of 3840 2396 cmd.exe timeout.exe PID 2396 wrote to memory of 3840 2396 cmd.exe timeout.exe PID 2396 wrote to memory of 3840 2396 cmd.exe timeout.exe PID 576 wrote to memory of 652 576 vlc.exe vlc.exe PID 576 wrote to memory of 652 576 vlc.exe vlc.exe PID 576 wrote to memory of 652 576 vlc.exe vlc.exe PID 576 wrote to memory of 652 576 vlc.exe vlc.exe PID 576 wrote to memory of 652 576 vlc.exe vlc.exe PID 576 wrote to memory of 652 576 vlc.exe vlc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\77bae1e8054ce3da1f20b43d0040af17.exe"C:\Users\Admin\AppData\Local\Temp\77bae1e8054ce3da1f20b43d0040af17.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\77bae1e8054ce3da1f20b43d0040af17.exe"C:\Users\Admin\AppData\Local\Temp\77bae1e8054ce3da1f20b43d0040af17.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\77bae1e8054ce3da1f20b43d0040af17.exe"C:\Users\Admin\AppData\Local\Temp\77bae1e8054ce3da1f20b43d0040af17.exe"2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\vlc.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\vlc.exeC:\Users\Admin\AppData\Roaming\vlc.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 16⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 17⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\vlc.exe"C:\Users\Admin\AppData\Roaming\vlc.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 988 -s 16202⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
0fd303b21c1a43c6a9078e6f5280ca85
SHA10db8f1ae34f4e2e72184e337951fde826c0bd26f
SHA2565d8c6cfdf8fc198c4fd279487e5c1620ece89e39781c6337f4cb5e111e606ddc
SHA512be4cdd48940bead0274c7cf08abd9bc75b5db468159cbf883198712d0bb15ad81a069638c628eba62237cfa0a197f845c0d9e1f4727c9608a8d642f7aba38671
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
77bae1e8054ce3da1f20b43d0040af17
SHA16ee8ea745b8afcf7ebd921720964ae8d15443a7b
SHA2569d61a9f459f8981483707df711e575931c3f637ec31b2befffce77d1ee486925
SHA5120dd0f902a274334441435a979041e3fd4ca0a9d44a1acfe3fb1fe0280e65b6e7532dde24243b86164c470f4ce6cf0c1e47363df2a59bfbd06f6252079409cb64
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
77bae1e8054ce3da1f20b43d0040af17
SHA16ee8ea745b8afcf7ebd921720964ae8d15443a7b
SHA2569d61a9f459f8981483707df711e575931c3f637ec31b2befffce77d1ee486925
SHA5120dd0f902a274334441435a979041e3fd4ca0a9d44a1acfe3fb1fe0280e65b6e7532dde24243b86164c470f4ce6cf0c1e47363df2a59bfbd06f6252079409cb64
-
C:\Users\Admin\AppData\Roaming\vlc.exeMD5
77bae1e8054ce3da1f20b43d0040af17
SHA16ee8ea745b8afcf7ebd921720964ae8d15443a7b
SHA2569d61a9f459f8981483707df711e575931c3f637ec31b2befffce77d1ee486925
SHA5120dd0f902a274334441435a979041e3fd4ca0a9d44a1acfe3fb1fe0280e65b6e7532dde24243b86164c470f4ce6cf0c1e47363df2a59bfbd06f6252079409cb64
-
memory/188-24-0x0000000000000000-mapping.dmp
-
memory/196-13-0x0000000000000000-mapping.dmp
-
memory/312-39-0x0000000000000000-mapping.dmp
-
memory/576-28-0x0000000073800000-0x0000000073EEE000-memory.dmpFilesize
6.9MB
-
memory/576-25-0x0000000000000000-mapping.dmp
-
memory/652-45-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/652-43-0x0000000000413FA4-mapping.dmp
-
memory/760-14-0x0000000000000000-mapping.dmp
-
memory/828-12-0x0000000000000000-mapping.dmp
-
memory/860-11-0x0000000000000000-mapping.dmp
-
memory/988-8-0x0000000004F10000-0x0000000004F11000-memory.dmpFilesize
4KB
-
memory/988-7-0x0000000005170000-0x0000000005171000-memory.dmpFilesize
4KB
-
memory/988-2-0x0000000073800000-0x0000000073EEE000-memory.dmpFilesize
6.9MB
-
memory/988-6-0x00000000054D0000-0x00000000054D1000-memory.dmpFilesize
4KB
-
memory/988-5-0x0000000004F30000-0x0000000004F31000-memory.dmpFilesize
4KB
-
memory/988-3-0x0000000000560000-0x0000000000561000-memory.dmpFilesize
4KB
-
memory/988-9-0x00000000050D0000-0x0000000005100000-memory.dmpFilesize
192KB
-
memory/1620-19-0x0000000000000000-mapping.dmp
-
memory/1784-36-0x0000000000000000-mapping.dmp
-
memory/2092-20-0x0000000004480000-0x0000000004481000-memory.dmpFilesize
4KB
-
memory/2396-40-0x0000000000000000-mapping.dmp
-
memory/2432-38-0x0000000000000000-mapping.dmp
-
memory/2688-18-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2688-17-0x0000000000413FA4-mapping.dmp
-
memory/2688-16-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2736-15-0x0000000000000000-mapping.dmp
-
memory/3256-37-0x0000000000000000-mapping.dmp
-
memory/3644-10-0x0000000000000000-mapping.dmp
-
memory/3840-41-0x0000000000000000-mapping.dmp