Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-01-2021 07:14
Static task
static1
Behavioral task
behavioral1
Sample
unpaid.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
unpaid.exe
Resource
win10v20201028
General
-
Target
unpaid.exe
-
Size
289KB
-
MD5
23195e221bd52fc2ff7bcecef0c6e9af
-
SHA1
efffd2231109a8103f1b85da879ee2cfd9e59ba8
-
SHA256
07cb866df6df9ad51ce01426b0a0466834619e72c2653ff7c25320cc3c0a3f9a
-
SHA512
8cbb1a709e198e7c905b81554000d83f88e2429c821d5990d45c8f182442e2409828de014750aa2ef23c97f033b0f098bdf281cc8bc7b5c1e7ff53ca7d2dd3c8
Malware Config
Extracted
remcos
nkosarevaocs.duckdns.org:7266
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
remcos.exeremcos.exepid process 3592 remcos.exe 1096 remcos.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
remcos.exeunpaid.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" remcos.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ unpaid.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" unpaid.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
unpaid.exeremcos.exedescription pid process target process PID 1432 set thread context of 2076 1432 unpaid.exe unpaid.exe PID 3592 set thread context of 1096 3592 remcos.exe remcos.exe -
Modifies registry class 1 IoCs
Processes:
unpaid.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings unpaid.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
unpaid.exeunpaid.exeremcos.exepid process 4000 unpaid.exe 1432 unpaid.exe 3592 remcos.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
remcos.exepid process 1096 remcos.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
unpaid.exeunpaid.exeunpaid.exeWScript.execmd.exeremcos.exedescription pid process target process PID 4000 wrote to memory of 1424 4000 unpaid.exe unpaid.exe PID 4000 wrote to memory of 1424 4000 unpaid.exe unpaid.exe PID 4000 wrote to memory of 1424 4000 unpaid.exe unpaid.exe PID 4000 wrote to memory of 1432 4000 unpaid.exe unpaid.exe PID 4000 wrote to memory of 1432 4000 unpaid.exe unpaid.exe PID 4000 wrote to memory of 1432 4000 unpaid.exe unpaid.exe PID 1432 wrote to memory of 2076 1432 unpaid.exe unpaid.exe PID 1432 wrote to memory of 2076 1432 unpaid.exe unpaid.exe PID 1432 wrote to memory of 2076 1432 unpaid.exe unpaid.exe PID 1432 wrote to memory of 2076 1432 unpaid.exe unpaid.exe PID 2076 wrote to memory of 2500 2076 unpaid.exe WScript.exe PID 2076 wrote to memory of 2500 2076 unpaid.exe WScript.exe PID 2076 wrote to memory of 2500 2076 unpaid.exe WScript.exe PID 2500 wrote to memory of 3684 2500 WScript.exe cmd.exe PID 2500 wrote to memory of 3684 2500 WScript.exe cmd.exe PID 2500 wrote to memory of 3684 2500 WScript.exe cmd.exe PID 3684 wrote to memory of 3592 3684 cmd.exe remcos.exe PID 3684 wrote to memory of 3592 3684 cmd.exe remcos.exe PID 3684 wrote to memory of 3592 3684 cmd.exe remcos.exe PID 3592 wrote to memory of 1096 3592 remcos.exe remcos.exe PID 3592 wrote to memory of 1096 3592 remcos.exe remcos.exe PID 3592 wrote to memory of 1096 3592 remcos.exe remcos.exe PID 3592 wrote to memory of 1096 3592 remcos.exe remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\unpaid.exe"C:\Users\Admin\AppData\Local\Temp\unpaid.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unpaid.exe"C:\Users\Admin\AppData\Local\Temp\unpaid.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\unpaid.exe"C:\Users\Admin\AppData\Local\Temp\unpaid.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unpaid.exe"C:\Users\Admin\AppData\Local\Temp\unpaid.exe"3⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe7⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
b92d64fe5b1d1f59df4b738262aea8df
SHA1c8fb1981759c2d9bb2ec91b705985fba5fc7af63
SHA256fa20e9aab03dc8e9f1910aaf0cf42662379fa16ae3a22642084fb97fa3d4f83a
SHA5122566248b93c0cfb0414f033b8dd18bbd4f88180093eac2861107289bcb4ee160f9593706ff1f7d1f2e4ecea430d67a5a2897551a4f9ebd82b707243e300520e2
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
23195e221bd52fc2ff7bcecef0c6e9af
SHA1efffd2231109a8103f1b85da879ee2cfd9e59ba8
SHA25607cb866df6df9ad51ce01426b0a0466834619e72c2653ff7c25320cc3c0a3f9a
SHA5128cbb1a709e198e7c905b81554000d83f88e2429c821d5990d45c8f182442e2409828de014750aa2ef23c97f033b0f098bdf281cc8bc7b5c1e7ff53ca7d2dd3c8
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
23195e221bd52fc2ff7bcecef0c6e9af
SHA1efffd2231109a8103f1b85da879ee2cfd9e59ba8
SHA25607cb866df6df9ad51ce01426b0a0466834619e72c2653ff7c25320cc3c0a3f9a
SHA5128cbb1a709e198e7c905b81554000d83f88e2429c821d5990d45c8f182442e2409828de014750aa2ef23c97f033b0f098bdf281cc8bc7b5c1e7ff53ca7d2dd3c8
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
23195e221bd52fc2ff7bcecef0c6e9af
SHA1efffd2231109a8103f1b85da879ee2cfd9e59ba8
SHA25607cb866df6df9ad51ce01426b0a0466834619e72c2653ff7c25320cc3c0a3f9a
SHA5128cbb1a709e198e7c905b81554000d83f88e2429c821d5990d45c8f182442e2409828de014750aa2ef23c97f033b0f098bdf281cc8bc7b5c1e7ff53ca7d2dd3c8
-
memory/1096-11-0x0000000000413FA4-mapping.dmp
-
memory/1096-13-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1432-2-0x0000000000000000-mapping.dmp
-
memory/2076-3-0x0000000000413FA4-mapping.dmp
-
memory/2076-6-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2500-4-0x0000000000000000-mapping.dmp
-
memory/3592-8-0x0000000000000000-mapping.dmp
-
memory/3684-7-0x0000000000000000-mapping.dmp