Overview

overview

10

Static

static

RESOLDELPR...03.exe

windows7_x64

10

RESOLDELPR...03.exe

windows10_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    22-04-2021 00:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe

  • Size

    801KB

  • MD5

    cdbe179ccd3e2676a8149430dd4d2027

  • SHA1

    dd79a36de18f788899276805f2efcaf2a6295b7a

  • SHA256

    7a1ca0872400fc383eea460f0eb93927610a9ba28cd74dfa8f37d11a2b2b6d71

  • SHA512

    703e87d7b5986a3c9a486a3fc5ced5ce49f89ba1469145562f86c037e733f84f9d324d362b5f3936f770c71d090a962613cc9e015e811ab14a0d75f521adf1f6

Score
10/10
remcosrat

Malware Config

Extracted

Family

remcos

C2

electricaribe.duckdns.org:1717

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe
    "C:\Users\Admin\AppData\Local\Temp\RESOLDELPROCPORFRAUFISC468830002 RESOLDELPROCPORFRAUFISC468830003.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1088
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zHvfETCQIPJiU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBB25.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:744
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "{path}"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:332

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpBB25.tmp
    MD5

    fded8207797847b3f1425d9f388d2f61

    SHA1

    39a2219aa25f9790d6375e38ab26d4e0318ff792

    SHA256

    06c42a60eb92d680260087f05e2717bf4bbaf4f45e791515179cc5fa059c3bae

    SHA512

    4a573aa77f455b444578e67ca31d898adc6521040e77a34d38aedce154f4258fbbe1ef660c950f654252aa12380ae86288dfde9e92aab50fa04e0f42d79748f0

    Download Submit

  • memory/332-67-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

    Download

  • memory/332-68-0x0000000000413E54-mapping.dmp

    Download

  • memory/332-69-0x00000000753B1000-0x00000000753B3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/332-70-0x0000000000400000-0x0000000000421000-memory.dmp

    Filesize

    132KB

    Download

  • memory/744-65-0x0000000000000000-mapping.dmp

    Download

  • memory/1088-59-0x0000000001310000-0x0000000001311000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1088-61-0x00000000011F0000-0x00000000011F1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1088-62-0x00000000003D0000-0x00000000003D5000-memory.dmp

    Filesize

    20KB

    Download

  • memory/1088-63-0x0000000005DC0000-0x0000000005E69000-memory.dmp

    Filesize

    676KB

    Download

  • memory/1088-64-0x00000000008A0000-0x0000000000900000-memory.dmp

    Filesize

    384KB

    Download