Overview

overview

10

Static

static

FV02700013...df.exe

windows7_x64

10

FV02700013...df.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    20-01-2021 18:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    FV027000130023; ASORIOFRIO SAS; FACTURACION ELECTRONICApdf.exe

  • Size

    1.3MB

  • MD5

    a19f05f20d0763c0d7794ff03d8db8d4

  • SHA1

    78f4586c4e318ff44d4886ac5665cdebe9f0196e

  • SHA256

    db1c03a38ddda7f85b4d812e7aa84f11464b02719cb621d21289464fd7e14fa0

  • SHA512

    ffda1d8f6544bd3d048585f8129166880bb08a90983f99c10c22103ff14c07de12da6259ed4d9f0e494a514e3b53cbcff2f4ff242e92af5ea5cf25bcf1e7895e

Score
10/10
remcosransomwarerat

Malware Config

Extracted

Family

remcos

C2

starkduck0001.duckdns.org:9403

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    ransomware
  • Suspicious use of SetThreadContext 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FV027000130023; ASORIOFRIO SAS; FACTURACION ELECTRONICApdf.exe
    "C:\Users\Admin\AppData\Local\Temp\FV027000130023; ASORIOFRIO SAS; FACTURACION ELECTRONICApdf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2008
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rBoJsy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCF9E.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:396
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "{path}"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:1364

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpCF9E.tmp
    MD5

    846156f1e119201cf27d925d5b5dd854

    SHA1

    b5b9c59d1899947850122cba4a37183fa1dd47e8

    SHA256

    1fdfa09be2f3f352195a9a2f21e577456db9b72cb51b95bfaedf678459f2bd0f

    SHA512

    3adc0605c3393af88dc66e2d0c6eaee907e7819eacee288b89a582ef75784c6fb2c15d74f65b1129b6ff187d36a4d0be87b51d0fcf634ef7f14703411fd012f6

    Download Submit
  • memory/396-9-0x0000000000000000-mapping.dmp
    Download
  • memory/1364-11-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

    Download
  • memory/1364-12-0x0000000000413B74-mapping.dmp
    Download
  • memory/1364-13-0x0000000076641000-0x0000000076643000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1364-14-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

    Download
  • memory/2008-2-0x0000000074BA0000-0x000000007528E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/2008-3-0x0000000001050000-0x0000000001051000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2008-5-0x0000000000FB0000-0x0000000001024000-memory.dmp
    Filesize

    464KB

    Download
  • memory/2008-6-0x0000000000330000-0x0000000000331000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2008-7-0x0000000000320000-0x000000000032E000-memory.dmp
    Filesize

    56KB

    Download
  • memory/2008-8-0x0000000000BB0000-0x0000000000BEE000-memory.dmp
    Filesize

    248KB

    Download