Analysis
- max time kernel
66s - max time network
110s - platform
windows10_x64 - resource
win10v20210410 - submitted
26/04/2021, 05:47
General
- Target ORDER SHEET & SAMPLES_pdf.exe
- Size 1.0MB
- Sample210426-59q37qmb4e
- SHA256 3c0df5607ab1e7bf906ce2be36ee0bb970c26baf19710f0c195ca9356a2d918f
Malware Config
Extracted
-
remcos
-
remcoswealth.ddns.net:59239
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Executes dropped EXE 1 IoCs
- Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORDER SHEET & SAMPLES_pdf.exe"C:\Users\Admin\AppData\Local\Temp\ORDER SHEET & SAMPLES_pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ednalvrhubmmwdlojjrej.vbs"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3464-127-0x0000000000400000-0x0000000000478000-memory.dmp
memory/3464-130-0x0000000000400000-0x0000000000478000-memory.dmp
memory/3992-120-0x0000000004DE0000-0x00000000052DE000-memory.dmp
memory/3992-124-0x0000000004DE0000-0x00000000052DE000-memory.dmp
memory/3992-125-0x0000000006C00000-0x0000000006C0B000-memory.dmp
memory/3992-126-0x00000000091E0000-0x00000000091E1000-memory.dmp
memory/3992-123-0x0000000006330000-0x0000000006331000-memory.dmp
memory/3992-122-0x0000000006370000-0x0000000006371000-memory.dmp
memory/3992-121-0x00000000062D0000-0x00000000062F1000-memory.dmp
memory/3992-114-0x0000000000540000-0x0000000000541000-memory.dmp
memory/3992-118-0x0000000004FC0000-0x0000000004FC1000-memory.dmp
memory/3992-117-0x0000000004E80000-0x0000000004E81000-memory.dmp
memory/3992-116-0x00000000052E0000-0x00000000052E1000-memory.dmp