Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-01-2021 09:07
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Quotation.exe
Resource
win10v20201028
General
-
Target
Quotation.exe
-
Size
301KB
-
MD5
86ee20d76d6fcd5411f6ac7f6087e636
-
SHA1
bdccba4e08fdcb0eb4881111087b04871ac9a017
-
SHA256
605834c1fd1e1ad6e039fa17f7de298663ab902e84a70947a15ef18d088879e8
-
SHA512
811795cd24c69795120dc26c4c876a51453eb11820f9482819a70698d6b14ddece068da18bad307e28975273d20d9a680b31df07c04362e8d33d7de733b26516
Malware Config
Extracted
remcos
whatgodcannotdodoestnotexist.duckdns.org:2889
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
remcos.exeremcos.exepid process 1704 remcos.exe 268 remcos.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 1300 cmd.exe 1300 cmd.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
Quotation.exeremcos.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Quotation.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" Quotation.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" remcos.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Quotation.exeremcos.exedescription pid process target process PID 1832 set thread context of 1364 1832 Quotation.exe Quotation.exe PID 1704 set thread context of 268 1704 remcos.exe remcos.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Quotation.exeremcos.exepid process 1832 Quotation.exe 1704 remcos.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
remcos.exepid process 268 remcos.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
Quotation.execmd.exeQuotation.exeWScript.execmd.exeremcos.exedescription pid process target process PID 1832 wrote to memory of 1188 1832 Quotation.exe cmd.exe PID 1832 wrote to memory of 1188 1832 Quotation.exe cmd.exe PID 1832 wrote to memory of 1188 1832 Quotation.exe cmd.exe PID 1832 wrote to memory of 1188 1832 Quotation.exe cmd.exe PID 1832 wrote to memory of 1364 1832 Quotation.exe Quotation.exe PID 1832 wrote to memory of 1364 1832 Quotation.exe Quotation.exe PID 1832 wrote to memory of 1364 1832 Quotation.exe Quotation.exe PID 1832 wrote to memory of 1364 1832 Quotation.exe Quotation.exe PID 1832 wrote to memory of 1364 1832 Quotation.exe Quotation.exe PID 1188 wrote to memory of 1996 1188 cmd.exe schtasks.exe PID 1188 wrote to memory of 1996 1188 cmd.exe schtasks.exe PID 1188 wrote to memory of 1996 1188 cmd.exe schtasks.exe PID 1188 wrote to memory of 1996 1188 cmd.exe schtasks.exe PID 1364 wrote to memory of 1264 1364 Quotation.exe WScript.exe PID 1364 wrote to memory of 1264 1364 Quotation.exe WScript.exe PID 1364 wrote to memory of 1264 1364 Quotation.exe WScript.exe PID 1364 wrote to memory of 1264 1364 Quotation.exe WScript.exe PID 1264 wrote to memory of 1300 1264 WScript.exe cmd.exe PID 1264 wrote to memory of 1300 1264 WScript.exe cmd.exe PID 1264 wrote to memory of 1300 1264 WScript.exe cmd.exe PID 1264 wrote to memory of 1300 1264 WScript.exe cmd.exe PID 1300 wrote to memory of 1704 1300 cmd.exe remcos.exe PID 1300 wrote to memory of 1704 1300 cmd.exe remcos.exe PID 1300 wrote to memory of 1704 1300 cmd.exe remcos.exe PID 1300 wrote to memory of 1704 1300 cmd.exe remcos.exe PID 1704 wrote to memory of 268 1704 remcos.exe remcos.exe PID 1704 wrote to memory of 268 1704 remcos.exe remcos.exe PID 1704 wrote to memory of 268 1704 remcos.exe remcos.exe PID 1704 wrote to memory of 268 1704 remcos.exe remcos.exe PID 1704 wrote to memory of 268 1704 remcos.exe remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\46b0b47c981843f9ad736934b2e3a8ee.xml"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\46b0b47c981843f9ad736934b2e3a8ee.xml"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\46b0b47c981843f9ad736934b2e3a8ee.xmlMD5
9313352a59e3b368ab4eb8173567c406
SHA1fc776c28e3ae9bd5e68f25c2a4f6248126731370
SHA256469d4994320f37196faca4de8ada85161a43dd42c9405b283bea5e4ea84c9a8d
SHA512000f6edf387b4ea0f244003fad3f66be5eb1920012838ba3a19c3f2dcde973fce8450c8e556c22cc20f7a3a0980d735fb169ecfafd440993c9fe5b8875fc7462
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
b92d64fe5b1d1f59df4b738262aea8df
SHA1c8fb1981759c2d9bb2ec91b705985fba5fc7af63
SHA256fa20e9aab03dc8e9f1910aaf0cf42662379fa16ae3a22642084fb97fa3d4f83a
SHA5122566248b93c0cfb0414f033b8dd18bbd4f88180093eac2861107289bcb4ee160f9593706ff1f7d1f2e4ecea430d67a5a2897551a4f9ebd82b707243e300520e2
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
86ee20d76d6fcd5411f6ac7f6087e636
SHA1bdccba4e08fdcb0eb4881111087b04871ac9a017
SHA256605834c1fd1e1ad6e039fa17f7de298663ab902e84a70947a15ef18d088879e8
SHA512811795cd24c69795120dc26c4c876a51453eb11820f9482819a70698d6b14ddece068da18bad307e28975273d20d9a680b31df07c04362e8d33d7de733b26516
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
86ee20d76d6fcd5411f6ac7f6087e636
SHA1bdccba4e08fdcb0eb4881111087b04871ac9a017
SHA256605834c1fd1e1ad6e039fa17f7de298663ab902e84a70947a15ef18d088879e8
SHA512811795cd24c69795120dc26c4c876a51453eb11820f9482819a70698d6b14ddece068da18bad307e28975273d20d9a680b31df07c04362e8d33d7de733b26516
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
86ee20d76d6fcd5411f6ac7f6087e636
SHA1bdccba4e08fdcb0eb4881111087b04871ac9a017
SHA256605834c1fd1e1ad6e039fa17f7de298663ab902e84a70947a15ef18d088879e8
SHA512811795cd24c69795120dc26c4c876a51453eb11820f9482819a70698d6b14ddece068da18bad307e28975273d20d9a680b31df07c04362e8d33d7de733b26516
-
\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
86ee20d76d6fcd5411f6ac7f6087e636
SHA1bdccba4e08fdcb0eb4881111087b04871ac9a017
SHA256605834c1fd1e1ad6e039fa17f7de298663ab902e84a70947a15ef18d088879e8
SHA512811795cd24c69795120dc26c4c876a51453eb11820f9482819a70698d6b14ddece068da18bad307e28975273d20d9a680b31df07c04362e8d33d7de733b26516
-
\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
86ee20d76d6fcd5411f6ac7f6087e636
SHA1bdccba4e08fdcb0eb4881111087b04871ac9a017
SHA256605834c1fd1e1ad6e039fa17f7de298663ab902e84a70947a15ef18d088879e8
SHA512811795cd24c69795120dc26c4c876a51453eb11820f9482819a70698d6b14ddece068da18bad307e28975273d20d9a680b31df07c04362e8d33d7de733b26516
-
memory/268-22-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/268-19-0x0000000000413FA4-mapping.dmp
-
memory/1188-3-0x0000000000000000-mapping.dmp
-
memory/1264-8-0x0000000000000000-mapping.dmp
-
memory/1264-13-0x00000000026E0000-0x00000000026E4000-memory.dmpFilesize
16KB
-
memory/1300-12-0x0000000000000000-mapping.dmp
-
memory/1364-10-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1364-4-0x0000000000413FA4-mapping.dmp
-
memory/1704-17-0x0000000000000000-mapping.dmp
-
memory/1832-2-0x0000000076371000-0x0000000076373000-memory.dmpFilesize
8KB
-
memory/1996-6-0x0000000000000000-mapping.dmp