Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-02-2021 13:17
General
-
Target
POEA DELISTED AGENCIES (BATCH A).PDF.exe
-
Size
515KB
-
MD5
217179aac1ed3994614e7c8666d2f82b
-
SHA1
d62998531aea7d6acb9d0add1f168739e2e9eab1
-
SHA256
0bfae38c37f8478cfd4c92f603b202f8f4bff11f96fdce5959eeaad5142d9a3a
-
SHA512
fd70c49c0fb1df2606e2496497656a4d23ab9868b227a1fef62ff4fa321952964bcd64f70bad1b1a8d763f4985264f1edd6ff19f0b6441bf214f2a37363179ce
Malware Config
Extracted
remcos
shahzad73.casacam.net:2404
shahzad73.ddns.net:2404
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\POEA DELISTED AGENCIES (BATCH A).PDF.exe"C:\Users\Admin\AppData\Local\Temp\POEA DELISTED AGENCIES (BATCH A).PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iUReni" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBFCB.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\POEA DELISTED AGENCIES (BATCH A).PDF.exe"{path}"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpBFCB.tmpMD5
ce663c0d80864fb676dbf68f59b159bb
SHA166342c1b7b0411726f65a73c0fa6f35d8c97dd83
SHA256a6de060e5d4f9bfdec02081341e3ffd53a5182b24c5520db4616ff48ed0dd869
SHA512a02abad55987db2e28c4ea32a2d251e6c8d61674654f3956ba8537f792d3344ca4b9786202d0bd9d02a1bab966890cc97a94a7649803f381ee3fd588d4753bb5
-
memory/428-16-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/428-15-0x0000000000413FA4-mapping.dmp
-
memory/428-14-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4056-12-0x0000000000000000-mapping.dmp
-
memory/4704-6-0x0000000004B90000-0x0000000004B91000-memory.dmpFilesize
4KB
-
memory/4704-9-0x0000000008130000-0x0000000008131000-memory.dmpFilesize
4KB
-
memory/4704-10-0x00000000080F0000-0x00000000080FB000-memory.dmpFilesize
44KB
-
memory/4704-11-0x00000000081D0000-0x0000000008246000-memory.dmpFilesize
472KB
-
memory/4704-8-0x0000000004A90000-0x0000000004A91000-memory.dmpFilesize
4KB
-
memory/4704-7-0x0000000004C80000-0x0000000004C81000-memory.dmpFilesize
4KB
-
memory/4704-2-0x0000000073CE0000-0x00000000743CE000-memory.dmpFilesize
6.9MB
-
memory/4704-5-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/4704-3-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB