Overview

overview

10

Static

static

1

Request fo...on.exe

windows7_x64

10

Request fo...on.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    23-02-2021 06:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Request for Quotation.exe

  • Size

    241KB

  • MD5

    ae4bd6c5a7eaa50704d43d6054fc5dbd

  • SHA1

    ab597cfc0433999f2032c56fe2c9e17081bcab46

  • SHA256

    8e51354c8b2f461ab0cfb92409bc45bf4e06ae244080513e2d6224dc22f47771

  • SHA512

    b7b0b772a5e9e969f3d5389c1c12f053a5b3a7aa774fffa3a2dac8903df09a2a6b9d242a4f1fb63602d7581226ec647be44139d27aacd82dbec6242bcd3bab43

Score
10/10
remcosratspyware

Malware Config

Extracted

Family

remcos

C2

103.89.88.238:4299

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe
    "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1832
    • C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe
      "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1040
      • C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe
        "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe" /stext "C:\Users\Admin\AppData\Local\Temp\hmlqrhptxh"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1420
      • C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe
        "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe" /stext "C:\Users\Admin\AppData\Local\Temp\kgziraavspspri"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1152
      • C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe
        "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe" /stext "C:\Users\Admin\AppData\Local\Temp\uietsslogxkuconlp"
        3⤵
          PID:1636

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\hmlqrhptxh
      MD5

      f3b25701fe362ec84616a93a45ce9998

      SHA1

      d62636d8caec13f04e28442a0a6fa1afeb024bbb

      SHA256

      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

      SHA512

      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

      Download Submit
    • \Users\Admin\AppData\Local\Temp\aqx5kku77.dll
      MD5

      d58bf216c5da94776aaca50132847a49

      SHA1

      4444cbb553381c13409707562ced76ce6525879e

      SHA256

      04870a6cb3cf7b291fa4bb2378b3aeae921e0c5d220a8420c327d779b7fd2180

      SHA512

      19e7f5ef052ae1195a01a993fc3b2e5dd464299a5e666daa18132fe7f6264a9f354136cc2f3c90d0b20e7fcdc4bf9f8f55c2d63cb74df0c6da6f1fb1610af4fa

      Download Submit
    • \Users\Admin\AppData\Local\Temp\nssA71A.tmp\System.dll
      MD5

      fccff8cb7a1067e23fd2e2b63971a8e1

      SHA1

      30e2a9e137c1223a78a0f7b0bf96a1c361976d91

      SHA256

      6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

      SHA512

      f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

      Download Submit
    • memory/860-20-0x000007FEF7BD0000-0x000007FEF7E4A000-memory.dmp
      Filesize

      2.5MB

      Download
    • memory/1040-5-0x0000000000413FA4-mapping.dmp
      Download
    • memory/1040-7-0x0000000000400000-0x0000000000421000-memory.dmp
      Filesize

      132KB

      Download
    • memory/1152-18-0x0000000000400000-0x0000000000424000-memory.dmp
      Filesize

      144KB

      Download
    • memory/1152-10-0x0000000000400000-0x0000000000424000-memory.dmp
      Filesize

      144KB

      Download
    • memory/1152-11-0x0000000000422206-mapping.dmp
      Download
    • memory/1420-9-0x0000000000476274-mapping.dmp
      Download
    • memory/1420-17-0x0000000000400000-0x0000000000478000-memory.dmp
      Filesize

      480KB

      Download
    • memory/1420-8-0x0000000000400000-0x0000000000478000-memory.dmp
      Filesize

      480KB

      Download
    • memory/1636-15-0x0000000000455238-mapping.dmp
      Download
    • memory/1636-14-0x0000000000400000-0x0000000000457000-memory.dmp
      Filesize

      348KB

      Download
    • memory/1636-19-0x0000000000400000-0x0000000000457000-memory.dmp
      Filesize

      348KB

      Download
    • memory/1832-2-0x00000000765A1000-0x00000000765A3000-memory.dmp
      Filesize

      8KB

      Download