Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
30-06-2022 23:30
Static task
static1
Behavioral task
behavioral1
Sample
c3fe455b6952a4abcda157f240b3b9ee2925ef060b7bc5fe6d214875853867ad.exe
Resource
win7-20220414-en
General
-
Target
c3fe455b6952a4abcda157f240b3b9ee2925ef060b7bc5fe6d214875853867ad.exe
-
Size
1.8MB
-
MD5
56d303880d7dd7cc938af1e033c8fa0b
-
SHA1
55a5a6a829d3ad9799c546f6846150131ef89c1f
-
SHA256
c3fe455b6952a4abcda157f240b3b9ee2925ef060b7bc5fe6d214875853867ad
-
SHA512
e98c01d294d113c7dfc079504150e7c0f22b6e6f21cda3186679d24218ad8a8fa6005e59574af45813525ae49ab208c65302585a323488f69ebc04544f5c0a52
Malware Config
Extracted
remcos
2.5.0 Pro
1
193.111.198.220:5861
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
Logs
-
keylog_path
%Temp%
-
mouse_option
false
-
mutex
5850Port-UAYNLL
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
-
Blocklisted process makes network request 19 IoCs
Processes:
cmd.exeflow pid process 6 1936 cmd.exe 7 1936 cmd.exe 8 1936 cmd.exe 9 1936 cmd.exe 10 1936 cmd.exe 11 1936 cmd.exe 12 1936 cmd.exe 13 1936 cmd.exe 14 1936 cmd.exe 15 1936 cmd.exe 16 1936 cmd.exe 17 1936 cmd.exe 18 1936 cmd.exe 19 1936 cmd.exe 20 1936 cmd.exe 21 1936 cmd.exe 22 1936 cmd.exe 23 1936 cmd.exe 24 1936 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
mdrs.exepid process 2016 mdrs.exe -
Loads dropped DLL 5 IoCs
Processes:
c3fe455b6952a4abcda157f240b3b9ee2925ef060b7bc5fe6d214875853867ad.exemdrs.exepid process 784 c3fe455b6952a4abcda157f240b3b9ee2925ef060b7bc5fe6d214875853867ad.exe 784 c3fe455b6952a4abcda157f240b3b9ee2925ef060b7bc5fe6d214875853867ad.exe 784 c3fe455b6952a4abcda157f240b3b9ee2925ef060b7bc5fe6d214875853867ad.exe 784 c3fe455b6952a4abcda157f240b3b9ee2925ef060b7bc5fe6d214875853867ad.exe 2016 mdrs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
mdrs.exenslookup.exepid process 2016 mdrs.exe 2004 nslookup.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
nslookup.exepid process 2004 nslookup.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
mdrs.execmd.exepid process 2016 mdrs.exe 1936 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c3fe455b6952a4abcda157f240b3b9ee2925ef060b7bc5fe6d214875853867ad.exemdrs.exenslookup.exedescription pid process target process PID 784 wrote to memory of 2016 784 c3fe455b6952a4abcda157f240b3b9ee2925ef060b7bc5fe6d214875853867ad.exe mdrs.exe PID 784 wrote to memory of 2016 784 c3fe455b6952a4abcda157f240b3b9ee2925ef060b7bc5fe6d214875853867ad.exe mdrs.exe PID 784 wrote to memory of 2016 784 c3fe455b6952a4abcda157f240b3b9ee2925ef060b7bc5fe6d214875853867ad.exe mdrs.exe PID 784 wrote to memory of 2016 784 c3fe455b6952a4abcda157f240b3b9ee2925ef060b7bc5fe6d214875853867ad.exe mdrs.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2016 wrote to memory of 2004 2016 mdrs.exe nslookup.exe PID 2004 wrote to memory of 1936 2004 nslookup.exe cmd.exe PID 2004 wrote to memory of 1936 2004 nslookup.exe cmd.exe PID 2004 wrote to memory of 1936 2004 nslookup.exe cmd.exe PID 2004 wrote to memory of 1936 2004 nslookup.exe cmd.exe PID 2004 wrote to memory of 1936 2004 nslookup.exe cmd.exe PID 2004 wrote to memory of 1936 2004 nslookup.exe cmd.exe PID 2004 wrote to memory of 1936 2004 nslookup.exe cmd.exe PID 2004 wrote to memory of 1936 2004 nslookup.exe cmd.exe PID 2004 wrote to memory of 1936 2004 nslookup.exe cmd.exe PID 2004 wrote to memory of 1936 2004 nslookup.exe cmd.exe PID 2004 wrote to memory of 1936 2004 nslookup.exe cmd.exe PID 2004 wrote to memory of 1936 2004 nslookup.exe cmd.exe PID 2004 wrote to memory of 1936 2004 nslookup.exe cmd.exe PID 2004 wrote to memory of 1936 2004 nslookup.exe cmd.exe PID 2004 wrote to memory of 1936 2004 nslookup.exe cmd.exe PID 2004 wrote to memory of 1936 2004 nslookup.exe cmd.exe PID 2004 wrote to memory of 1936 2004 nslookup.exe cmd.exe PID 2004 wrote to memory of 1936 2004 nslookup.exe cmd.exe PID 2004 wrote to memory of 1936 2004 nslookup.exe cmd.exe PID 2004 wrote to memory of 1936 2004 nslookup.exe cmd.exe PID 2004 wrote to memory of 1936 2004 nslookup.exe cmd.exe PID 2004 wrote to memory of 1936 2004 nslookup.exe cmd.exe PID 2004 wrote to memory of 1936 2004 nslookup.exe cmd.exe PID 2004 wrote to memory of 1936 2004 nslookup.exe cmd.exe PID 2004 wrote to memory of 1936 2004 nslookup.exe cmd.exe PID 2004 wrote to memory of 1936 2004 nslookup.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3fe455b6952a4abcda157f240b3b9ee2925ef060b7bc5fe6d214875853867ad.exe"C:\Users\Admin\AppData\Local\Temp\c3fe455b6952a4abcda157f240b3b9ee2925ef060b7bc5fe6d214875853867ad.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mdrs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\mdrs.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\nslookup.exe"C:\Windows\system32\nslookup.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Blocklisted process makes network request
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\libcrypto-1_1.dllFilesize
4.5MB
MD5d73134c0b780595c6c95f8568c1f81a7
SHA119bd711b9d66df0353f5d74ae9ef6c30909dba78
SHA2560221fa75ad37f1a90092eb34171740b9f735eda0f50f2f4e7b62fcc9f7a62d70
SHA512e2e6659efdd82ab817c61cfb40669736c2db8c73737de571df7470f5477730e03cb32910e31304fba27dba754de80f7dbe8bdef73a280299b3d9fd307dbea176
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mdrs.exeFilesize
630KB
MD57215c1b9693b1394aaa7c86dcd741ad7
SHA1290dda9a0f85cf5f119cb726e4f5d86696672bbc
SHA2561d2914c04b213029550eba1e0c0b40e36a32b443a76efc9c2f779e8b9448bdd5
SHA512e79b8a8ffbf75a17ab8b16752d3da68be9c6f7c50fedf4a6049da2393ff8b1b43e1f9cd9b9bfdc06c8b62764031d959962cfc11898bd81bf22a9970d6c63b945
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mdrs.exeFilesize
630KB
MD57215c1b9693b1394aaa7c86dcd741ad7
SHA1290dda9a0f85cf5f119cb726e4f5d86696672bbc
SHA2561d2914c04b213029550eba1e0c0b40e36a32b443a76efc9c2f779e8b9448bdd5
SHA512e79b8a8ffbf75a17ab8b16752d3da68be9c6f7c50fedf4a6049da2393ff8b1b43e1f9cd9b9bfdc06c8b62764031d959962cfc11898bd81bf22a9970d6c63b945
-
\Users\Admin\AppData\Local\Temp\RarSFX0\libcrypto-1_1.dllFilesize
4.5MB
MD5d73134c0b780595c6c95f8568c1f81a7
SHA119bd711b9d66df0353f5d74ae9ef6c30909dba78
SHA2560221fa75ad37f1a90092eb34171740b9f735eda0f50f2f4e7b62fcc9f7a62d70
SHA512e2e6659efdd82ab817c61cfb40669736c2db8c73737de571df7470f5477730e03cb32910e31304fba27dba754de80f7dbe8bdef73a280299b3d9fd307dbea176
-
\Users\Admin\AppData\Local\Temp\RarSFX0\mdrs.exeFilesize
630KB
MD57215c1b9693b1394aaa7c86dcd741ad7
SHA1290dda9a0f85cf5f119cb726e4f5d86696672bbc
SHA2561d2914c04b213029550eba1e0c0b40e36a32b443a76efc9c2f779e8b9448bdd5
SHA512e79b8a8ffbf75a17ab8b16752d3da68be9c6f7c50fedf4a6049da2393ff8b1b43e1f9cd9b9bfdc06c8b62764031d959962cfc11898bd81bf22a9970d6c63b945
-
\Users\Admin\AppData\Local\Temp\RarSFX0\mdrs.exeFilesize
630KB
MD57215c1b9693b1394aaa7c86dcd741ad7
SHA1290dda9a0f85cf5f119cb726e4f5d86696672bbc
SHA2561d2914c04b213029550eba1e0c0b40e36a32b443a76efc9c2f779e8b9448bdd5
SHA512e79b8a8ffbf75a17ab8b16752d3da68be9c6f7c50fedf4a6049da2393ff8b1b43e1f9cd9b9bfdc06c8b62764031d959962cfc11898bd81bf22a9970d6c63b945
-
\Users\Admin\AppData\Local\Temp\RarSFX0\mdrs.exeFilesize
630KB
MD57215c1b9693b1394aaa7c86dcd741ad7
SHA1290dda9a0f85cf5f119cb726e4f5d86696672bbc
SHA2561d2914c04b213029550eba1e0c0b40e36a32b443a76efc9c2f779e8b9448bdd5
SHA512e79b8a8ffbf75a17ab8b16752d3da68be9c6f7c50fedf4a6049da2393ff8b1b43e1f9cd9b9bfdc06c8b62764031d959962cfc11898bd81bf22a9970d6c63b945
-
\Users\Admin\AppData\Local\Temp\RarSFX0\mdrs.exeFilesize
630KB
MD57215c1b9693b1394aaa7c86dcd741ad7
SHA1290dda9a0f85cf5f119cb726e4f5d86696672bbc
SHA2561d2914c04b213029550eba1e0c0b40e36a32b443a76efc9c2f779e8b9448bdd5
SHA512e79b8a8ffbf75a17ab8b16752d3da68be9c6f7c50fedf4a6049da2393ff8b1b43e1f9cd9b9bfdc06c8b62764031d959962cfc11898bd81bf22a9970d6c63b945
-
memory/784-54-0x0000000076391000-0x0000000076393000-memory.dmpFilesize
8KB
-
memory/1936-83-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1936-82-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1936-75-0x0000000000090000-0x0000000000098000-memory.dmpFilesize
32KB
-
memory/1936-74-0x00000000777E0000-0x0000000077989000-memory.dmpFilesize
1.7MB
-
memory/1936-72-0x0000000000000000-mapping.dmp
-
memory/2004-71-0x0000000004547000-0x0000000004557000-memory.dmpFilesize
64KB
-
memory/2004-70-0x00000000001E0000-0x00000000001E8000-memory.dmpFilesize
32KB
-
memory/2004-69-0x00000000777E0000-0x0000000077989000-memory.dmpFilesize
1.7MB
-
memory/2004-68-0x0000000004540000-0x0000000004576000-memory.dmpFilesize
216KB
-
memory/2004-80-0x0000000004547000-0x0000000004557000-memory.dmpFilesize
64KB
-
memory/2004-65-0x0000000000000000-mapping.dmp
-
memory/2016-66-0x00000000001A0000-0x00000000001AA000-memory.dmpFilesize
40KB
-
memory/2016-63-0x0000000000730000-0x0000000000BC8000-memory.dmpFilesize
4.6MB
-
memory/2016-59-0x0000000000000000-mapping.dmp