Analysis
-
max time kernel
110s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
24-04-2021 11:09
Static task
static1
Behavioral task
behavioral1
Sample
m1WOP5oC15Xaepo.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
m1WOP5oC15Xaepo.exe
Resource
win10v20210410
General
-
Target
m1WOP5oC15Xaepo.exe
-
Size
784KB
-
MD5
3441e57f22d51b7bc539595450ee1dd6
-
SHA1
cd77031b1df0ec4e2d10fe4077674783270d6c4e
-
SHA256
30552657a06df54de322d5d689ca77d2cacbf8e85136ca915843c9a99e4f26c0
-
SHA512
b05c84cb74ab5cdd17e8778712febb9c193ff29d38b461463f6000723f90040ad531a6274a660c00798c3cf6c31f1b71b4f9f8166be3620c6f569e19f78c066c
Malware Config
Extracted
remcos
217.138.212.58:52667
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
remcos.exepid process 4072 remcos.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
m1WOP5oC15Xaepo.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\ m1WOP5oC15Xaepo.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" m1WOP5oC15Xaepo.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
m1WOP5oC15Xaepo.exedescription pid process target process PID 3896 set thread context of 1120 3896 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
m1WOP5oC15Xaepo.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings m1WOP5oC15Xaepo.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
m1WOP5oC15Xaepo.exepowershell.exepid process 3896 m1WOP5oC15Xaepo.exe 3896 m1WOP5oC15Xaepo.exe 3896 m1WOP5oC15Xaepo.exe 3896 m1WOP5oC15Xaepo.exe 3440 powershell.exe 3440 powershell.exe 3440 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
m1WOP5oC15Xaepo.exepowershell.exedescription pid process Token: SeDebugPrivilege 3896 m1WOP5oC15Xaepo.exe Token: SeDebugPrivilege 3440 powershell.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
m1WOP5oC15Xaepo.exem1WOP5oC15Xaepo.exeWScript.execmd.exedescription pid process target process PID 3896 wrote to memory of 3440 3896 m1WOP5oC15Xaepo.exe powershell.exe PID 3896 wrote to memory of 3440 3896 m1WOP5oC15Xaepo.exe powershell.exe PID 3896 wrote to memory of 3440 3896 m1WOP5oC15Xaepo.exe powershell.exe PID 3896 wrote to memory of 1120 3896 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe PID 3896 wrote to memory of 1120 3896 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe PID 3896 wrote to memory of 1120 3896 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe PID 3896 wrote to memory of 1120 3896 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe PID 3896 wrote to memory of 1120 3896 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe PID 3896 wrote to memory of 1120 3896 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe PID 3896 wrote to memory of 1120 3896 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe PID 3896 wrote to memory of 1120 3896 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe PID 3896 wrote to memory of 1120 3896 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe PID 3896 wrote to memory of 1120 3896 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe PID 3896 wrote to memory of 1120 3896 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe PID 3896 wrote to memory of 1120 3896 m1WOP5oC15Xaepo.exe m1WOP5oC15Xaepo.exe PID 1120 wrote to memory of 1612 1120 m1WOP5oC15Xaepo.exe WScript.exe PID 1120 wrote to memory of 1612 1120 m1WOP5oC15Xaepo.exe WScript.exe PID 1120 wrote to memory of 1612 1120 m1WOP5oC15Xaepo.exe WScript.exe PID 1612 wrote to memory of 2504 1612 WScript.exe cmd.exe PID 1612 wrote to memory of 2504 1612 WScript.exe cmd.exe PID 1612 wrote to memory of 2504 1612 WScript.exe cmd.exe PID 2504 wrote to memory of 4072 2504 cmd.exe remcos.exe PID 2504 wrote to memory of 4072 2504 cmd.exe remcos.exe PID 2504 wrote to memory of 4072 2504 cmd.exe remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\m1WOP5oC15Xaepo.exe"C:\Users\Admin\AppData\Local\Temp\m1WOP5oC15Xaepo.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\m1WOP5oC15Xaepo.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\m1WOP5oC15Xaepo.exe"C:\Users\Admin\AppData\Local\Temp\m1WOP5oC15Xaepo.exe"2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe5⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
b92d64fe5b1d1f59df4b738262aea8df
SHA1c8fb1981759c2d9bb2ec91b705985fba5fc7af63
SHA256fa20e9aab03dc8e9f1910aaf0cf42662379fa16ae3a22642084fb97fa3d4f83a
SHA5122566248b93c0cfb0414f033b8dd18bbd4f88180093eac2861107289bcb4ee160f9593706ff1f7d1f2e4ecea430d67a5a2897551a4f9ebd82b707243e300520e2
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
3441e57f22d51b7bc539595450ee1dd6
SHA1cd77031b1df0ec4e2d10fe4077674783270d6c4e
SHA25630552657a06df54de322d5d689ca77d2cacbf8e85136ca915843c9a99e4f26c0
SHA512b05c84cb74ab5cdd17e8778712febb9c193ff29d38b461463f6000723f90040ad531a6274a660c00798c3cf6c31f1b71b4f9f8166be3620c6f569e19f78c066c
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
3441e57f22d51b7bc539595450ee1dd6
SHA1cd77031b1df0ec4e2d10fe4077674783270d6c4e
SHA25630552657a06df54de322d5d689ca77d2cacbf8e85136ca915843c9a99e4f26c0
SHA512b05c84cb74ab5cdd17e8778712febb9c193ff29d38b461463f6000723f90040ad531a6274a660c00798c3cf6c31f1b71b4f9f8166be3620c6f569e19f78c066c
-
memory/1120-125-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1120-137-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/1120-126-0x000000000042EEEF-mapping.dmp
-
memory/1612-130-0x0000000000000000-mapping.dmp
-
memory/2504-143-0x0000000000000000-mapping.dmp
-
memory/3440-135-0x00000000081F0000-0x00000000081F1000-memory.dmpFilesize
4KB
-
memory/3440-140-0x0000000008320000-0x0000000008321000-memory.dmpFilesize
4KB
-
memory/3440-192-0x00000000036A3000-0x00000000036A4000-memory.dmpFilesize
4KB
-
memory/3440-191-0x000000007E730000-0x000000007E731000-memory.dmpFilesize
4KB
-
memory/3440-129-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB
-
memory/3440-175-0x0000000009DC0000-0x0000000009DC1000-memory.dmpFilesize
4KB
-
memory/3440-131-0x0000000007AE0000-0x0000000007AE1000-memory.dmpFilesize
4KB
-
memory/3440-174-0x0000000009C20000-0x0000000009C21000-memory.dmpFilesize
4KB
-
memory/3440-133-0x0000000007A50000-0x0000000007A51000-memory.dmpFilesize
4KB
-
memory/3440-134-0x0000000008180000-0x0000000008181000-memory.dmpFilesize
4KB
-
memory/3440-169-0x0000000009890000-0x0000000009891000-memory.dmpFilesize
4KB
-
memory/3440-136-0x0000000008440000-0x0000000008441000-memory.dmpFilesize
4KB
-
memory/3440-162-0x0000000009AF0000-0x0000000009B23000-memory.dmpFilesize
204KB
-
memory/3440-138-0x00000000036A0000-0x00000000036A1000-memory.dmpFilesize
4KB
-
memory/3440-139-0x00000000036A2000-0x00000000036A3000-memory.dmpFilesize
4KB
-
memory/3440-124-0x0000000000000000-mapping.dmp
-
memory/3440-141-0x0000000008C70000-0x0000000008C71000-memory.dmpFilesize
4KB
-
memory/3440-142-0x0000000008B20000-0x0000000008B21000-memory.dmpFilesize
4KB
-
memory/3896-118-0x00000000052A0000-0x00000000052A1000-memory.dmpFilesize
4KB
-
memory/3896-117-0x0000000005200000-0x0000000005201000-memory.dmpFilesize
4KB
-
memory/3896-116-0x0000000005700000-0x0000000005701000-memory.dmpFilesize
4KB
-
memory/3896-119-0x0000000005360000-0x0000000005361000-memory.dmpFilesize
4KB
-
memory/3896-114-0x0000000000860000-0x0000000000861000-memory.dmpFilesize
4KB
-
memory/3896-120-0x0000000005660000-0x000000000566D000-memory.dmpFilesize
52KB
-
memory/3896-121-0x0000000005200000-0x00000000056FE000-memory.dmpFilesize
5.0MB
-
memory/3896-122-0x0000000005F00000-0x0000000005FBD000-memory.dmpFilesize
756KB
-
memory/3896-123-0x0000000008470000-0x00000000084F7000-memory.dmpFilesize
540KB
-
memory/4072-144-0x0000000000000000-mapping.dmp
-
memory/4072-153-0x0000000004BD0000-0x00000000050CE000-memory.dmpFilesize
5.0MB