Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
15-09-2021 06:52
Static task
static1
Behavioral task
behavioral1
Sample
9ca31c0977758f77bebfd4b77d0aafb5.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
9ca31c0977758f77bebfd4b77d0aafb5.exe
Resource
win10v20210408
General
-
Target
9ca31c0977758f77bebfd4b77d0aafb5.exe
-
Size
917KB
-
MD5
9ca31c0977758f77bebfd4b77d0aafb5
-
SHA1
8952680a883dcd8941b903ffdb2cc783f370967f
-
SHA256
02d8b132efe46479349be92ee105032ffb4f6451b9439b68df46f3049844db81
-
SHA512
750f8252dbba3adee099adf6c3035e4d08f31f15fac638f52c3bb188b66697ca7c0b2a359c2ce0e92718c8b0224ec1b4cf075daa23627ebd6491859f0152353f
Malware Config
Extracted
remcos
3.2.0 Pro
RemoteHost
freelife.hopto.org:2404
freelife1.hopto.org:2404
freelife2.hopto.org:2404
freelife01.hopto.org:2404
freelife3.hopto.org:2404
freelife4.hopto.org:2404
freelife5.hopto.org:2404
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
pastananiceforwhat-QQD2AI
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
9ca31c0977758f77bebfd4b77d0aafb5.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Uhexymko = "C:\\Users\\Public\\Libraries\\okmyxehU.url" 9ca31c0977758f77bebfd4b77d0aafb5.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
9ca31c0977758f77bebfd4b77d0aafb5.exedescription pid process target process PID 4796 wrote to memory of 4908 4796 9ca31c0977758f77bebfd4b77d0aafb5.exe dialer.exe PID 4796 wrote to memory of 4908 4796 9ca31c0977758f77bebfd4b77d0aafb5.exe dialer.exe PID 4796 wrote to memory of 4908 4796 9ca31c0977758f77bebfd4b77d0aafb5.exe dialer.exe PID 4796 wrote to memory of 4908 4796 9ca31c0977758f77bebfd4b77d0aafb5.exe dialer.exe PID 4796 wrote to memory of 4908 4796 9ca31c0977758f77bebfd4b77d0aafb5.exe dialer.exe PID 4796 wrote to memory of 4908 4796 9ca31c0977758f77bebfd4b77d0aafb5.exe dialer.exe PID 4796 wrote to memory of 4908 4796 9ca31c0977758f77bebfd4b77d0aafb5.exe dialer.exe PID 4796 wrote to memory of 4908 4796 9ca31c0977758f77bebfd4b77d0aafb5.exe dialer.exe PID 4796 wrote to memory of 4908 4796 9ca31c0977758f77bebfd4b77d0aafb5.exe dialer.exe PID 4796 wrote to memory of 4908 4796 9ca31c0977758f77bebfd4b77d0aafb5.exe dialer.exe PID 4796 wrote to memory of 4908 4796 9ca31c0977758f77bebfd4b77d0aafb5.exe dialer.exe PID 4796 wrote to memory of 4908 4796 9ca31c0977758f77bebfd4b77d0aafb5.exe dialer.exe PID 4796 wrote to memory of 4908 4796 9ca31c0977758f77bebfd4b77d0aafb5.exe dialer.exe PID 4796 wrote to memory of 4908 4796 9ca31c0977758f77bebfd4b77d0aafb5.exe dialer.exe PID 4796 wrote to memory of 4908 4796 9ca31c0977758f77bebfd4b77d0aafb5.exe dialer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ca31c0977758f77bebfd4b77d0aafb5.exe"C:\Users\Admin\AppData\Local\Temp\9ca31c0977758f77bebfd4b77d0aafb5.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dialer.exeC:\Windows\System32\dialer.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4796-118-0x00000000005B0000-0x00000000006FA000-memory.dmpFilesize
1.3MB
-
memory/4908-119-0x0000000000000000-mapping.dmp
-
memory/4908-121-0x0000000000800000-0x0000000000801000-memory.dmpFilesize
4KB
-
memory/4908-120-0x0000000000540000-0x0000000000541000-memory.dmpFilesize
4KB
-
memory/4908-123-0x0000000010590000-0x000000001060C000-memory.dmpFilesize
496KB
-
memory/4908-124-0x0000000000810000-0x0000000000889000-memory.dmpFilesize
484KB
-
memory/4908-122-0x00000000005A0000-0x00000000005A1000-memory.dmpFilesize
4KB