Overview

overview

10

Static

static

1

Request fo...on.exe

windows7_x64

10

Request fo...on.exe

windows10_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    23-02-2021 06:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Request for Quotation.exe

  • Size

    241KB

  • MD5

    ae4bd6c5a7eaa50704d43d6054fc5dbd

  • SHA1

    ab597cfc0433999f2032c56fe2c9e17081bcab46

  • SHA256

    8e51354c8b2f461ab0cfb92409bc45bf4e06ae244080513e2d6224dc22f47771

  • SHA512

    b7b0b772a5e9e969f3d5389c1c12f053a5b3a7aa774fffa3a2dac8903df09a2a6b9d242a4f1fb63602d7581226ec647be44139d27aacd82dbec6242bcd3bab43

Score
10/10
remcosratspyware

Malware Config

Extracted

Family

remcos

C2

103.89.88.238:4299

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • NirSoft MailPassView 1 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe
    "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:4804
    • C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe
      "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3420
      • C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe
        "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe" /stext "C:\Users\Admin\AppData\Local\Temp\mnokfunscruxfzoanigpwstjehygiegdmi"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2236
      • C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe
        "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe" /stext "C:\Users\Admin\AppData\Local\Temp\xptcgmy"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4300
      • C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe
        "C:\Users\Admin\AppData\Local\Temp\Request for Quotation.exe" /stext "C:\Users\Admin\AppData\Local\Temp\hjgvgfineh"
        3⤵
          PID:2796

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\mnokfunscruxfzoanigpwstjehygiegdmi
      MD5

      1e69b6d630e694119f4f8c448a430b60

      SHA1

      b118feca7d85ec706b54279a1dafc71673fe6e54

      SHA256

      2f7eedbe9e3b0a3aa08df4fa2dc27de189484a8da8925cc6056513d744b7c00e

      SHA512

      19924161f75cbbcf7bdf122f3aecb43d813186a6693413ccc15bb2945d48401c8f058edf034cc641cedc97ae5e328d88fabfab1b5f324014b83671b3ebd78822

      Download Submit
    • \Users\Admin\AppData\Local\Temp\aqx5kku77.dll
      MD5

      d58bf216c5da94776aaca50132847a49

      SHA1

      4444cbb553381c13409707562ced76ce6525879e

      SHA256

      04870a6cb3cf7b291fa4bb2378b3aeae921e0c5d220a8420c327d779b7fd2180

      SHA512

      19e7f5ef052ae1195a01a993fc3b2e5dd464299a5e666daa18132fe7f6264a9f354136cc2f3c90d0b20e7fcdc4bf9f8f55c2d63cb74df0c6da6f1fb1610af4fa

      Download Submit
    • \Users\Admin\AppData\Local\Temp\nsd67F9.tmp\System.dll
      MD5

      fccff8cb7a1067e23fd2e2b63971a8e1

      SHA1

      30e2a9e137c1223a78a0f7b0bf96a1c361976d91

      SHA256

      6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

      SHA512

      f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

      Download Submit
    • memory/2236-9-0x0000000000400000-0x0000000000478000-memory.dmp
      Filesize

      480KB

      Download
    • memory/2236-6-0x0000000000400000-0x0000000000478000-memory.dmp
      Filesize

      480KB

      Download
    • memory/2236-7-0x0000000000476274-mapping.dmp
      Download
    • memory/2796-14-0x0000000000400000-0x0000000000457000-memory.dmp
      Filesize

      348KB

      Download
    • memory/2796-12-0x0000000000455238-mapping.dmp
      Download
    • memory/2796-11-0x0000000000400000-0x0000000000457000-memory.dmp
      Filesize

      348KB

      Download
    • memory/3420-5-0x0000000000400000-0x0000000000421000-memory.dmp
      Filesize

      132KB

      Download
    • memory/3420-4-0x0000000000413FA4-mapping.dmp
      Download
    • memory/4300-10-0x0000000000422206-mapping.dmp
      Download
    • memory/4300-13-0x0000000000400000-0x0000000000424000-memory.dmp
      Filesize

      144KB

      Download
    • memory/4300-8-0x0000000000400000-0x0000000000424000-memory.dmp
      Filesize

      144KB

      Download