Analysis
- max time kernel
149s - max time network
152s - platform
windows7_x64 - resource
win7v20210410 - submitted
02/06/2021, 09:52
General
- Target SecuriteInfo.com.W32.MSIL_Kryptik.DVA.genEldorado.6230.14929.exe
- Size 1.1MB
- Sample210602-s3rypp87ex
- SHA256 e0a0c2bb0b0436bb613bd1eb9142edf9f09166349a12c71045eeb99c13d154c5
Score
10/10
Malware Config
Extracted
Family
-
remcos
C2
-
trucker5.ddns.net:3341
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.DVA.genEldorado.6230.14929.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.MSIL_Kryptik.DVA.genEldorado.6230.14929.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/744-65-0x0000000000400000-0x0000000000478000-memory.dmp
memory/744-67-0x00000000753B1000-0x00000000753B3000-memory.dmp
memory/744-68-0x0000000000400000-0x0000000000478000-memory.dmp
memory/1088-59-0x0000000000BE0000-0x0000000000BE1000-memory.dmp
memory/1088-61-0x00000000005F0000-0x00000000005F1000-memory.dmp
memory/1088-62-0x0000000000530000-0x0000000000544000-memory.dmp
memory/1088-63-0x0000000005010000-0x00000000050D5000-memory.dmp
memory/1088-64-0x00000000051E0000-0x000000000526E000-memory.dmp