Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
20-01-2021 18:32
General
-
Target
FV027000130023; ASORIOFRIO SAS; FACTURACION ELECTRONICApdf.exe
-
Size
1.3MB
-
MD5
a19f05f20d0763c0d7794ff03d8db8d4
-
SHA1
78f4586c4e318ff44d4886ac5665cdebe9f0196e
-
SHA256
db1c03a38ddda7f85b4d812e7aa84f11464b02719cb621d21289464fd7e14fa0
-
SHA512
ffda1d8f6544bd3d048585f8129166880bb08a90983f99c10c22103ff14c07de12da6259ed4d9f0e494a514e3b53cbcff2f4ff242e92af5ea5cf25bcf1e7895e
Malware Config
Extracted
remcos
starkduck0001.duckdns.org:9403
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetThreadContext 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FV027000130023; ASORIOFRIO SAS; FACTURACION ELECTRONICApdf.exe"C:\Users\Admin\AppData\Local\Temp\FV027000130023; ASORIOFRIO SAS; FACTURACION ELECTRONICApdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rBoJsy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFD90.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpFD90.tmpMD5
bd9bba0e1aa893f3dbd13ea6625810a3
SHA1f3a9aee9a2a79a89f0b357dacdcbe2d774390062
SHA2564ccf6d9e4e7eb4f3bcd32a82dbf4f708df0a19af26d8912cc109fb3cbb212562
SHA5128844fb6cfc2098484f41879e63f226cb2f87712b0fc8b8d355e4c2e633f33871092c9c405accfa4bf84f26faaa58668f50d92a3ae7f57158da0701ff53e54599
-
memory/388-17-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/388-15-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/388-16-0x0000000000413B74-mapping.dmp
-
memory/648-13-0x0000000000000000-mapping.dmp
-
memory/4764-9-0x0000000004DB0000-0x0000000004DB1000-memory.dmpFilesize
4KB
-
memory/4764-2-0x00000000732D0000-0x00000000739BE000-memory.dmpFilesize
6.9MB
-
memory/4764-10-0x0000000005240000-0x000000000524E000-memory.dmpFilesize
56KB
-
memory/4764-11-0x0000000005AC0000-0x0000000005AFE000-memory.dmpFilesize
248KB
-
memory/4764-12-0x0000000005BC0000-0x0000000005BC1000-memory.dmpFilesize
4KB
-
memory/4764-8-0x0000000004E30000-0x0000000004E31000-memory.dmpFilesize
4KB
-
memory/4764-7-0x0000000004B00000-0x0000000004B01000-memory.dmpFilesize
4KB
-
memory/4764-6-0x0000000005390000-0x0000000005391000-memory.dmpFilesize
4KB
-
memory/4764-5-0x0000000007010000-0x0000000007084000-memory.dmpFilesize
464KB
-
memory/4764-3-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB