Analysis
-
max time kernel
115s -
max time network
14s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
24-04-2021 11:09
Static task
static1
Behavioral task
behavioral1
Sample
m1WOP5oC15Xaepo.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
m1WOP5oC15Xaepo.exe
Resource
win10v20210410
General
-
Target
m1WOP5oC15Xaepo.exe
-
Size
784KB
-
MD5
3441e57f22d51b7bc539595450ee1dd6
-
SHA1
cd77031b1df0ec4e2d10fe4077674783270d6c4e
-
SHA256
30552657a06df54de322d5d689ca77d2cacbf8e85136ca915843c9a99e4f26c0
-
SHA512
b05c84cb74ab5cdd17e8778712febb9c193ff29d38b461463f6000723f90040ad531a6274a660c00798c3cf6c31f1b71b4f9f8166be3620c6f569e19f78c066c
Malware Config
Extracted
remcos
217.138.212.58:52667
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
remcos.exepid process 1844 remcos.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 592 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
m1WOP5oC15Xaepo.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\ m1WOP5oC15Xaepo.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" m1WOP5oC15Xaepo.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
m1WOP5oC15Xaepo.exedescription pid process target process PID 1100 set thread context of 1744 1100 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
m1WOP5oC15Xaepo.exepowershell.exepid process 1100 m1WOP5oC15Xaepo.exe 1100 m1WOP5oC15Xaepo.exe 1100 m1WOP5oC15Xaepo.exe 568 powershell.exe 568 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
m1WOP5oC15Xaepo.exepowershell.exedescription pid process Token: SeDebugPrivilege 1100 m1WOP5oC15Xaepo.exe Token: SeDebugPrivilege 568 powershell.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
m1WOP5oC15Xaepo.exem1WOP5oC15Xaepo.exeWScript.execmd.exedescription pid process target process PID 1100 wrote to memory of 568 1100 m1WOP5oC15Xaepo.exe powershell.exe PID 1100 wrote to memory of 568 1100 m1WOP5oC15Xaepo.exe powershell.exe PID 1100 wrote to memory of 568 1100 m1WOP5oC15Xaepo.exe powershell.exe PID 1100 wrote to memory of 568 1100 m1WOP5oC15Xaepo.exe powershell.exe PID 1100 wrote to memory of 1744 1100 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe PID 1100 wrote to memory of 1744 1100 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe PID 1100 wrote to memory of 1744 1100 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe PID 1100 wrote to memory of 1744 1100 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe PID 1100 wrote to memory of 1744 1100 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe PID 1100 wrote to memory of 1744 1100 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe PID 1100 wrote to memory of 1744 1100 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe PID 1100 wrote to memory of 1744 1100 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe PID 1100 wrote to memory of 1744 1100 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe PID 1100 wrote to memory of 1744 1100 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe PID 1100 wrote to memory of 1744 1100 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe PID 1100 wrote to memory of 1744 1100 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe PID 1100 wrote to memory of 1744 1100 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe PID 1744 wrote to memory of 1232 1744 m1WOP5oC15Xaepo.exe WScript.exe PID 1744 wrote to memory of 1232 1744 m1WOP5oC15Xaepo.exe WScript.exe PID 1744 wrote to memory of 1232 1744 m1WOP5oC15Xaepo.exe WScript.exe PID 1744 wrote to memory of 1232 1744 m1WOP5oC15Xaepo.exe WScript.exe PID 1232 wrote to memory of 592 1232 WScript.exe cmd.exe PID 1232 wrote to memory of 592 1232 WScript.exe cmd.exe PID 1232 wrote to memory of 592 1232 WScript.exe cmd.exe PID 1232 wrote to memory of 592 1232 WScript.exe cmd.exe PID 592 wrote to memory of 1844 592 cmd.exe remcos.exe PID 592 wrote to memory of 1844 592 cmd.exe remcos.exe PID 592 wrote to memory of 1844 592 cmd.exe remcos.exe PID 592 wrote to memory of 1844 592 cmd.exe remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\m1WOP5oC15Xaepo.exe"C:\Users\Admin\AppData\Local\Temp\m1WOP5oC15Xaepo.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\m1WOP5oC15Xaepo.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\m1WOP5oC15Xaepo.exe"C:\Users\Admin\AppData\Local\Temp\m1WOP5oC15Xaepo.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe5⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
b92d64fe5b1d1f59df4b738262aea8df
SHA1c8fb1981759c2d9bb2ec91b705985fba5fc7af63
SHA256fa20e9aab03dc8e9f1910aaf0cf42662379fa16ae3a22642084fb97fa3d4f83a
SHA5122566248b93c0cfb0414f033b8dd18bbd4f88180093eac2861107289bcb4ee160f9593706ff1f7d1f2e4ecea430d67a5a2897551a4f9ebd82b707243e300520e2
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
3441e57f22d51b7bc539595450ee1dd6
SHA1cd77031b1df0ec4e2d10fe4077674783270d6c4e
SHA25630552657a06df54de322d5d689ca77d2cacbf8e85136ca915843c9a99e4f26c0
SHA512b05c84cb74ab5cdd17e8778712febb9c193ff29d38b461463f6000723f90040ad531a6274a660c00798c3cf6c31f1b71b4f9f8166be3620c6f569e19f78c066c
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
3441e57f22d51b7bc539595450ee1dd6
SHA1cd77031b1df0ec4e2d10fe4077674783270d6c4e
SHA25630552657a06df54de322d5d689ca77d2cacbf8e85136ca915843c9a99e4f26c0
SHA512b05c84cb74ab5cdd17e8778712febb9c193ff29d38b461463f6000723f90040ad531a6274a660c00798c3cf6c31f1b71b4f9f8166be3620c6f569e19f78c066c
-
\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
3441e57f22d51b7bc539595450ee1dd6
SHA1cd77031b1df0ec4e2d10fe4077674783270d6c4e
SHA25630552657a06df54de322d5d689ca77d2cacbf8e85136ca915843c9a99e4f26c0
SHA512b05c84cb74ab5cdd17e8778712febb9c193ff29d38b461463f6000723f90040ad531a6274a660c00798c3cf6c31f1b71b4f9f8166be3620c6f569e19f78c066c
-
memory/568-79-0x00000000024D0000-0x00000000024D1000-memory.dmpFilesize
4KB
-
memory/568-97-0x00000000060C0000-0x00000000060C1000-memory.dmpFilesize
4KB
-
memory/568-122-0x0000000006310000-0x0000000006311000-memory.dmpFilesize
4KB
-
memory/568-121-0x0000000006300000-0x0000000006301000-memory.dmpFilesize
4KB
-
memory/568-69-0x0000000075DA1000-0x0000000075DA3000-memory.dmpFilesize
8KB
-
memory/568-107-0x0000000006220000-0x0000000006221000-memory.dmpFilesize
4KB
-
memory/568-106-0x0000000006280000-0x0000000006281000-memory.dmpFilesize
4KB
-
memory/568-99-0x0000000006180000-0x0000000006181000-memory.dmpFilesize
4KB
-
memory/568-75-0x0000000000E80000-0x0000000000E81000-memory.dmpFilesize
4KB
-
memory/568-76-0x0000000004870000-0x0000000004871000-memory.dmpFilesize
4KB
-
memory/568-77-0x0000000004830000-0x0000000004831000-memory.dmpFilesize
4KB
-
memory/568-78-0x0000000004832000-0x0000000004833000-memory.dmpFilesize
4KB
-
memory/568-98-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/568-66-0x0000000000000000-mapping.dmp
-
memory/568-92-0x0000000006040000-0x0000000006041000-memory.dmpFilesize
4KB
-
memory/568-89-0x0000000005240000-0x0000000005241000-memory.dmpFilesize
4KB
-
memory/592-80-0x0000000000000000-mapping.dmp
-
memory/1100-62-0x0000000000430000-0x000000000043D000-memory.dmpFilesize
52KB
-
memory/1100-63-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/1100-65-0x00000000076D0000-0x0000000007757000-memory.dmpFilesize
540KB
-
memory/1100-60-0x0000000000910000-0x0000000000911000-memory.dmpFilesize
4KB
-
memory/1100-64-0x0000000005110000-0x00000000051CD000-memory.dmpFilesize
756KB
-
memory/1232-72-0x0000000000000000-mapping.dmp
-
memory/1744-71-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1744-68-0x000000000042EEEF-mapping.dmp
-
memory/1744-67-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1844-83-0x0000000000000000-mapping.dmp
-
memory/1844-88-0x0000000000D30000-0x0000000000D31000-memory.dmpFilesize
4KB
-
memory/1844-85-0x00000000012E0000-0x00000000012E1000-memory.dmpFilesize
4KB