Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-01-2021 16:28
Static task
static1
Behavioral task
behavioral1
Sample
Quotation Request.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Quotation Request.exe
Resource
win10v20201028
General
-
Target
Quotation Request.exe
-
Size
498KB
-
MD5
e14fc3accfaa18fee9a5c60689768864
-
SHA1
f77f4c23d6987fc4a9edbf47eb4219d591f314c9
-
SHA256
321be1554d0c8aaf169078b16f29bac61f923485fcc124499a6886c4ecadb552
-
SHA512
b62ae51e70417deaba0f0b88acccff8f3168559a84585f7cd93d997e57364c39d25079a3f521ae9203a172682a94d095721b12d840d5428711bba15e175316c7
Malware Config
Extracted
remcos
chhjvhvkjbhliiuyuj.duckdns.org:20909
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
remcos.exeremcos.exepid process 1160 remcos.exe 1096 remcos.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 324 cmd.exe 324 cmd.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
Quotation Request.exeremcos.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Quotation Request.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" Quotation Request.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" remcos.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Quotation Request.exeremcos.exedescription pid process target process PID 1884 set thread context of 1208 1884 Quotation Request.exe Quotation Request.exe PID 1160 set thread context of 1096 1160 remcos.exe remcos.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Quotation Request.exeremcos.exepid process 1884 Quotation Request.exe 1160 remcos.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
remcos.exepid process 1096 remcos.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
Quotation Request.execmd.exeQuotation Request.exeWScript.execmd.exeremcos.exedescription pid process target process PID 1884 wrote to memory of 1996 1884 Quotation Request.exe cmd.exe PID 1884 wrote to memory of 1996 1884 Quotation Request.exe cmd.exe PID 1884 wrote to memory of 1996 1884 Quotation Request.exe cmd.exe PID 1884 wrote to memory of 1996 1884 Quotation Request.exe cmd.exe PID 1884 wrote to memory of 1208 1884 Quotation Request.exe Quotation Request.exe PID 1884 wrote to memory of 1208 1884 Quotation Request.exe Quotation Request.exe PID 1884 wrote to memory of 1208 1884 Quotation Request.exe Quotation Request.exe PID 1884 wrote to memory of 1208 1884 Quotation Request.exe Quotation Request.exe PID 1884 wrote to memory of 1208 1884 Quotation Request.exe Quotation Request.exe PID 1996 wrote to memory of 1860 1996 cmd.exe schtasks.exe PID 1996 wrote to memory of 1860 1996 cmd.exe schtasks.exe PID 1996 wrote to memory of 1860 1996 cmd.exe schtasks.exe PID 1996 wrote to memory of 1860 1996 cmd.exe schtasks.exe PID 1208 wrote to memory of 1844 1208 Quotation Request.exe WScript.exe PID 1208 wrote to memory of 1844 1208 Quotation Request.exe WScript.exe PID 1208 wrote to memory of 1844 1208 Quotation Request.exe WScript.exe PID 1208 wrote to memory of 1844 1208 Quotation Request.exe WScript.exe PID 1844 wrote to memory of 324 1844 WScript.exe cmd.exe PID 1844 wrote to memory of 324 1844 WScript.exe cmd.exe PID 1844 wrote to memory of 324 1844 WScript.exe cmd.exe PID 1844 wrote to memory of 324 1844 WScript.exe cmd.exe PID 324 wrote to memory of 1160 324 cmd.exe remcos.exe PID 324 wrote to memory of 1160 324 cmd.exe remcos.exe PID 324 wrote to memory of 1160 324 cmd.exe remcos.exe PID 324 wrote to memory of 1160 324 cmd.exe remcos.exe PID 1160 wrote to memory of 1096 1160 remcos.exe remcos.exe PID 1160 wrote to memory of 1096 1160 remcos.exe remcos.exe PID 1160 wrote to memory of 1096 1160 remcos.exe remcos.exe PID 1160 wrote to memory of 1096 1160 remcos.exe remcos.exe PID 1160 wrote to memory of 1096 1160 remcos.exe remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation Request.exe"C:\Users\Admin\AppData\Local\Temp\Quotation Request.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\c21b36ce778f4ca1b76d04fcd74cc727.xml"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\c21b36ce778f4ca1b76d04fcd74cc727.xml"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Quotation Request.exe"C:\Users\Admin\AppData\Local\Temp\Quotation Request.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\c21b36ce778f4ca1b76d04fcd74cc727.xmlMD5
9313352a59e3b368ab4eb8173567c406
SHA1fc776c28e3ae9bd5e68f25c2a4f6248126731370
SHA256469d4994320f37196faca4de8ada85161a43dd42c9405b283bea5e4ea84c9a8d
SHA512000f6edf387b4ea0f244003fad3f66be5eb1920012838ba3a19c3f2dcde973fce8450c8e556c22cc20f7a3a0980d735fb169ecfafd440993c9fe5b8875fc7462
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
b92d64fe5b1d1f59df4b738262aea8df
SHA1c8fb1981759c2d9bb2ec91b705985fba5fc7af63
SHA256fa20e9aab03dc8e9f1910aaf0cf42662379fa16ae3a22642084fb97fa3d4f83a
SHA5122566248b93c0cfb0414f033b8dd18bbd4f88180093eac2861107289bcb4ee160f9593706ff1f7d1f2e4ecea430d67a5a2897551a4f9ebd82b707243e300520e2
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
e14fc3accfaa18fee9a5c60689768864
SHA1f77f4c23d6987fc4a9edbf47eb4219d591f314c9
SHA256321be1554d0c8aaf169078b16f29bac61f923485fcc124499a6886c4ecadb552
SHA512b62ae51e70417deaba0f0b88acccff8f3168559a84585f7cd93d997e57364c39d25079a3f521ae9203a172682a94d095721b12d840d5428711bba15e175316c7
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
e14fc3accfaa18fee9a5c60689768864
SHA1f77f4c23d6987fc4a9edbf47eb4219d591f314c9
SHA256321be1554d0c8aaf169078b16f29bac61f923485fcc124499a6886c4ecadb552
SHA512b62ae51e70417deaba0f0b88acccff8f3168559a84585f7cd93d997e57364c39d25079a3f521ae9203a172682a94d095721b12d840d5428711bba15e175316c7
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
e14fc3accfaa18fee9a5c60689768864
SHA1f77f4c23d6987fc4a9edbf47eb4219d591f314c9
SHA256321be1554d0c8aaf169078b16f29bac61f923485fcc124499a6886c4ecadb552
SHA512b62ae51e70417deaba0f0b88acccff8f3168559a84585f7cd93d997e57364c39d25079a3f521ae9203a172682a94d095721b12d840d5428711bba15e175316c7
-
\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
e14fc3accfaa18fee9a5c60689768864
SHA1f77f4c23d6987fc4a9edbf47eb4219d591f314c9
SHA256321be1554d0c8aaf169078b16f29bac61f923485fcc124499a6886c4ecadb552
SHA512b62ae51e70417deaba0f0b88acccff8f3168559a84585f7cd93d997e57364c39d25079a3f521ae9203a172682a94d095721b12d840d5428711bba15e175316c7
-
\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
e14fc3accfaa18fee9a5c60689768864
SHA1f77f4c23d6987fc4a9edbf47eb4219d591f314c9
SHA256321be1554d0c8aaf169078b16f29bac61f923485fcc124499a6886c4ecadb552
SHA512b62ae51e70417deaba0f0b88acccff8f3168559a84585f7cd93d997e57364c39d25079a3f521ae9203a172682a94d095721b12d840d5428711bba15e175316c7
-
memory/324-12-0x0000000000000000-mapping.dmp
-
memory/1096-19-0x0000000000413FA4-mapping.dmp
-
memory/1096-22-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1160-16-0x0000000000000000-mapping.dmp
-
memory/1208-8-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1208-4-0x0000000000413FA4-mapping.dmp
-
memory/1844-9-0x0000000000000000-mapping.dmp
-
memory/1860-5-0x0000000000000000-mapping.dmp
-
memory/1884-2-0x0000000074D11000-0x0000000074D13000-memory.dmpFilesize
8KB
-
memory/1996-3-0x0000000000000000-mapping.dmp