Analysis
-
max time kernel
57s -
max time network
56s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-01-2021 07:51
Static task
static1
Behavioral task
behavioral1
Sample
Quotation Request-PDF_PDF.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Quotation Request-PDF_PDF.exe
Resource
win10v20201028
General
-
Target
Quotation Request-PDF_PDF.exe
-
Size
1.6MB
-
MD5
25a3b2a25320e45a9a58eb84789719ee
-
SHA1
7b1ffe6a3be0d676b89f2986ca1ae6fee11fe271
-
SHA256
858819973735c0c8715675602e067da2f7ef3ac0fa34bc2c96c39831addb8992
-
SHA512
e526426fdee134ebffd28a9c9625fc0907b1fcdc6d6047df54d353b0841464dbe09db87b1e44ac2f549b926032e5e3780a1469a4aa9fa2c69b556dd3efcfdb43
Malware Config
Extracted
remcos
nkosarevaocs.duckdns.org:7266
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
remcos.exepid process 368 remcos.exe -
Drops startup file 1 IoCs
Processes:
Quotation Request-PDF_PDF.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.url Quotation Request-PDF_PDF.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1536 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Quotation Request-PDF_PDF.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Quotation Request-PDF_PDF.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" Quotation Request-PDF_PDF.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Quotation Request-PDF_PDF.exedescription pid process target process PID 1044 set thread context of 1680 1044 Quotation Request-PDF_PDF.exe Quotation Request-PDF_PDF.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Quotation Request-PDF_PDF.exepid process 1044 Quotation Request-PDF_PDF.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
Quotation Request-PDF_PDF.exeremcos.exepid process 1044 Quotation Request-PDF_PDF.exe 1044 Quotation Request-PDF_PDF.exe 1044 Quotation Request-PDF_PDF.exe 368 remcos.exe 368 remcos.exe 368 remcos.exe -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
Quotation Request-PDF_PDF.exeremcos.exepid process 1044 Quotation Request-PDF_PDF.exe 1044 Quotation Request-PDF_PDF.exe 1044 Quotation Request-PDF_PDF.exe 368 remcos.exe 368 remcos.exe 368 remcos.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Quotation Request-PDF_PDF.exeQuotation Request-PDF_PDF.exeWScript.execmd.exedescription pid process target process PID 1044 wrote to memory of 1680 1044 Quotation Request-PDF_PDF.exe Quotation Request-PDF_PDF.exe PID 1044 wrote to memory of 1680 1044 Quotation Request-PDF_PDF.exe Quotation Request-PDF_PDF.exe PID 1044 wrote to memory of 1680 1044 Quotation Request-PDF_PDF.exe Quotation Request-PDF_PDF.exe PID 1044 wrote to memory of 1680 1044 Quotation Request-PDF_PDF.exe Quotation Request-PDF_PDF.exe PID 1044 wrote to memory of 1680 1044 Quotation Request-PDF_PDF.exe Quotation Request-PDF_PDF.exe PID 1680 wrote to memory of 1324 1680 Quotation Request-PDF_PDF.exe WScript.exe PID 1680 wrote to memory of 1324 1680 Quotation Request-PDF_PDF.exe WScript.exe PID 1680 wrote to memory of 1324 1680 Quotation Request-PDF_PDF.exe WScript.exe PID 1680 wrote to memory of 1324 1680 Quotation Request-PDF_PDF.exe WScript.exe PID 1324 wrote to memory of 1536 1324 WScript.exe cmd.exe PID 1324 wrote to memory of 1536 1324 WScript.exe cmd.exe PID 1324 wrote to memory of 1536 1324 WScript.exe cmd.exe PID 1324 wrote to memory of 1536 1324 WScript.exe cmd.exe PID 1536 wrote to memory of 368 1536 cmd.exe remcos.exe PID 1536 wrote to memory of 368 1536 cmd.exe remcos.exe PID 1536 wrote to memory of 368 1536 cmd.exe remcos.exe PID 1536 wrote to memory of 368 1536 cmd.exe remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation Request-PDF_PDF.exe"C:\Users\Admin\AppData\Local\Temp\Quotation Request-PDF_PDF.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation Request-PDF_PDF.exe"C:\Users\Admin\AppData\Local\Temp\Quotation Request-PDF_PDF.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe5⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
b92d64fe5b1d1f59df4b738262aea8df
SHA1c8fb1981759c2d9bb2ec91b705985fba5fc7af63
SHA256fa20e9aab03dc8e9f1910aaf0cf42662379fa16ae3a22642084fb97fa3d4f83a
SHA5122566248b93c0cfb0414f033b8dd18bbd4f88180093eac2861107289bcb4ee160f9593706ff1f7d1f2e4ecea430d67a5a2897551a4f9ebd82b707243e300520e2
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
25a3b2a25320e45a9a58eb84789719ee
SHA17b1ffe6a3be0d676b89f2986ca1ae6fee11fe271
SHA256858819973735c0c8715675602e067da2f7ef3ac0fa34bc2c96c39831addb8992
SHA512e526426fdee134ebffd28a9c9625fc0907b1fcdc6d6047df54d353b0841464dbe09db87b1e44ac2f549b926032e5e3780a1469a4aa9fa2c69b556dd3efcfdb43
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
25a3b2a25320e45a9a58eb84789719ee
SHA17b1ffe6a3be0d676b89f2986ca1ae6fee11fe271
SHA256858819973735c0c8715675602e067da2f7ef3ac0fa34bc2c96c39831addb8992
SHA512e526426fdee134ebffd28a9c9625fc0907b1fcdc6d6047df54d353b0841464dbe09db87b1e44ac2f549b926032e5e3780a1469a4aa9fa2c69b556dd3efcfdb43
-
\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
25a3b2a25320e45a9a58eb84789719ee
SHA17b1ffe6a3be0d676b89f2986ca1ae6fee11fe271
SHA256858819973735c0c8715675602e067da2f7ef3ac0fa34bc2c96c39831addb8992
SHA512e526426fdee134ebffd28a9c9625fc0907b1fcdc6d6047df54d353b0841464dbe09db87b1e44ac2f549b926032e5e3780a1469a4aa9fa2c69b556dd3efcfdb43
-
memory/368-15-0x0000000000000000-mapping.dmp
-
memory/1044-3-0x00000000003B0000-0x00000000003D1000-memory.dmpFilesize
132KB
-
memory/1044-5-0x00000000001F0000-0x00000000001F3000-memory.dmpFilesize
12KB
-
memory/1044-2-0x00000000760A1000-0x00000000760A3000-memory.dmpFilesize
8KB
-
memory/1324-7-0x0000000000000000-mapping.dmp
-
memory/1324-12-0x0000000002780000-0x0000000002784000-memory.dmpFilesize
16KB
-
memory/1536-11-0x0000000000000000-mapping.dmp
-
memory/1680-4-0x0000000000413FA4-mapping.dmp
-
memory/1680-10-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB