Analysis
-
max time kernel
150s -
max time network
160s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
21-10-2021 13:54
Static task
static1
Behavioral task
behavioral1
Sample
BANKSLIP.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
BANKSLIP.exe
Resource
win10-en-20210920
General
-
Target
BANKSLIP.exe
-
Size
726KB
-
MD5
fdd9b67bd04d1768858f095d90d5dc88
-
SHA1
07c81bd427eecbd130e52351d99432b16bdc8d2e
-
SHA256
3536f79b815a6d77e371df48abaec315c92ccec6e197e547440fa66629edd640
-
SHA512
4356e6c1ad77ecb750ce4d720521da2113f69f6dfed113c306a0ef6681512cb356c39ecd1d0917d55990efbb7e8abfb796d48c0a77bb0742c75c480777a2b491
Malware Config
Extracted
remcos
3.3.0 Pro
RemoteHost
172.94.88.26:3033
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-FFP6U6
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
BANKSLIP.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion BANKSLIP.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion BANKSLIP.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
BANKSLIP.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum BANKSLIP.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 BANKSLIP.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
BANKSLIP.exedescription pid process target process PID 3040 set thread context of 360 3040 BANKSLIP.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 4504 powershell.exe 4504 powershell.exe 4504 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4504 powershell.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
BANKSLIP.exedescription pid process target process PID 3040 wrote to memory of 4504 3040 BANKSLIP.exe powershell.exe PID 3040 wrote to memory of 4504 3040 BANKSLIP.exe powershell.exe PID 3040 wrote to memory of 4504 3040 BANKSLIP.exe powershell.exe PID 3040 wrote to memory of 360 3040 BANKSLIP.exe RegSvcs.exe PID 3040 wrote to memory of 360 3040 BANKSLIP.exe RegSvcs.exe PID 3040 wrote to memory of 360 3040 BANKSLIP.exe RegSvcs.exe PID 3040 wrote to memory of 360 3040 BANKSLIP.exe RegSvcs.exe PID 3040 wrote to memory of 360 3040 BANKSLIP.exe RegSvcs.exe PID 3040 wrote to memory of 360 3040 BANKSLIP.exe RegSvcs.exe PID 3040 wrote to memory of 360 3040 BANKSLIP.exe RegSvcs.exe PID 3040 wrote to memory of 360 3040 BANKSLIP.exe RegSvcs.exe PID 3040 wrote to memory of 360 3040 BANKSLIP.exe RegSvcs.exe PID 3040 wrote to memory of 360 3040 BANKSLIP.exe RegSvcs.exe PID 3040 wrote to memory of 360 3040 BANKSLIP.exe RegSvcs.exe PID 3040 wrote to memory of 360 3040 BANKSLIP.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BANKSLIP.exe"C:\Users\Admin\AppData\Local\Temp\BANKSLIP.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\BANKSLIP.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/360-130-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/360-140-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/360-131-0x000000000042FC39-mapping.dmp
-
memory/3040-117-0x0000000005CE0000-0x0000000005CE1000-memory.dmpFilesize
4KB
-
memory/3040-118-0x0000000005880000-0x0000000005881000-memory.dmpFilesize
4KB
-
memory/3040-119-0x0000000005930000-0x0000000005931000-memory.dmpFilesize
4KB
-
memory/3040-120-0x0000000005C30000-0x0000000005C37000-memory.dmpFilesize
28KB
-
memory/3040-121-0x00000000057E0000-0x0000000005CDE000-memory.dmpFilesize
5.0MB
-
memory/3040-122-0x0000000006600000-0x0000000006601000-memory.dmpFilesize
4KB
-
memory/3040-123-0x0000000006740000-0x00000000067D5000-memory.dmpFilesize
596KB
-
memory/3040-125-0x0000000006860000-0x0000000006861000-memory.dmpFilesize
4KB
-
memory/3040-115-0x0000000000F90000-0x0000000000F91000-memory.dmpFilesize
4KB
-
memory/4504-132-0x0000000007120000-0x0000000007121000-memory.dmpFilesize
4KB
-
memory/4504-138-0x0000000006C20000-0x0000000006C21000-memory.dmpFilesize
4KB
-
memory/4504-128-0x00000000044E0000-0x00000000044E1000-memory.dmpFilesize
4KB
-
memory/4504-127-0x0000000000D30000-0x0000000000D31000-memory.dmpFilesize
4KB
-
memory/4504-126-0x0000000000D30000-0x0000000000D31000-memory.dmpFilesize
4KB
-
memory/4504-133-0x0000000007150000-0x0000000007151000-memory.dmpFilesize
4KB
-
memory/4504-135-0x0000000007890000-0x0000000007891000-memory.dmpFilesize
4KB
-
memory/4504-136-0x0000000007BE0000-0x0000000007BE1000-memory.dmpFilesize
4KB
-
memory/4504-137-0x00000000080B0000-0x00000000080B1000-memory.dmpFilesize
4KB
-
memory/4504-129-0x0000000007260000-0x0000000007261000-memory.dmpFilesize
4KB
-
memory/4504-139-0x0000000006C22000-0x0000000006C23000-memory.dmpFilesize
4KB
-
memory/4504-124-0x0000000000000000-mapping.dmp
-
memory/4504-141-0x0000000007F70000-0x0000000007F71000-memory.dmpFilesize
4KB
-
memory/4504-142-0x0000000000D30000-0x0000000000D31000-memory.dmpFilesize
4KB
-
memory/4504-149-0x0000000008FC0000-0x0000000008FF3000-memory.dmpFilesize
204KB
-
memory/4504-156-0x0000000008F80000-0x0000000008F81000-memory.dmpFilesize
4KB
-
memory/4504-161-0x00000000090F0000-0x00000000090F1000-memory.dmpFilesize
4KB
-
memory/4504-162-0x00000000092C0000-0x00000000092C1000-memory.dmpFilesize
4KB
-
memory/4504-231-0x000000007F450000-0x000000007F451000-memory.dmpFilesize
4KB
-
memory/4504-232-0x0000000006C23000-0x0000000006C24000-memory.dmpFilesize
4KB