Managed XDR

re_-dhl-cfs-bk_-bestbuy-_-202654671523.eml (Remcos, Brute Ratel) — malware analysis report

File info

Filename
re_-dhl-cfs-bk_-bestbuy-_-202654671523.eml
File type
SMTP mail, ASCII text, with CRLF line terminators
File size
41 KB
First seen
Last seen

Environment

w10/x64 en

Hashes

SHA1
116c63a606beba11c101f51eaf1f22d9c85267cb
SHA256
a0debc09cd9aab766d44202c5fc0bb820a4bc5919b3798f1b1a550ad4fa8893d
MD5
7a99effb0d06e2c200849ad5a1bc8643

Malwares

  • Remcos
  • Brute Ratel

Signatures

Execution

T1059 powershell_cmd_longcommandline: Suspiciously long commandline
T1059.001 suspicious_powershell: Creates suspicious PowerShell process
T1059.001 suspicious_process: Spawns a suspicious process
T1047 antivm_wmi: Uses WMI to detect virtual environment
T1047 has_wmi: Executes one or several WMI requests
T1059.001 url_cmdline: Cmdline of process contains URL
T1059.003 url_cmdline: Cmdline of process contains URL

Privilege Escalation

T1055.002 inject_write_pe: Writes PE file to another process's memory
T1055.012 injection_runpe: Injects code into another process
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1218 bypass_dev_utils: Executing .NET utility in a suspended state, potentially for injection
T1055.002 inject_write_pe: Writes PE file to another process's memory
T1055.012 injection_runpe: Injects code into another process
T1027.002 unnamed_memory_regions_contains_pe: One or several unnamed memory regions are PE files
T1027.002 unnamed_memory_regions: Code was executed in unnamed regions
T1562 dep_disable: Disables DEP
T1497 debugs_self: Creates a process and debugs it
T1497.001 antivm_wmi: Uses WMI to detect virtual environment
T1497 evasion_printers: Attempts to detect Sandbox by exploring existing printers
T1497.001 antivm_generic_productname: Checks system product name in registry, possibly for anti-virtualization
T1497.002 antivm_usbstor: Reads information about usbdevices from regkey
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Credential Access

T1555.004 windows_credential_manager: Acquire credentials from the Windows Credential Manager

Discovery

T1497 debugs_self: Creates a process and debugs it
T1497.001 antivm_wmi: Uses WMI to detect virtual environment
T1057 has_wmi: Executes one or several WMI requests
T1082 has_wmi: Executes one or several WMI requests
T1497 evasion_printers: Attempts to detect Sandbox by exploring existing printers
T1497.001 antivm_generic_productname: Checks system product name in registry, possibly for anti-virtualization
T1497.002 antivm_usbstor: Reads information about usbdevices from regkey

Command and Control

T1071.001 network_http: Performs HTTP requests
T1071.001 winhttp_https: Performs HTTP/HTTPS requests using WinHttp

Other

yara_rules: Static rules
suricata_alert: Malicious traffic detected
ce_info: Remcos Configuration Data found
unpacker_wrong_base: Possibly, an error occurred in the file unpacker
network_bind: Starts servers listening at None
dead_host: Connects to IP addresses that do not respond to requests
network_powershell: PowerShell process network connection detected
create_rpc_bindings: Creates RPC connection
creates_suspended_process: Creates suspended process
suspicious_network_port: Performs TCP or UDP request to non-standard port
test_check_service: Starts services
antisandbox_check_graphics_card: Uses CreateDXGIFactory, potentially to detect graphics card

Related reports