Analysis
-
max time kernel
107s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
21-04-2021 08:39
Static task
static1
Behavioral task
behavioral1
Sample
Query_Ref_5787533_pdf.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Query_Ref_5787533_pdf.exe
Resource
win10v20210410
General
-
Target
Query_Ref_5787533_pdf.exe
-
Size
957KB
-
MD5
0b7883cd326d76228c722b69541cb9a3
-
SHA1
bf513758205dda0b62084d9b9718042aad5c836c
-
SHA256
741ffe5460a43194d3a8cf76729abd8f6a5fb7d991e219037215920195a38c5e
-
SHA512
2bc401cc1ce71ee9f783a67433be84dfa14d2b52715586a2a318cad51db15d3de09370a4ff580efa05935c91e5f7658794467166c5af38f65b8027d310a7b612
Malware Config
Extracted
remcos
kjdes.ddns.net:6062
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
remcos.exepid process 3808 remcos.exe -
Deletes itself 1 IoCs
Processes:
WScript.exepid process 3588 WScript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Query_Ref_5787533_pdf.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\ Query_Ref_5787533_pdf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" Query_Ref_5787533_pdf.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Query_Ref_5787533_pdf.exedescription pid process target process PID 2208 set thread context of 1132 2208 Query_Ref_5787533_pdf.exe Query_Ref_5787533_pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 1 IoCs
Processes:
Query_Ref_5787533_pdf.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings Query_Ref_5787533_pdf.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Query_Ref_5787533_pdf.exepid process 2208 Query_Ref_5787533_pdf.exe 2208 Query_Ref_5787533_pdf.exe 2208 Query_Ref_5787533_pdf.exe 2208 Query_Ref_5787533_pdf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Query_Ref_5787533_pdf.exedescription pid process Token: SeDebugPrivilege 2208 Query_Ref_5787533_pdf.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
Query_Ref_5787533_pdf.exeQuery_Ref_5787533_pdf.exeWScript.execmd.exedescription pid process target process PID 2208 wrote to memory of 4076 2208 Query_Ref_5787533_pdf.exe schtasks.exe PID 2208 wrote to memory of 4076 2208 Query_Ref_5787533_pdf.exe schtasks.exe PID 2208 wrote to memory of 4076 2208 Query_Ref_5787533_pdf.exe schtasks.exe PID 2208 wrote to memory of 1132 2208 Query_Ref_5787533_pdf.exe Query_Ref_5787533_pdf.exe PID 2208 wrote to memory of 1132 2208 Query_Ref_5787533_pdf.exe Query_Ref_5787533_pdf.exe PID 2208 wrote to memory of 1132 2208 Query_Ref_5787533_pdf.exe Query_Ref_5787533_pdf.exe PID 2208 wrote to memory of 1132 2208 Query_Ref_5787533_pdf.exe Query_Ref_5787533_pdf.exe PID 2208 wrote to memory of 1132 2208 Query_Ref_5787533_pdf.exe Query_Ref_5787533_pdf.exe PID 2208 wrote to memory of 1132 2208 Query_Ref_5787533_pdf.exe Query_Ref_5787533_pdf.exe PID 2208 wrote to memory of 1132 2208 Query_Ref_5787533_pdf.exe Query_Ref_5787533_pdf.exe PID 2208 wrote to memory of 1132 2208 Query_Ref_5787533_pdf.exe Query_Ref_5787533_pdf.exe PID 2208 wrote to memory of 1132 2208 Query_Ref_5787533_pdf.exe Query_Ref_5787533_pdf.exe PID 2208 wrote to memory of 1132 2208 Query_Ref_5787533_pdf.exe Query_Ref_5787533_pdf.exe PID 2208 wrote to memory of 1132 2208 Query_Ref_5787533_pdf.exe Query_Ref_5787533_pdf.exe PID 2208 wrote to memory of 1132 2208 Query_Ref_5787533_pdf.exe Query_Ref_5787533_pdf.exe PID 1132 wrote to memory of 3588 1132 Query_Ref_5787533_pdf.exe WScript.exe PID 1132 wrote to memory of 3588 1132 Query_Ref_5787533_pdf.exe WScript.exe PID 1132 wrote to memory of 3588 1132 Query_Ref_5787533_pdf.exe WScript.exe PID 3588 wrote to memory of 3496 3588 WScript.exe cmd.exe PID 3588 wrote to memory of 3496 3588 WScript.exe cmd.exe PID 3588 wrote to memory of 3496 3588 WScript.exe cmd.exe PID 3496 wrote to memory of 3808 3496 cmd.exe remcos.exe PID 3496 wrote to memory of 3808 3496 cmd.exe remcos.exe PID 3496 wrote to memory of 3808 3496 cmd.exe remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Query_Ref_5787533_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Query_Ref_5787533_pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YwDUrECuAdTV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA50B.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Query_Ref_5787533_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Query_Ref_5787533_pdf.exe"2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe5⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
b296f9f1ff59fdbf02ee4324414e09e5
SHA131221dea05c20aacc89efd78390d1bc6ca1a3105
SHA256eb6c18a8da55031aaea75fd038ddd78dbf309b7febdd859668d1e083a989e983
SHA51263e0cbe2e34ec331530daf0f62f7c76ff1b0aaac88aadc25436e18e212b4628f8c1b7c17d3f7df3a2ff2b6a0bbb5a95a905b66662cedfd3a9c6b4c21f8d39c18
-
C:\Users\Admin\AppData\Local\Temp\tmpA50B.tmpMD5
b4cb918564828be2392b7b59fd4dd24f
SHA11c173d546b6ae2ba23f50e3904eb43091f091969
SHA25650d0d863440f31f28a5f511e02003bdd29eda1098dc30e27e4323462cf441b9e
SHA512b3a95fd421d1fb01cb52404b4fe09951ad21279eb857b899d3a175284a7a721693d6d61935ae5f6117fac9d2a8472748798e0587e452fc99f2d4f9c70dce3182
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
0b7883cd326d76228c722b69541cb9a3
SHA1bf513758205dda0b62084d9b9718042aad5c836c
SHA256741ffe5460a43194d3a8cf76729abd8f6a5fb7d991e219037215920195a38c5e
SHA5122bc401cc1ce71ee9f783a67433be84dfa14d2b52715586a2a318cad51db15d3de09370a4ff580efa05935c91e5f7658794467166c5af38f65b8027d310a7b612
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
0b7883cd326d76228c722b69541cb9a3
SHA1bf513758205dda0b62084d9b9718042aad5c836c
SHA256741ffe5460a43194d3a8cf76729abd8f6a5fb7d991e219037215920195a38c5e
SHA5122bc401cc1ce71ee9f783a67433be84dfa14d2b52715586a2a318cad51db15d3de09370a4ff580efa05935c91e5f7658794467166c5af38f65b8027d310a7b612
-
memory/1132-130-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1132-126-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1132-127-0x000000000042EEEF-mapping.dmp
-
memory/2208-117-0x0000000005930000-0x0000000005931000-memory.dmpFilesize
4KB
-
memory/2208-121-0x0000000005AD0000-0x0000000005AD9000-memory.dmpFilesize
36KB
-
memory/2208-122-0x0000000007D00000-0x0000000007DB6000-memory.dmpFilesize
728KB
-
memory/2208-123-0x000000000A3A0000-0x000000000A425000-memory.dmpFilesize
532KB
-
memory/2208-116-0x0000000005D50000-0x0000000005D51000-memory.dmpFilesize
4KB
-
memory/2208-119-0x0000000005850000-0x0000000005D4E000-memory.dmpFilesize
5.0MB
-
memory/2208-120-0x00000000058D0000-0x00000000058D1000-memory.dmpFilesize
4KB
-
memory/2208-118-0x00000000059D0000-0x00000000059D1000-memory.dmpFilesize
4KB
-
memory/2208-114-0x0000000000FA0000-0x0000000000FA1000-memory.dmpFilesize
4KB
-
memory/3496-131-0x0000000000000000-mapping.dmp
-
memory/3588-128-0x0000000000000000-mapping.dmp
-
memory/3808-132-0x0000000000000000-mapping.dmp
-
memory/3808-142-0x0000000004D50000-0x0000000004DE2000-memory.dmpFilesize
584KB
-
memory/4076-124-0x0000000000000000-mapping.dmp