Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
19-01-2022 18:17
Static task
static1
Behavioral task
behavioral1
Sample
Order 1.19.22.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
Order 1.19.22.exe
Resource
win10v2004-en-20220112
General
-
Target
Order 1.19.22.exe
-
Size
814KB
-
MD5
71ac65d6674034d67719875d94473dbd
-
SHA1
da0ed336c9ecb3374238ddb4d1f5fb798cf6cada
-
SHA256
fe62a7a3e86391e95bbfe46c669fa2ce372d911053342787c9f22f7287c94521
-
SHA512
0cf9b21fefbdedb5b698c615786e42e488e6f3e98bd0db20a03fb9834de301a1ecba13dfef49f2441c7402ef0e22621ed8092ab60b0b9d21bf4d09cb4413e0d4
Malware Config
Extracted
remcos
3.2.1 Pro
RemoteHost
janeilla.myddns.me:9711
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-YDT8HI
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Order 1.19.22.exedescription pid process target process PID 1740 set thread context of 3928 1740 Order 1.19.22.exe Order 1.19.22.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Order 1.19.22.exedescription pid process target process PID 1740 wrote to memory of 3928 1740 Order 1.19.22.exe Order 1.19.22.exe PID 1740 wrote to memory of 3928 1740 Order 1.19.22.exe Order 1.19.22.exe PID 1740 wrote to memory of 3928 1740 Order 1.19.22.exe Order 1.19.22.exe PID 1740 wrote to memory of 3928 1740 Order 1.19.22.exe Order 1.19.22.exe PID 1740 wrote to memory of 3928 1740 Order 1.19.22.exe Order 1.19.22.exe PID 1740 wrote to memory of 3928 1740 Order 1.19.22.exe Order 1.19.22.exe PID 1740 wrote to memory of 3928 1740 Order 1.19.22.exe Order 1.19.22.exe PID 1740 wrote to memory of 3928 1740 Order 1.19.22.exe Order 1.19.22.exe PID 1740 wrote to memory of 3928 1740 Order 1.19.22.exe Order 1.19.22.exe PID 1740 wrote to memory of 3928 1740 Order 1.19.22.exe Order 1.19.22.exe PID 1740 wrote to memory of 3928 1740 Order 1.19.22.exe Order 1.19.22.exe PID 1740 wrote to memory of 3928 1740 Order 1.19.22.exe Order 1.19.22.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order 1.19.22.exe"C:\Users\Admin\AppData\Local\Temp\Order 1.19.22.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order 1.19.22.exe"C:\Users\Admin\AppData\Local\Temp\Order 1.19.22.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1740-130-0x0000000000760000-0x0000000000834000-memory.dmpFilesize
848KB
-
memory/1740-131-0x0000000005750000-0x0000000005CF4000-memory.dmpFilesize
5.6MB
-
memory/1740-132-0x0000000005240000-0x00000000052D2000-memory.dmpFilesize
584KB
-
memory/1740-133-0x00000000051F0000-0x00000000051FA000-memory.dmpFilesize
40KB
-
memory/1740-134-0x00000000051A0000-0x0000000005744000-memory.dmpFilesize
5.6MB
-
memory/1740-135-0x0000000007710000-0x00000000077AC000-memory.dmpFilesize
624KB
-
memory/3928-136-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/3928-137-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB