Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
03-05-2021 20:02
Static task
static1
Behavioral task
behavioral1
Sample
02_MYCHI.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
02_MYCHI.exe
Resource
win10v20210408
General
-
Target
02_MYCHI.exe
-
Size
128KB
-
MD5
75043c4082c567335c389fdd3a2d43d2
-
SHA1
162dab26aea594b65a4f4fc11aeb5a2b8a53021b
-
SHA256
00c6fec43721edc15cca63d3848cfa4173edffa71e601461daaf130eec32eff4
-
SHA512
919081234316e7f142e908c38d4688154ff81eef94809e24a150b9e92f733a268d91ba78d98199bad7d96e92c4b5256601f70031981283fd3c93e02e9d00f4a9
Malware Config
Extracted
remcos
mychi.hopto.org:2405
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
remcos.exepid process 184 remcos.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
02_MYCHI.exeremcos.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 02_MYCHI.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" 02_MYCHI.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" remcos.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
02_MYCHI.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings 02_MYCHI.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
remcos.exepid process 184 remcos.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
02_MYCHI.exeWScript.execmd.exedescription pid process target process PID 4044 wrote to memory of 3540 4044 02_MYCHI.exe WScript.exe PID 4044 wrote to memory of 3540 4044 02_MYCHI.exe WScript.exe PID 4044 wrote to memory of 3540 4044 02_MYCHI.exe WScript.exe PID 3540 wrote to memory of 2652 3540 WScript.exe cmd.exe PID 3540 wrote to memory of 2652 3540 WScript.exe cmd.exe PID 3540 wrote to memory of 2652 3540 WScript.exe cmd.exe PID 2652 wrote to memory of 184 2652 cmd.exe remcos.exe PID 2652 wrote to memory of 184 2652 cmd.exe remcos.exe PID 2652 wrote to memory of 184 2652 cmd.exe remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\02_MYCHI.exe"C:\Users\Admin\AppData\Local\Temp\02_MYCHI.exe"1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsMD5
b92d64fe5b1d1f59df4b738262aea8df
SHA1c8fb1981759c2d9bb2ec91b705985fba5fc7af63
SHA256fa20e9aab03dc8e9f1910aaf0cf42662379fa16ae3a22642084fb97fa3d4f83a
SHA5122566248b93c0cfb0414f033b8dd18bbd4f88180093eac2861107289bcb4ee160f9593706ff1f7d1f2e4ecea430d67a5a2897551a4f9ebd82b707243e300520e2
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
75043c4082c567335c389fdd3a2d43d2
SHA1162dab26aea594b65a4f4fc11aeb5a2b8a53021b
SHA25600c6fec43721edc15cca63d3848cfa4173edffa71e601461daaf130eec32eff4
SHA512919081234316e7f142e908c38d4688154ff81eef94809e24a150b9e92f733a268d91ba78d98199bad7d96e92c4b5256601f70031981283fd3c93e02e9d00f4a9
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeMD5
75043c4082c567335c389fdd3a2d43d2
SHA1162dab26aea594b65a4f4fc11aeb5a2b8a53021b
SHA25600c6fec43721edc15cca63d3848cfa4173edffa71e601461daaf130eec32eff4
SHA512919081234316e7f142e908c38d4688154ff81eef94809e24a150b9e92f733a268d91ba78d98199bad7d96e92c4b5256601f70031981283fd3c93e02e9d00f4a9
-
memory/184-117-0x0000000000000000-mapping.dmp
-
memory/2652-116-0x0000000000000000-mapping.dmp
-
memory/3540-114-0x0000000000000000-mapping.dmp