Analysis
-
max time kernel
298s -
max time network
296s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
28-09-2021 18:58
Static task
static1
Behavioral task
behavioral1
Sample
olieki.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
olieki.exe
Resource
win10v20210408
General
-
Target
olieki.exe
-
Size
268KB
-
MD5
a63baaab947841c61e60e663c6209f80
-
SHA1
1f20c6525e42278f64303303468c13cf85ef5b4b
-
SHA256
c6a10b1d71d2aae9601572d3dba867bb8e5fbd435b41f3fa111cb89acc86774b
-
SHA512
021ec9ceebefdbc48b6ef86bc737534aae4cedbc0eff1198354bbe3cb8c7c6483e44ccf124466bd0d52931793aa114bff964b41b38ac5d773264a991c6bb9aae
Malware Config
Extracted
remcos
3.1.5 Pro
ORABANK
ns.atps-proximo.pt:2404
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%UserProfile%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
des
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
fes-MCZ4VD
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
olieki.exeieinstal.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe olieki.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe ieinstal.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ieinstal.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run ieinstal.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SYPHILIP = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ernringso\\olieki.exe" ieinstal.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
olieki.exeieinstal.exepid process 532 olieki.exe 4036 ieinstal.exe 4036 ieinstal.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
olieki.exedescription pid process target process PID 532 set thread context of 4036 532 olieki.exe ieinstal.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
olieki.exepid process 532 olieki.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
olieki.exeieinstal.exepid process 532 olieki.exe 4036 ieinstal.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
olieki.exedescription pid process target process PID 532 wrote to memory of 4036 532 olieki.exe ieinstal.exe PID 532 wrote to memory of 4036 532 olieki.exe ieinstal.exe PID 532 wrote to memory of 4036 532 olieki.exe ieinstal.exe PID 532 wrote to memory of 4036 532 olieki.exe ieinstal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\olieki.exe"C:\Users\Admin\AppData\Local\Temp\olieki.exe"1⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Users\Admin\AppData\Local\Temp\olieki.exe"2⤵
- Checks QEMU agent file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/532-116-0x0000000000620000-0x000000000062F000-memory.dmpFilesize
60KB
-
memory/532-118-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/532-117-0x00007FFB6BC10000-0x00007FFB6BDEB000-memory.dmpFilesize
1.9MB
-
memory/532-121-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/4036-119-0x0000000003200000-0x0000000003300000-memory.dmpFilesize
1024KB
-
memory/4036-120-0x0000000003200000-mapping.dmp
-
memory/4036-123-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/4036-122-0x00007FFB6BC10000-0x00007FFB6BDEB000-memory.dmpFilesize
1.9MB
-
memory/4036-124-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/4036-126-0x000000001EB80000-0x000000001EB81000-memory.dmpFilesize
4KB
-
memory/4036-127-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB