Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-01-2021 16:28
Static task
static1
Behavioral task
behavioral1
Sample
Quotation Request.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Quotation Request.exe
Resource
win10v20201028
General
-
Target
Quotation Request.exe
-
Size
498KB
-
MD5
e14fc3accfaa18fee9a5c60689768864
-
SHA1
f77f4c23d6987fc4a9edbf47eb4219d591f314c9
-
SHA256
321be1554d0c8aaf169078b16f29bac61f923485fcc124499a6886c4ecadb552
-
SHA512
b62ae51e70417deaba0f0b88acccff8f3168559a84585f7cd93d997e57364c39d25079a3f521ae9203a172682a94d095721b12d840d5428711bba15e175316c7
Malware Config
Extracted
remcos
chhjvhvkjbhliiuyuj.duckdns.org:20909
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
remcos.exeremcos.exeremcos.exeremcos.exepid process 3492 remcos.exe 4052 remcos.exe 4076 remcos.exe 2056 remcos.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
Quotation Request.exeremcos.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" Quotation Request.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" remcos.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Quotation Request.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Quotation Request.exeremcos.exedescription pid process target process PID 4692 set thread context of 3660 4692 Quotation Request.exe Quotation Request.exe PID 4076 set thread context of 2056 4076 remcos.exe remcos.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 1 IoCs
Processes:
Quotation Request.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings Quotation Request.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
Quotation Request.exeremcos.exeremcos.exepid process 4692 Quotation Request.exe 3492 remcos.exe 4076 remcos.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
remcos.exepid process 2056 remcos.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
Quotation Request.execmd.exeQuotation Request.exeWScript.execmd.exeremcos.exeremcos.exedescription pid process target process PID 4692 wrote to memory of 3600 4692 Quotation Request.exe cmd.exe PID 4692 wrote to memory of 3600 4692 Quotation Request.exe cmd.exe PID 4692 wrote to memory of 3600 4692 Quotation Request.exe cmd.exe PID 4692 wrote to memory of 3660 4692 Quotation Request.exe Quotation Request.exe PID 4692 wrote to memory of 3660 4692 Quotation Request.exe Quotation Request.exe PID 4692 wrote to memory of 3660 4692 Quotation Request.exe Quotation Request.exe PID 4692 wrote to memory of 3660 4692 Quotation Request.exe Quotation Request.exe PID 3600 wrote to memory of 748 3600 cmd.exe schtasks.exe PID 3600 wrote to memory of 748 3600 cmd.exe schtasks.exe PID 3600 wrote to memory of 748 3600 cmd.exe schtasks.exe PID 3660 wrote to memory of 4184 3660 Quotation Request.exe WScript.exe PID 3660 wrote to memory of 4184 3660 Quotation Request.exe WScript.exe PID 3660 wrote to memory of 4184 3660 Quotation Request.exe WScript.exe PID 4184 wrote to memory of 3220 4184 WScript.exe cmd.exe PID 4184 wrote to memory of 3220 4184 WScript.exe cmd.exe PID 4184 wrote to memory of 3220 4184 WScript.exe cmd.exe PID 3220 wrote to memory of 3492 3220 cmd.exe remcos.exe PID 3220 wrote to memory of 3492 3220 cmd.exe remcos.exe PID 3220 wrote to memory of 3492 3220 cmd.exe remcos.exe PID 3492 wrote to memory of 4052 3492 remcos.exe remcos.exe PID 3492 wrote to memory of 4052 3492 remcos.exe remcos.exe PID 3492 wrote to memory of 4052 3492 remcos.exe remcos.exe PID 3492 wrote to memory of 4076 3492 remcos.exe remcos.exe PID 3492 wrote to memory of 4076 3492 remcos.exe remcos.exe PID 3492 wrote to memory of 4076 3492 remcos.exe remcos.exe PID 4076 wrote to memory of 2056 4076 remcos.exe remcos.exe PID 4076 wrote to memory of 2056 4076 remcos.exe remcos.exe PID 4076 wrote to memory of 2056 4076 remcos.exe remcos.exe PID 4076 wrote to memory of 2056 4076 remcos.exe remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation Request.exe"C:\Users\Admin\AppData\Local\Temp\Quotation Request.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\c21b36ce778f4ca1b76d04fcd74cc727.xml"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\c21b36ce778f4ca1b76d04fcd74cc727.xml"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Quotation Request.exe"C:\Users\Admin\AppData\Local\Temp\Quotation Request.exe"2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe5⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\c21b36ce778f4ca1b76d04fcd74cc727.xmlMD5
aa2f6636e997aaa0b01fbc78b1dabe52
SHA1fd462100fc91975dcbea8e361cf1eb8a70f6ad54
SHA256d710b6eda22285684579d8b547e5be2f48883c4bf8db39993b00df30f9dc8723
SHA5126540a3bbdbd3ab51679d5b32380e6c288bf6eba2777d067d40bfe65642ccafecd18028b102dfa46ac189d84282da2b6cb202a4f307587c5639f86834788f5104
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
b92d64fe5b1d1f59df4b738262aea8df
SHA1c8fb1981759c2d9bb2ec91b705985fba5fc7af63
SHA256fa20e9aab03dc8e9f1910aaf0cf42662379fa16ae3a22642084fb97fa3d4f83a
SHA5122566248b93c0cfb0414f033b8dd18bbd4f88180093eac2861107289bcb4ee160f9593706ff1f7d1f2e4ecea430d67a5a2897551a4f9ebd82b707243e300520e2
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
e14fc3accfaa18fee9a5c60689768864
SHA1f77f4c23d6987fc4a9edbf47eb4219d591f314c9
SHA256321be1554d0c8aaf169078b16f29bac61f923485fcc124499a6886c4ecadb552
SHA512b62ae51e70417deaba0f0b88acccff8f3168559a84585f7cd93d997e57364c39d25079a3f521ae9203a172682a94d095721b12d840d5428711bba15e175316c7
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
e14fc3accfaa18fee9a5c60689768864
SHA1f77f4c23d6987fc4a9edbf47eb4219d591f314c9
SHA256321be1554d0c8aaf169078b16f29bac61f923485fcc124499a6886c4ecadb552
SHA512b62ae51e70417deaba0f0b88acccff8f3168559a84585f7cd93d997e57364c39d25079a3f521ae9203a172682a94d095721b12d840d5428711bba15e175316c7
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
e14fc3accfaa18fee9a5c60689768864
SHA1f77f4c23d6987fc4a9edbf47eb4219d591f314c9
SHA256321be1554d0c8aaf169078b16f29bac61f923485fcc124499a6886c4ecadb552
SHA512b62ae51e70417deaba0f0b88acccff8f3168559a84585f7cd93d997e57364c39d25079a3f521ae9203a172682a94d095721b12d840d5428711bba15e175316c7
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
e14fc3accfaa18fee9a5c60689768864
SHA1f77f4c23d6987fc4a9edbf47eb4219d591f314c9
SHA256321be1554d0c8aaf169078b16f29bac61f923485fcc124499a6886c4ecadb552
SHA512b62ae51e70417deaba0f0b88acccff8f3168559a84585f7cd93d997e57364c39d25079a3f521ae9203a172682a94d095721b12d840d5428711bba15e175316c7
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
e14fc3accfaa18fee9a5c60689768864
SHA1f77f4c23d6987fc4a9edbf47eb4219d591f314c9
SHA256321be1554d0c8aaf169078b16f29bac61f923485fcc124499a6886c4ecadb552
SHA512b62ae51e70417deaba0f0b88acccff8f3168559a84585f7cd93d997e57364c39d25079a3f521ae9203a172682a94d095721b12d840d5428711bba15e175316c7
-
memory/748-4-0x0000000000000000-mapping.dmp
-
memory/2056-18-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2056-16-0x0000000000413FA4-mapping.dmp
-
memory/3220-9-0x0000000000000000-mapping.dmp
-
memory/3492-10-0x0000000000000000-mapping.dmp
-
memory/3600-2-0x0000000000000000-mapping.dmp
-
memory/3660-8-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3660-3-0x0000000000413FA4-mapping.dmp
-
memory/4076-14-0x0000000000000000-mapping.dmp
-
memory/4184-5-0x0000000000000000-mapping.dmp