Analysis
- max time kernel
150s - max time network
152s - platform
windows7_x64 - resource
win7v20210410 - submitted
20/06/2021, 08:16
General
- Target 6855e78fc405ab419cbe253874c74806.exe
- Size 850KB
- Sample210620-7xcbxspp2x
- SHA256 133a9234dee77f774077fd79e3edbdc22b9a8252a4e855fab33aeae974d2fa15
Malware Config
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6855e78fc405ab419cbe253874c74806.exe"C:\Users\Admin\AppData\Local\Temp\6855e78fc405ab419cbe253874c74806.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6855e78fc405ab419cbe253874c74806.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\6855e78fc405ab419cbe253874c74806.exe"C:\Users\Admin\AppData\Local\Temp\6855e78fc405ab419cbe253874c74806.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/528-72-0x0000000000400000-0x0000000000481000-memory.dmp
memory/528-66-0x0000000000400000-0x0000000000481000-memory.dmp
memory/528-68-0x0000000075591000-0x0000000075593000-memory.dmp
memory/1268-59-0x0000000001020000-0x0000000001021000-memory.dmp
memory/1268-61-0x0000000004CC0000-0x0000000004CC1000-memory.dmp
memory/1268-62-0x0000000000770000-0x0000000000786000-memory.dmp
memory/1268-64-0x0000000004EC0000-0x0000000004F17000-memory.dmp
memory/1268-63-0x00000000055B0000-0x0000000005642000-memory.dmp
memory/1620-74-0x00000000048E2000-0x00000000048E3000-memory.dmp
memory/1620-71-0x0000000004920000-0x0000000004921000-memory.dmp
memory/1620-73-0x00000000048E0000-0x00000000048E1000-memory.dmp
memory/1620-79-0x0000000005650000-0x0000000005651000-memory.dmp
memory/1620-75-0x0000000004710000-0x0000000004711000-memory.dmp
memory/1620-76-0x0000000005240000-0x0000000005241000-memory.dmp
memory/1620-70-0x0000000002170000-0x0000000002171000-memory.dmp
memory/1620-84-0x0000000006080000-0x0000000006081000-memory.dmp
memory/1620-85-0x0000000006190000-0x0000000006191000-memory.dmp
memory/1620-92-0x0000000006240000-0x0000000006241000-memory.dmp
memory/1620-93-0x000000007EF30000-0x000000007EF31000-memory.dmp
memory/1620-94-0x0000000005610000-0x0000000005611000-memory.dmp
memory/1620-108-0x0000000006300000-0x0000000006301000-memory.dmp
memory/1620-109-0x0000000006310000-0x0000000006311000-memory.dmp