Analysis
- max time kernel
90s - max time network
111s - platform
windows10_x64 - resource
win10v20201028 - submitted
07/04/2021, 05:52
General
- Target INVOICE_.EXE
- Size 618KB
- Sample210407-461ny2jc9e
- SHA256 8acdca153a4e16a5ff668a0a5ad8c274d2307a88cda385575ee4fbb8374d2254
Score
10/10
Malware Config
Extracted
Family
-
remcos
C2
-
185.19.85.171:2055
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\INVOICE_.EXE"C:\Users\Admin\AppData\Local\Temp\INVOICE_.EXE"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 640 -s 19322⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/640-2-0x0000000000640000-0x0000000000641000-memory.dmp
memory/640-3-0x0000000002250000-0x000000000226A000-memory.dmp
memory/640-5-0x0000000004FC0000-0x0000000005039000-memory.dmp
memory/640-4-0x0000000004F41000-0x0000000004FBA000-memory.dmp
memory/3444-6-0x00000000040D0000-0x00000000040D1000-memory.dmp
memory/3444-7-0x00000000040D0000-0x00000000040D1000-memory.dmp