Analysis
-
max time kernel
152s -
max time network
195s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
15-09-2021 06:51
Static task
static1
Behavioral task
behavioral1
Sample
265e318e8b0b5a8ccc590c20a5e9ab9b.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
265e318e8b0b5a8ccc590c20a5e9ab9b.exe
Resource
win10-en
General
-
Target
265e318e8b0b5a8ccc590c20a5e9ab9b.exe
-
Size
917KB
-
MD5
265e318e8b0b5a8ccc590c20a5e9ab9b
-
SHA1
4617044cfb01f8826ba6813b245b71c9d7753987
-
SHA256
bb269eaeeea17647477215cd7f690f204664bcdf39c14a38ac2f393eafb4b1a6
-
SHA512
aaf9353354f8cd1471cb7aa752c4e5f353e14c6c820dd6dcac3fb7a554d94b091b322a3f8ac14a47a42c88cd32e8278eca602036e783354430d2918b772f7d01
Malware Config
Extracted
remcos
3.2.0 Pro
RemoteHost
freelife.hopto.org:2404
freelife1.hopto.org:2404
freelife2.hopto.org:2404
freelife01.hopto.org:2404
freelife3.hopto.org:2404
freelife4.hopto.org:2404
freelife5.hopto.org:2404
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
pastananiceforwhat-QQD2AI
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
265e318e8b0b5a8ccc590c20a5e9ab9b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Uhexymko = "C:\\Users\\Public\\Libraries\\okmyxehU.url" 265e318e8b0b5a8ccc590c20a5e9ab9b.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
265e318e8b0b5a8ccc590c20a5e9ab9b.exedescription pid process target process PID 1016 wrote to memory of 552 1016 265e318e8b0b5a8ccc590c20a5e9ab9b.exe logagent.exe PID 1016 wrote to memory of 552 1016 265e318e8b0b5a8ccc590c20a5e9ab9b.exe logagent.exe PID 1016 wrote to memory of 552 1016 265e318e8b0b5a8ccc590c20a5e9ab9b.exe logagent.exe PID 1016 wrote to memory of 552 1016 265e318e8b0b5a8ccc590c20a5e9ab9b.exe logagent.exe PID 1016 wrote to memory of 552 1016 265e318e8b0b5a8ccc590c20a5e9ab9b.exe logagent.exe PID 1016 wrote to memory of 552 1016 265e318e8b0b5a8ccc590c20a5e9ab9b.exe logagent.exe PID 1016 wrote to memory of 552 1016 265e318e8b0b5a8ccc590c20a5e9ab9b.exe logagent.exe PID 1016 wrote to memory of 552 1016 265e318e8b0b5a8ccc590c20a5e9ab9b.exe logagent.exe PID 1016 wrote to memory of 552 1016 265e318e8b0b5a8ccc590c20a5e9ab9b.exe logagent.exe PID 1016 wrote to memory of 552 1016 265e318e8b0b5a8ccc590c20a5e9ab9b.exe logagent.exe PID 1016 wrote to memory of 552 1016 265e318e8b0b5a8ccc590c20a5e9ab9b.exe logagent.exe PID 1016 wrote to memory of 552 1016 265e318e8b0b5a8ccc590c20a5e9ab9b.exe logagent.exe PID 1016 wrote to memory of 552 1016 265e318e8b0b5a8ccc590c20a5e9ab9b.exe logagent.exe PID 1016 wrote to memory of 552 1016 265e318e8b0b5a8ccc590c20a5e9ab9b.exe logagent.exe PID 1016 wrote to memory of 552 1016 265e318e8b0b5a8ccc590c20a5e9ab9b.exe logagent.exe PID 1016 wrote to memory of 552 1016 265e318e8b0b5a8ccc590c20a5e9ab9b.exe logagent.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\265e318e8b0b5a8ccc590c20a5e9ab9b.exe"C:\Users\Admin\AppData\Local\Temp\265e318e8b0b5a8ccc590c20a5e9ab9b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/552-66-0x0000000000000000-mapping.dmp
-
memory/552-69-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/552-68-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/552-71-0x0000000000340000-0x00000000003B9000-memory.dmpFilesize
484KB
-
memory/552-70-0x0000000010590000-0x000000001060C000-memory.dmpFilesize
496KB
-
memory/552-72-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/1016-64-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1016-65-0x0000000075211000-0x0000000075213000-memory.dmpFilesize
8KB