Analysis
-
max time kernel
79s -
max time network
18s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
24-04-2021 07:39
Static task
static1
Behavioral task
behavioral1
Sample
53d1fe3209497d194e38201deb835924.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
53d1fe3209497d194e38201deb835924.exe
Resource
win10v20210410
General
-
Target
53d1fe3209497d194e38201deb835924.exe
-
Size
2.1MB
-
MD5
53d1fe3209497d194e38201deb835924
-
SHA1
43f4315a82d7cd359aec38eac9fa37602d8baac6
-
SHA256
af0249150bee4fec74c124f89019cd260c9aacd7b7a7715192b5097f1948eb82
-
SHA512
a706c677811bc7b5b0368c840c00499b45c3f30e3b52350373e4475bfe90c8bfceee57100d28dece8ec3006382a0be5a8ae780e1c1d71acf43208301200128a2
Malware Config
Extracted
remcos
fieldsdegreenf.duckdns.org:6553
aaeeerbbbeee.duckdns.org:6553
Signatures
-
Executes dropped EXE 6 IoCs
Processes:
remcos.exeremcos.exeremcos.exeremcos.exeremcos.exeremcos.exepid process 112 remcos.exe 1932 remcos.exe 900 remcos.exe 1752 remcos.exe 1344 remcos.exe 1544 remcos.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 544 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
53d1fe3209497d194e38201deb835924.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 53d1fe3209497d194e38201deb835924.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" 53d1fe3209497d194e38201deb835924.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
53d1fe3209497d194e38201deb835924.exedescription pid process target process PID 1632 set thread context of 592 1632 53d1fe3209497d194e38201deb835924.exe 53d1fe3209497d194e38201deb835924.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
remcos.exepid process 112 remcos.exe 112 remcos.exe 112 remcos.exe 112 remcos.exe 112 remcos.exe 112 remcos.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
remcos.exedescription pid process Token: SeDebugPrivilege 112 remcos.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
53d1fe3209497d194e38201deb835924.exe53d1fe3209497d194e38201deb835924.exeWScript.execmd.exeremcos.exedescription pid process target process PID 1632 wrote to memory of 592 1632 53d1fe3209497d194e38201deb835924.exe 53d1fe3209497d194e38201deb835924.exe PID 1632 wrote to memory of 592 1632 53d1fe3209497d194e38201deb835924.exe 53d1fe3209497d194e38201deb835924.exe PID 1632 wrote to memory of 592 1632 53d1fe3209497d194e38201deb835924.exe 53d1fe3209497d194e38201deb835924.exe PID 1632 wrote to memory of 592 1632 53d1fe3209497d194e38201deb835924.exe 53d1fe3209497d194e38201deb835924.exe PID 1632 wrote to memory of 592 1632 53d1fe3209497d194e38201deb835924.exe 53d1fe3209497d194e38201deb835924.exe PID 1632 wrote to memory of 592 1632 53d1fe3209497d194e38201deb835924.exe 53d1fe3209497d194e38201deb835924.exe PID 1632 wrote to memory of 592 1632 53d1fe3209497d194e38201deb835924.exe 53d1fe3209497d194e38201deb835924.exe PID 1632 wrote to memory of 592 1632 53d1fe3209497d194e38201deb835924.exe 53d1fe3209497d194e38201deb835924.exe PID 1632 wrote to memory of 592 1632 53d1fe3209497d194e38201deb835924.exe 53d1fe3209497d194e38201deb835924.exe PID 1632 wrote to memory of 592 1632 53d1fe3209497d194e38201deb835924.exe 53d1fe3209497d194e38201deb835924.exe PID 1632 wrote to memory of 592 1632 53d1fe3209497d194e38201deb835924.exe 53d1fe3209497d194e38201deb835924.exe PID 1632 wrote to memory of 592 1632 53d1fe3209497d194e38201deb835924.exe 53d1fe3209497d194e38201deb835924.exe PID 1632 wrote to memory of 592 1632 53d1fe3209497d194e38201deb835924.exe 53d1fe3209497d194e38201deb835924.exe PID 592 wrote to memory of 1732 592 53d1fe3209497d194e38201deb835924.exe WScript.exe PID 592 wrote to memory of 1732 592 53d1fe3209497d194e38201deb835924.exe WScript.exe PID 592 wrote to memory of 1732 592 53d1fe3209497d194e38201deb835924.exe WScript.exe PID 592 wrote to memory of 1732 592 53d1fe3209497d194e38201deb835924.exe WScript.exe PID 1732 wrote to memory of 544 1732 WScript.exe cmd.exe PID 1732 wrote to memory of 544 1732 WScript.exe cmd.exe PID 1732 wrote to memory of 544 1732 WScript.exe cmd.exe PID 1732 wrote to memory of 544 1732 WScript.exe cmd.exe PID 544 wrote to memory of 112 544 cmd.exe remcos.exe PID 544 wrote to memory of 112 544 cmd.exe remcos.exe PID 544 wrote to memory of 112 544 cmd.exe remcos.exe PID 544 wrote to memory of 112 544 cmd.exe remcos.exe PID 112 wrote to memory of 1932 112 remcos.exe remcos.exe PID 112 wrote to memory of 1932 112 remcos.exe remcos.exe PID 112 wrote to memory of 1932 112 remcos.exe remcos.exe PID 112 wrote to memory of 1932 112 remcos.exe remcos.exe PID 112 wrote to memory of 900 112 remcos.exe remcos.exe PID 112 wrote to memory of 900 112 remcos.exe remcos.exe PID 112 wrote to memory of 900 112 remcos.exe remcos.exe PID 112 wrote to memory of 900 112 remcos.exe remcos.exe PID 112 wrote to memory of 1752 112 remcos.exe remcos.exe PID 112 wrote to memory of 1752 112 remcos.exe remcos.exe PID 112 wrote to memory of 1752 112 remcos.exe remcos.exe PID 112 wrote to memory of 1752 112 remcos.exe remcos.exe PID 112 wrote to memory of 1344 112 remcos.exe remcos.exe PID 112 wrote to memory of 1344 112 remcos.exe remcos.exe PID 112 wrote to memory of 1344 112 remcos.exe remcos.exe PID 112 wrote to memory of 1344 112 remcos.exe remcos.exe PID 112 wrote to memory of 1544 112 remcos.exe remcos.exe PID 112 wrote to memory of 1544 112 remcos.exe remcos.exe PID 112 wrote to memory of 1544 112 remcos.exe remcos.exe PID 112 wrote to memory of 1544 112 remcos.exe remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53d1fe3209497d194e38201deb835924.exe"C:\Users\Admin\AppData\Local\Temp\53d1fe3209497d194e38201deb835924.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\53d1fe3209497d194e38201deb835924.exe"{path}"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"{path}"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"{path}"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"{path}"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"{path}"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"{path}"6⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
b92d64fe5b1d1f59df4b738262aea8df
SHA1c8fb1981759c2d9bb2ec91b705985fba5fc7af63
SHA256fa20e9aab03dc8e9f1910aaf0cf42662379fa16ae3a22642084fb97fa3d4f83a
SHA5122566248b93c0cfb0414f033b8dd18bbd4f88180093eac2861107289bcb4ee160f9593706ff1f7d1f2e4ecea430d67a5a2897551a4f9ebd82b707243e300520e2
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
53d1fe3209497d194e38201deb835924
SHA143f4315a82d7cd359aec38eac9fa37602d8baac6
SHA256af0249150bee4fec74c124f89019cd260c9aacd7b7a7715192b5097f1948eb82
SHA512a706c677811bc7b5b0368c840c00499b45c3f30e3b52350373e4475bfe90c8bfceee57100d28dece8ec3006382a0be5a8ae780e1c1d71acf43208301200128a2
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
53d1fe3209497d194e38201deb835924
SHA143f4315a82d7cd359aec38eac9fa37602d8baac6
SHA256af0249150bee4fec74c124f89019cd260c9aacd7b7a7715192b5097f1948eb82
SHA512a706c677811bc7b5b0368c840c00499b45c3f30e3b52350373e4475bfe90c8bfceee57100d28dece8ec3006382a0be5a8ae780e1c1d71acf43208301200128a2
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
53d1fe3209497d194e38201deb835924
SHA143f4315a82d7cd359aec38eac9fa37602d8baac6
SHA256af0249150bee4fec74c124f89019cd260c9aacd7b7a7715192b5097f1948eb82
SHA512a706c677811bc7b5b0368c840c00499b45c3f30e3b52350373e4475bfe90c8bfceee57100d28dece8ec3006382a0be5a8ae780e1c1d71acf43208301200128a2
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
53d1fe3209497d194e38201deb835924
SHA143f4315a82d7cd359aec38eac9fa37602d8baac6
SHA256af0249150bee4fec74c124f89019cd260c9aacd7b7a7715192b5097f1948eb82
SHA512a706c677811bc7b5b0368c840c00499b45c3f30e3b52350373e4475bfe90c8bfceee57100d28dece8ec3006382a0be5a8ae780e1c1d71acf43208301200128a2
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
53d1fe3209497d194e38201deb835924
SHA143f4315a82d7cd359aec38eac9fa37602d8baac6
SHA256af0249150bee4fec74c124f89019cd260c9aacd7b7a7715192b5097f1948eb82
SHA512a706c677811bc7b5b0368c840c00499b45c3f30e3b52350373e4475bfe90c8bfceee57100d28dece8ec3006382a0be5a8ae780e1c1d71acf43208301200128a2
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
53d1fe3209497d194e38201deb835924
SHA143f4315a82d7cd359aec38eac9fa37602d8baac6
SHA256af0249150bee4fec74c124f89019cd260c9aacd7b7a7715192b5097f1948eb82
SHA512a706c677811bc7b5b0368c840c00499b45c3f30e3b52350373e4475bfe90c8bfceee57100d28dece8ec3006382a0be5a8ae780e1c1d71acf43208301200128a2
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
53d1fe3209497d194e38201deb835924
SHA143f4315a82d7cd359aec38eac9fa37602d8baac6
SHA256af0249150bee4fec74c124f89019cd260c9aacd7b7a7715192b5097f1948eb82
SHA512a706c677811bc7b5b0368c840c00499b45c3f30e3b52350373e4475bfe90c8bfceee57100d28dece8ec3006382a0be5a8ae780e1c1d71acf43208301200128a2
-
\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
53d1fe3209497d194e38201deb835924
SHA143f4315a82d7cd359aec38eac9fa37602d8baac6
SHA256af0249150bee4fec74c124f89019cd260c9aacd7b7a7715192b5097f1948eb82
SHA512a706c677811bc7b5b0368c840c00499b45c3f30e3b52350373e4475bfe90c8bfceee57100d28dece8ec3006382a0be5a8ae780e1c1d71acf43208301200128a2
-
memory/112-80-0x00000000049C0000-0x00000000049C1000-memory.dmpFilesize
4KB
-
memory/112-78-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/112-76-0x0000000000000000-mapping.dmp
-
memory/544-73-0x0000000000000000-mapping.dmp
-
memory/592-66-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/592-72-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/592-68-0x0000000075551000-0x0000000075553000-memory.dmpFilesize
8KB
-
memory/592-67-0x000000000042EEEF-mapping.dmp
-
memory/1632-60-0x0000000000EA0000-0x0000000000EA1000-memory.dmpFilesize
4KB
-
memory/1632-65-0x0000000006310000-0x0000000006384000-memory.dmpFilesize
464KB
-
memory/1632-64-0x00000000094D0000-0x000000000957B000-memory.dmpFilesize
684KB
-
memory/1632-63-0x00000000009A0000-0x00000000009AE000-memory.dmpFilesize
56KB
-
memory/1632-62-0x0000000004E10000-0x0000000004E11000-memory.dmpFilesize
4KB
-
memory/1732-69-0x0000000000000000-mapping.dmp