Overview

overview

10

Static

static

QOUTATION-...om.exe

windows7_x64

10

QOUTATION-...om.exe

windows10_x64

7

Analysis

  • max time kernel
    9s
  • max time network
    11s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    18-01-2021 18:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    QOUTATION-PDF- SCAN COPY.com.exe

  • Size

    1.5MB

  • MD5

    9a9bbfd840fc81a65bbbd542c5b218c9

  • SHA1

    41a8ce06eff712b8aa1e6c9a86776b9fa1763950

  • SHA256

    a29a5b9eafdb7e2dbec28f1cb59d5ffcec859333d8f1a4cc00a37c3eded32ae3

  • SHA512

    6f06eedda66f0e55b24f82d9c6bbabc08972c271749ceacd7826f5062034d135a4d0e89d65c1c693cd85947ac9763d1cac3521f75fc72c4abf38f733dfafa4e5

Score
10/10
remcospersistencerat

Malware Config

Extracted

Family

remcos

C2

eileenwmsscm.duckdns.org:2558

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Executes dropped EXE 1 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: MapViewOfSection 14 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 69 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe
    "C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1852
    • C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe
      "C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe"
      2⤵
        PID:604
      • C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe
        "C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe"
        2⤵
          PID:1432
        • C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe
          "C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe"
          2⤵
            PID:1296
          • C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe
            "C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe"
            2⤵
              PID:1596
            • C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe
              "C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe"
              2⤵
                PID:1700
              • C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe
                "C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe"
                2⤵
                  PID:1644
                • C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe
                  "C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe"
                  2⤵
                    PID:1628
                  • C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe
                    "C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe"
                    2⤵
                      PID:1372
                    • C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe
                      "C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe"
                      2⤵
                        PID:1640
                      • C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe
                        "C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe"
                        2⤵
                          PID:1568
                        • C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe
                          "C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe"
                          2⤵
                            PID:1776
                          • C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe
                            "C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe"
                            2⤵
                              PID:740
                            • C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe
                              "C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe"
                              2⤵
                                PID:272
                              • C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe
                                "C:\Users\Admin\AppData\Local\Temp\QOUTATION-PDF- SCAN COPY.com.exe"
                                2⤵
                                • Adds Run key to start application
                                • Suspicious use of WriteProcessMemory
                                PID:776
                                • C:\Windows\SysWOW64\WScript.exe
                                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
                                  3⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:748
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
                                    4⤵
                                    • Loads dropped DLL
                                    PID:1044
                                    • C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
                                      C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      PID:784

                            Network

                            MITRE ATT&CK Matrix ATT&CK v6

                            Initial Access

                            Execution

                            Persistence

                            Registry Run Keys / Startup Folder

                            1
                            T1060

                            Privilege Escalation

                            Defense Evasion

                            Modify Registry

                            1
                            T1112

                            Credential Access

                            Discovery

                            Lateral Movement

                            Collection

                            Exfiltration

                            Command and Control

                            Impact

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Temp\install.vbs
                              MD5

                              b92d64fe5b1d1f59df4b738262aea8df

                              SHA1

                              c8fb1981759c2d9bb2ec91b705985fba5fc7af63

                              SHA256

                              fa20e9aab03dc8e9f1910aaf0cf42662379fa16ae3a22642084fb97fa3d4f83a

                              SHA512

                              2566248b93c0cfb0414f033b8dd18bbd4f88180093eac2861107289bcb4ee160f9593706ff1f7d1f2e4ecea430d67a5a2897551a4f9ebd82b707243e300520e2

                              Download Submit
                            • C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
                              MD5

                              9a9bbfd840fc81a65bbbd542c5b218c9

                              SHA1

                              41a8ce06eff712b8aa1e6c9a86776b9fa1763950

                              SHA256

                              a29a5b9eafdb7e2dbec28f1cb59d5ffcec859333d8f1a4cc00a37c3eded32ae3

                              SHA512

                              6f06eedda66f0e55b24f82d9c6bbabc08972c271749ceacd7826f5062034d135a4d0e89d65c1c693cd85947ac9763d1cac3521f75fc72c4abf38f733dfafa4e5

                              Download Submit
                            • C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
                              MD5

                              9a9bbfd840fc81a65bbbd542c5b218c9

                              SHA1

                              41a8ce06eff712b8aa1e6c9a86776b9fa1763950

                              SHA256

                              a29a5b9eafdb7e2dbec28f1cb59d5ffcec859333d8f1a4cc00a37c3eded32ae3

                              SHA512

                              6f06eedda66f0e55b24f82d9c6bbabc08972c271749ceacd7826f5062034d135a4d0e89d65c1c693cd85947ac9763d1cac3521f75fc72c4abf38f733dfafa4e5

                              Download Submit
                            • \Users\Admin\AppData\Roaming\Remcos\remcos.exe
                              MD5

                              9a9bbfd840fc81a65bbbd542c5b218c9

                              SHA1

                              41a8ce06eff712b8aa1e6c9a86776b9fa1763950

                              SHA256

                              a29a5b9eafdb7e2dbec28f1cb59d5ffcec859333d8f1a4cc00a37c3eded32ae3

                              SHA512

                              6f06eedda66f0e55b24f82d9c6bbabc08972c271749ceacd7826f5062034d135a4d0e89d65c1c693cd85947ac9763d1cac3521f75fc72c4abf38f733dfafa4e5

                              Download Submit
                            • memory/748-12-0x00000000027A0000-0x00000000027A4000-memory.dmp
                              Filesize

                              16KB

                              Download
                            • memory/748-7-0x0000000000000000-mapping.dmp
                              Download
                            • memory/776-5-0x0000000000413FA4-mapping.dmp
                              Download
                            • memory/776-10-0x0000000000400000-0x0000000000421000-memory.dmp
                              Filesize

                              132KB

                              Download
                            • memory/784-15-0x0000000000000000-mapping.dmp
                              Download
                            • memory/1044-11-0x0000000000000000-mapping.dmp
                              Download
                            • memory/1852-2-0x00000000756C1000-0x00000000756C3000-memory.dmp
                              Filesize

                              8KB

                              Download
                            • memory/1852-4-0x0000000000660000-0x0000000000663000-memory.dmp
                              Filesize

                              12KB

                              Download
                            • memory/1852-3-0x00000000001A0000-0x00000000001C1000-memory.dmp
                              Filesize

                              132KB

                              Download