Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en -
submitted
15-09-2021 07:18
Static task
static1
Behavioral task
behavioral1
Sample
44fcb60fa4a1d0535b891a0d7f603975.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
44fcb60fa4a1d0535b891a0d7f603975.exe
Resource
win10-en
General
-
Target
44fcb60fa4a1d0535b891a0d7f603975.exe
-
Size
917KB
-
MD5
44fcb60fa4a1d0535b891a0d7f603975
-
SHA1
d526556c835337c2ca87c00d3ce3e430751bb3e2
-
SHA256
72a13a9e54e095c5878be67503dd808a7332cb631c4c615d65d69e2de47b080f
-
SHA512
537679df43c2924a7d409a527c929cab061e97b135f94110957ce4cb4193efc79b8d9962a8e56969a822534a161755c4cb99bb1caaf5804fe55f849716b414bb
Malware Config
Extracted
remcos
3.2.0 Pro
RemoteHost
freelife.hopto.org:2404
freelife1.hopto.org:2404
freelife2.hopto.org:2404
freelife01.hopto.org:2404
freelife3.hopto.org:2404
freelife4.hopto.org:2404
freelife5.hopto.org:2404
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
pastananiceforwhat-QQD2AI
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
mshta.exeflow pid process 15 2680 mshta.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
44fcb60fa4a1d0535b891a0d7f603975.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Uhexymko = "C:\\Users\\Public\\Libraries\\okmyxehU.url" 44fcb60fa4a1d0535b891a0d7f603975.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
44fcb60fa4a1d0535b891a0d7f603975.exedescription pid process target process PID 4008 wrote to memory of 2680 4008 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 4008 wrote to memory of 2680 4008 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 4008 wrote to memory of 2680 4008 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 4008 wrote to memory of 2680 4008 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 4008 wrote to memory of 2680 4008 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 4008 wrote to memory of 2680 4008 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 4008 wrote to memory of 2680 4008 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 4008 wrote to memory of 2680 4008 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 4008 wrote to memory of 2680 4008 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 4008 wrote to memory of 2680 4008 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 4008 wrote to memory of 2680 4008 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 4008 wrote to memory of 2680 4008 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 4008 wrote to memory of 2680 4008 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 4008 wrote to memory of 2680 4008 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe PID 4008 wrote to memory of 2680 4008 44fcb60fa4a1d0535b891a0d7f603975.exe mshta.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\44fcb60fa4a1d0535b891a0d7f603975.exe"C:\Users\Admin\AppData\Local\Temp\44fcb60fa4a1d0535b891a0d7f603975.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\System32\mshta.exe2⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2680-120-0x0000000000000000-mapping.dmp
-
memory/2680-122-0x0000000000600000-0x0000000000601000-memory.dmpFilesize
4KB
-
memory/2680-121-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB
-
memory/2680-124-0x0000000010590000-0x000000001060C000-memory.dmpFilesize
496KB
-
memory/2680-123-0x0000000000500000-0x0000000000501000-memory.dmpFilesize
4KB
-
memory/2680-125-0x0000000000550000-0x00000000005C9000-memory.dmpFilesize
484KB
-
memory/4008-119-0x0000000000680000-0x0000000000681000-memory.dmpFilesize
4KB