Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
27-07-2021 15:04
Static task
static1
Behavioral task
behavioral1
Sample
Dringende Vertragsbestellung GH7856648,pdf.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Dringende Vertragsbestellung GH7856648,pdf.exe
Resource
win10v20210410
General
-
Target
Dringende Vertragsbestellung GH7856648,pdf.exe
-
Size
843KB
-
MD5
34684b3de7b33bb0bc8e9b8e62a26431
-
SHA1
c4ad20e82a7456c4bea6436c7a394deed5fa4e8a
-
SHA256
0b10f51931ebadefe515c5db78b89095df9ff47ad1bd042eace9d47047c5a09d
-
SHA512
f246a24d7f94e3717023acafd30f46e6c05c2b5cdb2c6416ee2a2cd3018c43bf44df6d9cedfb781d17b0a2ca4f2c1141186b49acad80dbadc438dd90819607f5
Malware Config
Extracted
remcos
BUSINESS
moneymustdrop.ddns.net:6808
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-84ZKJ7
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Dringende Vertragsbestellung GH7856648,pdf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\Msqhcgo = "C:\\Users\\Public\\Libraries\\ogchqsM.url" Dringende Vertragsbestellung GH7856648,pdf.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Dringende Vertragsbestellung GH7856648,pdf.exedescription pid process target process PID 3236 wrote to memory of 3452 3236 Dringende Vertragsbestellung GH7856648,pdf.exe dialer.exe PID 3236 wrote to memory of 3452 3236 Dringende Vertragsbestellung GH7856648,pdf.exe dialer.exe PID 3236 wrote to memory of 3452 3236 Dringende Vertragsbestellung GH7856648,pdf.exe dialer.exe PID 3236 wrote to memory of 3452 3236 Dringende Vertragsbestellung GH7856648,pdf.exe dialer.exe PID 3236 wrote to memory of 3452 3236 Dringende Vertragsbestellung GH7856648,pdf.exe dialer.exe PID 3236 wrote to memory of 3452 3236 Dringende Vertragsbestellung GH7856648,pdf.exe dialer.exe PID 3236 wrote to memory of 3452 3236 Dringende Vertragsbestellung GH7856648,pdf.exe dialer.exe PID 3236 wrote to memory of 3452 3236 Dringende Vertragsbestellung GH7856648,pdf.exe dialer.exe PID 3236 wrote to memory of 3452 3236 Dringende Vertragsbestellung GH7856648,pdf.exe dialer.exe PID 3236 wrote to memory of 3452 3236 Dringende Vertragsbestellung GH7856648,pdf.exe dialer.exe PID 3236 wrote to memory of 3452 3236 Dringende Vertragsbestellung GH7856648,pdf.exe dialer.exe PID 3236 wrote to memory of 3452 3236 Dringende Vertragsbestellung GH7856648,pdf.exe dialer.exe PID 3236 wrote to memory of 3452 3236 Dringende Vertragsbestellung GH7856648,pdf.exe dialer.exe PID 3236 wrote to memory of 3452 3236 Dringende Vertragsbestellung GH7856648,pdf.exe dialer.exe PID 3236 wrote to memory of 3452 3236 Dringende Vertragsbestellung GH7856648,pdf.exe dialer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dringende Vertragsbestellung GH7856648,pdf.exe"C:\Users\Admin\AppData\Local\Temp\Dringende Vertragsbestellung GH7856648,pdf.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dialer.exeC:\Windows\System32\dialer.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3236-114-0x0000000002370000-0x0000000002371000-memory.dmpFilesize
4KB
-
memory/3236-116-0x0000000002390000-0x00000000023AA000-memory.dmpFilesize
104KB
-
memory/3452-119-0x0000000000000000-mapping.dmp
-
memory/3452-121-0x0000000000A30000-0x0000000000A31000-memory.dmpFilesize
4KB
-
memory/3452-120-0x0000000000770000-0x0000000000771000-memory.dmpFilesize
4KB
-
memory/3452-123-0x0000000010590000-0x000000001060D000-memory.dmpFilesize
500KB
-
memory/3452-122-0x00000000007D0000-0x00000000007D1000-memory.dmpFilesize
4KB
-
memory/3452-124-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB