Overview

overview

10

Static

static

POEA DELIS...DF.exe

windows7_x64

10

POEA DELIS...DF.exe

windows10_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    18-02-2021 13:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    POEA DELISTED AGENCIES (BATCH A).PDF.exe

  • Size

    515KB

  • MD5

    217179aac1ed3994614e7c8666d2f82b

  • SHA1

    d62998531aea7d6acb9d0add1f168739e2e9eab1

  • SHA256

    0bfae38c37f8478cfd4c92f603b202f8f4bff11f96fdce5959eeaad5142d9a3a

  • SHA512

    fd70c49c0fb1df2606e2496497656a4d23ab9868b227a1fef62ff4fa321952964bcd64f70bad1b1a8d763f4985264f1edd6ff19f0b6441bf214f2a37363179ce

Score
10/10
remcosrat

Malware Config

Extracted

Family

remcos

C2

shahzad73.casacam.net:2404

shahzad73.ddns.net:2404

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\POEA DELISTED AGENCIES (BATCH A).PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\POEA DELISTED AGENCIES (BATCH A).PDF.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1856
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iUReni" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1AD1.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1336
    • C:\Users\Admin\AppData\Local\Temp\POEA DELISTED AGENCIES (BATCH A).PDF.exe
      "{path}"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:1700

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp1AD1.tmp
    MD5

    2a93b782a97693a92ed54d023e56c9ad

    SHA1

    992175a3452c89d218203b511136de254587cfc0

    SHA256

    b3afb7c8cacba40f81de989c6bf6622e66addee3def31d53430a36647fc1c73f

    SHA512

    5f6d85d3efb8682503f3567e220a05248b2da3c533696acf0b68262153ec09a470c75fe787eda49d060b93604f6851ad915aaa6986fce8206dd5ed6cd5d7a46b

    Download Submit
  • memory/1336-8-0x0000000000000000-mapping.dmp
    Download
  • memory/1700-10-0x0000000000400000-0x0000000000421000-memory.dmp
    Filesize

    132KB

    Download
  • memory/1700-11-0x0000000000413FA4-mapping.dmp
    Download
  • memory/1700-12-0x00000000767E1000-0x00000000767E3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1700-13-0x0000000000400000-0x0000000000421000-memory.dmp
    Filesize

    132KB

    Download
  • memory/1856-2-0x0000000074590000-0x0000000074C7E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/1856-3-0x0000000000CB0000-0x0000000000CB1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1856-5-0x0000000004E00000-0x0000000004E01000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1856-6-0x0000000000250000-0x000000000025B000-memory.dmp
    Filesize

    44KB

    Download
  • memory/1856-7-0x0000000004F40000-0x0000000004FB6000-memory.dmp
    Filesize

    472KB

    Download