Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
27-04-2021 20:13
General
-
Target
DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe
-
Size
1003KB
-
MD5
73fe7532d75c146f45f2d09ad844d573
-
SHA1
b982e7b808b140625cc1af5b5d093f03b0b44ce3
-
SHA256
08f234ec292a6a493c9c3e21cf1a08a91899bc929de74ed1a833a42da0891bb9
-
SHA512
b930b35292abba797900234f4e5a0a9b1f340e072a9af646fc2dce876fd5757b2bba6fca218e2fe5c7487757880ccfe71a1d624067903ebe833334811cb0dd34
Malware Config
Extracted
remcos
yuyitosjs.duckdns.org:1717
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe"C:\Users\Admin\AppData\Local\Temp\DOCADJDELPROCEFRAUFISC346340003 DOCADJDELPROCEFRAUFISC346340005.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fDecVP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB116.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpB116.tmpMD5
5ee62c65933558e30ddaddee0f131e9c
SHA1ea59e628e6945ed3e39d3e1c2bfde13041f9deb7
SHA256ae45da0211c75fc5bd0f2ee8d1291f6ccbcf97fbf6f72a45854954529d288bf8
SHA51247f79447e3841a29774c36e1de71c4149de30241663fa9f4f4ab8a8b169f60844f323b20dd6f2737a0ee93e4f45ce438f33d362bb1e13897d94432be78ebe539
-
memory/1292-128-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1292-127-0x0000000000413E54-mapping.dmp
-
memory/1292-126-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/2588-124-0x0000000000000000-mapping.dmp
-
memory/3944-118-0x0000000005460000-0x0000000005461000-memory.dmpFilesize
4KB
-
memory/3944-121-0x0000000005620000-0x000000000562E000-memory.dmpFilesize
56KB
-
memory/3944-122-0x0000000009750000-0x000000000981A000-memory.dmpFilesize
808KB
-
memory/3944-123-0x000000000BEA0000-0x000000000BF22000-memory.dmpFilesize
520KB
-
memory/3944-120-0x0000000009420000-0x0000000009421000-memory.dmpFilesize
4KB
-
memory/3944-119-0x0000000005460000-0x000000000595E000-memory.dmpFilesize
5.0MB
-
memory/3944-114-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/3944-117-0x00000000053B0000-0x00000000053B1000-memory.dmpFilesize
4KB
-
memory/3944-116-0x0000000005960000-0x0000000005961000-memory.dmpFilesize
4KB