Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
12-04-2021 19:42
General
-
Target
FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe
-
Size
955KB
-
MD5
66bc12a8ad1e13c3e6dd65bd6db4790a
-
SHA1
61048635297de9edf916ab5c2bbeeac865cad997
-
SHA256
419000b66f04ce0f9b5b3b9f4825d4b68d21df27e99d02b483bd96aa240413d7
-
SHA512
0f9fe805f7926a686382da2acc24da889be640b1951eb1a68c4f853aca56e7f3b1ff13d213d419f18e64b49f7a1c38edec556e2531d89c44e02755b286cec1aa
Malware Config
Extracted
remcos
portugal16.duckdns.org:1717
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe"C:\Users\Admin\AppData\Local\Temp\FORMAENWORDDELPROCEP364440002 FORMAENWORDDELPROCEP364440004.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GbbHlpGhB" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA286.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA286.tmpMD5
a5c0ab64d437291a4ee7bdcaf1db98c8
SHA1dd20b3bf077a3d47982929cc33fab5cb68193338
SHA256f9158108e3d9a240f329208dc10eb0cef58c95fc39f7cb61d6d4497a0e101fdb
SHA512e84a79e849ebf98b672ae34cbe236c1ff0ed556086c8fa403f7ec15a502025ab0bbd54c8f3689db8c7e267ca27738f2c6084ee2894d915d4e1131f9607de38d3
-
memory/340-68-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/340-69-0x0000000000413E54-mapping.dmp
-
memory/340-70-0x0000000076E11000-0x0000000076E13000-memory.dmpFilesize
8KB
-
memory/340-71-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/764-66-0x0000000000000000-mapping.dmp
-
memory/1104-59-0x0000000000E70000-0x0000000000E71000-memory.dmpFilesize
4KB
-
memory/1104-61-0x0000000000420000-0x000000000049F000-memory.dmpFilesize
508KB
-
memory/1104-62-0x0000000005DB0000-0x0000000005DB1000-memory.dmpFilesize
4KB
-
memory/1104-63-0x0000000000310000-0x0000000000315000-memory.dmpFilesize
20KB
-
memory/1104-64-0x0000000009760000-0x00000000097F6000-memory.dmpFilesize
600KB
-
memory/1104-65-0x00000000007C0000-0x000000000080D000-memory.dmpFilesize
308KB