Analysis
-
max time kernel
149s -
max time network
183s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
18-08-2021 13:07
Static task
static1
Behavioral task
behavioral1
Sample
RFQ NV76767986553 (DRINGEND),pdf.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
RFQ NV76767986553 (DRINGEND),pdf.exe
Resource
win10v20210410
General
-
Target
RFQ NV76767986553 (DRINGEND),pdf.exe
-
Size
622KB
-
MD5
66d6dd3b46315be077ceb45bd5c4359e
-
SHA1
223da6832cbaa6109e878d216f1c00e4569ad111
-
SHA256
91dfaa2872553058fa716f17748a56e8e4c678c004a72f85e05c7b4949a6c789
-
SHA512
322c850f9b3e3eab2ae19553e957ba222a2750caf25540bd82f2240d274852382fc4f2b55005c59290da7342b75da5345520a6f07496438f08d3b9d08da8584b
Malware Config
Extracted
remcos
E sure 4 me
thankyoulord4real.ddns.net:3030
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-7DDGKV
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RFQ NV76767986553 (DRINGEND),pdf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ekvalym = "C:\\Users\\Public\\Libraries\\mylavkE.url" RFQ NV76767986553 (DRINGEND),pdf.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
RFQ NV76767986553 (DRINGEND),pdf.exedescription pid process target process PID 736 wrote to memory of 568 736 RFQ NV76767986553 (DRINGEND),pdf.exe DpiScaling.exe PID 736 wrote to memory of 568 736 RFQ NV76767986553 (DRINGEND),pdf.exe DpiScaling.exe PID 736 wrote to memory of 568 736 RFQ NV76767986553 (DRINGEND),pdf.exe DpiScaling.exe PID 736 wrote to memory of 568 736 RFQ NV76767986553 (DRINGEND),pdf.exe DpiScaling.exe PID 736 wrote to memory of 568 736 RFQ NV76767986553 (DRINGEND),pdf.exe DpiScaling.exe PID 736 wrote to memory of 568 736 RFQ NV76767986553 (DRINGEND),pdf.exe DpiScaling.exe PID 736 wrote to memory of 568 736 RFQ NV76767986553 (DRINGEND),pdf.exe DpiScaling.exe PID 736 wrote to memory of 568 736 RFQ NV76767986553 (DRINGEND),pdf.exe DpiScaling.exe PID 736 wrote to memory of 568 736 RFQ NV76767986553 (DRINGEND),pdf.exe DpiScaling.exe PID 736 wrote to memory of 568 736 RFQ NV76767986553 (DRINGEND),pdf.exe DpiScaling.exe PID 736 wrote to memory of 568 736 RFQ NV76767986553 (DRINGEND),pdf.exe DpiScaling.exe PID 736 wrote to memory of 568 736 RFQ NV76767986553 (DRINGEND),pdf.exe DpiScaling.exe PID 736 wrote to memory of 568 736 RFQ NV76767986553 (DRINGEND),pdf.exe DpiScaling.exe PID 736 wrote to memory of 568 736 RFQ NV76767986553 (DRINGEND),pdf.exe DpiScaling.exe PID 736 wrote to memory of 568 736 RFQ NV76767986553 (DRINGEND),pdf.exe DpiScaling.exe PID 736 wrote to memory of 568 736 RFQ NV76767986553 (DRINGEND),pdf.exe DpiScaling.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ NV76767986553 (DRINGEND),pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ NV76767986553 (DRINGEND),pdf.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/568-62-0x0000000000000000-mapping.dmp
-
memory/568-65-0x0000000000140000-0x0000000000141000-memory.dmpFilesize
4KB
-
memory/568-67-0x0000000010590000-0x000000001060D000-memory.dmpFilesize
500KB
-
memory/568-66-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/568-68-0x0000000000290000-0x000000000030A000-memory.dmpFilesize
488KB
-
memory/568-64-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/736-60-0x00000000757E1000-0x00000000757E3000-memory.dmpFilesize
8KB
-
memory/736-61-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB