Overview

overview

10

Static

static

1

Quote.exe

windows7_x64

10

Quote.exe

windows10_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    17-02-2021 23:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Quote.exe

  • Size

    233KB

  • MD5

    a96067cac28b1f5c3de4e1b6c7d0a402

  • SHA1

    51c65c8ece4bfd5c7d1b09105440f3f02d3b14ca

  • SHA256

    79e70809a85e291f9da3d391131208ce7645dd512eb6bb71811154b43da23222

  • SHA512

    1627058a9a884965bce4ece1ccf03c24a849cd79fe883c923ae2eb56c8e0bbb730cf823e550c080685af1f906a38f2847a65dc8ed236181d97eee9ddcfc3f96e

Score
10/10
remcospersistencerat

Malware Config

Extracted

Family

remcos

C2

103.89.88.238:4299

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Quote.exe
    "C:\Users\Admin\AppData\Local\Temp\Quote.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:4684
    • C:\Users\Admin\AppData\Local\Temp\Quote.exe
      "C:\Users\Admin\AppData\Local\Temp\Quote.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:5076

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nhop.dll
    MD5

    ff98a06930bd4c0a11500f2378f23ffa

    SHA1

    c25a3da1562f0dc0247140ff8636c88a843e9a66

    SHA256

    97cc714ecc6d201ff90e6947bedf9345dd9f0abffaa0687607d216f4567dfbd9

    SHA512

    8e33d253610a07c6603c6da9714bc18f2b9a6f3e229fd5d9873783ce842214689e3296bb37864720ca561a74b72beb5f7852ae3a732f4ec85c046646acd25916

    Download Submit
  • \Users\Admin\AppData\Local\Temp\nso2B7B.tmp\System.dll
    MD5

    fccff8cb7a1067e23fd2e2b63971a8e1

    SHA1

    30e2a9e137c1223a78a0f7b0bf96a1c361976d91

    SHA256

    6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

    SHA512

    f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

    Download Submit
  • memory/5076-4-0x0000000000413FA4-mapping.dmp
    Download
  • memory/5076-5-0x0000000000400000-0x0000000000421000-memory.dmp
    Filesize

    132KB

    Download