Analysis
-
max time kernel
154s -
max time network
173s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
15-09-2021 06:52
Static task
static1
Behavioral task
behavioral1
Sample
64e3a0b3d39e61ab529cc4f9a7528d1d.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
64e3a0b3d39e61ab529cc4f9a7528d1d.exe
Resource
win10-en
General
-
Target
64e3a0b3d39e61ab529cc4f9a7528d1d.exe
-
Size
917KB
-
MD5
64e3a0b3d39e61ab529cc4f9a7528d1d
-
SHA1
3149dbd400836e7db81c5e2bef130e470057b600
-
SHA256
8a0f8162ea104c59ca502748f5d4c72d930d21d59d23b0dde2fb6b5fec69947f
-
SHA512
3d024537168ab19dd2ab38b0bb89a86b2473f9614a4dce021c87fdc0c3a220986a5e2360dec04bddd25519ee20f89d41c740d10364f0f1272505922c3770c3fa
Malware Config
Extracted
remcos
3.2.0 Pro
RemoteHost
freelife.hopto.org:2404
freelife1.hopto.org:2404
freelife2.hopto.org:2404
freelife01.hopto.org:2404
freelife3.hopto.org:2404
freelife4.hopto.org:2404
freelife5.hopto.org:2404
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
pastananiceforwhat-QQD2AI
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
64e3a0b3d39e61ab529cc4f9a7528d1d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Uhexymko = "C:\\Users\\Public\\Libraries\\okmyxehU.url" 64e3a0b3d39e61ab529cc4f9a7528d1d.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
64e3a0b3d39e61ab529cc4f9a7528d1d.exedescription pid process target process PID 1100 wrote to memory of 1916 1100 64e3a0b3d39e61ab529cc4f9a7528d1d.exe logagent.exe PID 1100 wrote to memory of 1916 1100 64e3a0b3d39e61ab529cc4f9a7528d1d.exe logagent.exe PID 1100 wrote to memory of 1916 1100 64e3a0b3d39e61ab529cc4f9a7528d1d.exe logagent.exe PID 1100 wrote to memory of 1916 1100 64e3a0b3d39e61ab529cc4f9a7528d1d.exe logagent.exe PID 1100 wrote to memory of 1916 1100 64e3a0b3d39e61ab529cc4f9a7528d1d.exe logagent.exe PID 1100 wrote to memory of 1916 1100 64e3a0b3d39e61ab529cc4f9a7528d1d.exe logagent.exe PID 1100 wrote to memory of 1916 1100 64e3a0b3d39e61ab529cc4f9a7528d1d.exe logagent.exe PID 1100 wrote to memory of 1916 1100 64e3a0b3d39e61ab529cc4f9a7528d1d.exe logagent.exe PID 1100 wrote to memory of 1916 1100 64e3a0b3d39e61ab529cc4f9a7528d1d.exe logagent.exe PID 1100 wrote to memory of 1916 1100 64e3a0b3d39e61ab529cc4f9a7528d1d.exe logagent.exe PID 1100 wrote to memory of 1916 1100 64e3a0b3d39e61ab529cc4f9a7528d1d.exe logagent.exe PID 1100 wrote to memory of 1916 1100 64e3a0b3d39e61ab529cc4f9a7528d1d.exe logagent.exe PID 1100 wrote to memory of 1916 1100 64e3a0b3d39e61ab529cc4f9a7528d1d.exe logagent.exe PID 1100 wrote to memory of 1916 1100 64e3a0b3d39e61ab529cc4f9a7528d1d.exe logagent.exe PID 1100 wrote to memory of 1916 1100 64e3a0b3d39e61ab529cc4f9a7528d1d.exe logagent.exe PID 1100 wrote to memory of 1916 1100 64e3a0b3d39e61ab529cc4f9a7528d1d.exe logagent.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\64e3a0b3d39e61ab529cc4f9a7528d1d.exe"C:\Users\Admin\AppData\Local\Temp\64e3a0b3d39e61ab529cc4f9a7528d1d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1100-64-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1100-65-0x0000000075C71000-0x0000000075C73000-memory.dmpFilesize
8KB
-
memory/1916-66-0x0000000000000000-mapping.dmp
-
memory/1916-69-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/1916-68-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB
-
memory/1916-70-0x0000000010590000-0x000000001060C000-memory.dmpFilesize
496KB
-
memory/1916-71-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1916-72-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB