Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    18-01-2021 07:50

General

  • Target

    Urgent order 1812021-672 Q30721,pdf.exe

  • Size

    888KB

  • MD5

    5f4f037e04be43a34b342e4e481e1a90

  • SHA1

    3fdada0e5c3a0e73f38f5b5bc16c13323ad30ff4

  • SHA256

    af5e020c1ac3f3590036495b28ebad3153c66986da343142db222a5df5d42b2d

  • SHA512

    172f0130ac9d93ca31ba0af555cf8314d94be50cdba9b4ad0278a1d866d028e84020df95269ad56274621d3671d9871c85d8543d17fa6591694febf417e33a89

Score
10/10

Malware Config

Extracted

Family

remcos

C2

goddywin.freedynamicdns.net:2525

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Suspicious use of SetThreadContext 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Urgent order 1812021-672 Q30721,pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Urgent order 1812021-672 Q30721,pdf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4704
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yQrHLa" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDCE8.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:4072
    • C:\Users\Admin\AppData\Local\Temp\Urgent order 1812021-672 Q30721,pdf.exe
      "{path}"
      2⤵
        PID:3036

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpDCE8.tmp
      MD5

      9357fabda24788acd37bc93214a13a47

      SHA1

      23b63d4ca08e8b0e6c69db15fefa3c6aad0a2b15

      SHA256

      4a36d147c3bdd8d51cfc930b30db97863fc17ad857c4d2da032c65a3302bfbe0

      SHA512

      b735f4a7406cbb218cf5108436ef8955d55379e54d67397182c07072fbaaa892d3413536a029865ffba0bf5fe8c1d3482e7cb1786be37a9a30b1012f0dae2826

    • memory/3036-16-0x0000000000400000-0x0000000000421000-memory.dmp
      Filesize

      132KB

    • memory/3036-15-0x0000000000413FA4-mapping.dmp
    • memory/3036-14-0x0000000000400000-0x0000000000421000-memory.dmp
      Filesize

      132KB

    • memory/4072-12-0x0000000000000000-mapping.dmp
    • memory/4704-6-0x0000000004B90000-0x0000000004B91000-memory.dmp
      Filesize

      4KB

    • memory/4704-9-0x0000000004B10000-0x0000000004B11000-memory.dmp
      Filesize

      4KB

    • memory/4704-10-0x0000000006900000-0x000000000694E000-memory.dmp
      Filesize

      312KB

    • memory/4704-11-0x0000000006FF0000-0x0000000006FF1000-memory.dmp
      Filesize

      4KB

    • memory/4704-8-0x0000000004EA0000-0x0000000004EAE000-memory.dmp
      Filesize

      56KB

    • memory/4704-7-0x0000000004B80000-0x0000000004B81000-memory.dmp
      Filesize

      4KB

    • memory/4704-2-0x0000000073CE0000-0x00000000743CE000-memory.dmp
      Filesize

      6.9MB

    • memory/4704-5-0x0000000004FF0000-0x0000000004FF1000-memory.dmp
      Filesize

      4KB

    • memory/4704-3-0x0000000000240000-0x0000000000241000-memory.dmp
      Filesize

      4KB