Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    29-04-2021 04:04

General

  • Target

    EXTRACTOSERFINANZA989543704031499704092798964.exe

  • Size

    1.8MB

  • MD5

    2e91e5e3d39ce4155edad4f2a3acf916

  • SHA1

    58adf5d60d9da823a4fd62282c0c46134e20e47b

  • SHA256

    eb9e13fd092522e4dde08e96961117f9926e3ef70ca3b225f8c388e476541a21

  • SHA512

    5d27cd110e8d62d6d3e48f20ecd09c715fe5a98e7c9ce8042559f1d6e8a6ce0d666d262a536b2376b8e2d99beb7ce50dd53e238e2f37df118630945b5cbb4b87

Score
10/10

Malware Config

Extracted

Family

remcos

C2

databasepropersonombrecomercialideasearchwords.services:3521

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Delays execution with timeout.exe 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\EXTRACTOSERFINANZA989543704031499704092798964.exe
    "C:\Users\Admin\AppData\Local\Temp\EXTRACTOSERFINANZA989543704031499704092798964.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:452
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1100
      • C:\Windows\SysWOW64\timeout.exe
        timeout 1
        3⤵
        • Delays execution with timeout.exe
        PID:1528
    • C:\Users\Admin\AppData\Local\Temp\EXTRACTOSERFINANZA989543704031499704092798964.exe
      "C:\Users\Admin\AppData\Local\Temp\EXTRACTOSERFINANZA989543704031499704092798964.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:428
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1404
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1016
          • C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
            C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1284
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c timeout 1
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1784
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                7⤵
                • Delays execution with timeout.exe
                PID:652
            • C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
              "C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of SetWindowsHookEx
              PID:1632

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\install.vbs
    MD5

    a39af763b1c09ead3c98a6a615f377fe

    SHA1

    9bd3d39c89e47fe7072270ecc80b810103235c03

    SHA256

    a3930d7535eb768523ee52bbe69f13f857a0ae0f982d7bfc354d802f21010f8f

    SHA512

    3ed8e33ac95fd2536286b4afb2ed2a082bb5f98843478262b32263a14a5dbe0425de7b8d9662a5e482b207ebf8484ace8009ecd1881a6f6f8b0ccf3b0fdfe5da

  • C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
    MD5

    2e91e5e3d39ce4155edad4f2a3acf916

    SHA1

    58adf5d60d9da823a4fd62282c0c46134e20e47b

    SHA256

    eb9e13fd092522e4dde08e96961117f9926e3ef70ca3b225f8c388e476541a21

    SHA512

    5d27cd110e8d62d6d3e48f20ecd09c715fe5a98e7c9ce8042559f1d6e8a6ce0d666d262a536b2376b8e2d99beb7ce50dd53e238e2f37df118630945b5cbb4b87

  • C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
    MD5

    2e91e5e3d39ce4155edad4f2a3acf916

    SHA1

    58adf5d60d9da823a4fd62282c0c46134e20e47b

    SHA256

    eb9e13fd092522e4dde08e96961117f9926e3ef70ca3b225f8c388e476541a21

    SHA512

    5d27cd110e8d62d6d3e48f20ecd09c715fe5a98e7c9ce8042559f1d6e8a6ce0d666d262a536b2376b8e2d99beb7ce50dd53e238e2f37df118630945b5cbb4b87

  • C:\Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
    MD5

    2e91e5e3d39ce4155edad4f2a3acf916

    SHA1

    58adf5d60d9da823a4fd62282c0c46134e20e47b

    SHA256

    eb9e13fd092522e4dde08e96961117f9926e3ef70ca3b225f8c388e476541a21

    SHA512

    5d27cd110e8d62d6d3e48f20ecd09c715fe5a98e7c9ce8042559f1d6e8a6ce0d666d262a536b2376b8e2d99beb7ce50dd53e238e2f37df118630945b5cbb4b87

  • \Users\Admin\AppData\Roaming\System32\PxxoServicesTrialNet1.exe
    MD5

    2e91e5e3d39ce4155edad4f2a3acf916

    SHA1

    58adf5d60d9da823a4fd62282c0c46134e20e47b

    SHA256

    eb9e13fd092522e4dde08e96961117f9926e3ef70ca3b225f8c388e476541a21

    SHA512

    5d27cd110e8d62d6d3e48f20ecd09c715fe5a98e7c9ce8042559f1d6e8a6ce0d666d262a536b2376b8e2d99beb7ce50dd53e238e2f37df118630945b5cbb4b87

  • memory/428-65-0x0000000000400000-0x0000000000422000-memory.dmp
    Filesize

    136KB

  • memory/428-67-0x00000000753E1000-0x00000000753E3000-memory.dmp
    Filesize

    8KB

  • memory/428-71-0x0000000000400000-0x0000000000422000-memory.dmp
    Filesize

    136KB

  • memory/428-66-0x0000000000413FA4-mapping.dmp
  • memory/452-64-0x0000000006110000-0x0000000006111000-memory.dmp
    Filesize

    4KB

  • memory/452-61-0x0000000000360000-0x000000000039E000-memory.dmp
    Filesize

    248KB

  • memory/452-59-0x0000000000930000-0x0000000000931000-memory.dmp
    Filesize

    4KB

  • memory/652-81-0x0000000000000000-mapping.dmp
  • memory/1016-72-0x0000000000000000-mapping.dmp
  • memory/1100-62-0x0000000000000000-mapping.dmp
  • memory/1284-75-0x0000000000000000-mapping.dmp
  • memory/1284-77-0x0000000000CA0000-0x0000000000CA1000-memory.dmp
    Filesize

    4KB

  • memory/1284-82-0x00000000042C0000-0x00000000042C1000-memory.dmp
    Filesize

    4KB

  • memory/1404-68-0x0000000000000000-mapping.dmp
  • memory/1528-63-0x0000000000000000-mapping.dmp
  • memory/1632-84-0x0000000000413FA4-mapping.dmp
  • memory/1632-87-0x0000000000400000-0x0000000000422000-memory.dmp
    Filesize

    136KB

  • memory/1784-80-0x0000000000000000-mapping.dmp