Analysis
-
max time kernel
152s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
20-01-2022 10:27
Static task
static1
Behavioral task
behavioral1
Sample
IMG_4100047645799946532.scr
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
IMG_4100047645799946532.scr
Resource
win10v2004-en-20220112
General
-
Target
IMG_4100047645799946532.scr
-
Size
928KB
-
MD5
afd35e9511ec398191a4027c5db6e5a6
-
SHA1
2e70c2033b5f07ff3ca69ba396080e10b240f810
-
SHA256
ddfc4415217ec461350071b0965a1132ad43472bdc15980da23c46d8f1da188e
-
SHA512
c10e70576273ff6022a8403fad2833be6b2eff43d648117e5111b8aa76cd69ec4c3a742ce22257f62cc9b38652c2cf608dd31b55830bff22cd651a4f7dcb784f
Malware Config
Extracted
remcos
3.3.2 Pro
RemoteHost
flatbar21004.duckdns.org:7810
playtime40098.ddns.net:7810
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
comres-ISTZOF
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
Sets service image path in registry 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
IMG_4100047645799946532.scrdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Nwcxcxffke = "C:\\Users\\Admin\\Contacts\\ekffxcxcwN.url" IMG_4100047645799946532.scr -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
IMG_4100047645799946532.scrdescription pid process target process PID 2236 wrote to memory of 2432 2236 IMG_4100047645799946532.scr logagent.exe PID 2236 wrote to memory of 2432 2236 IMG_4100047645799946532.scr logagent.exe PID 2236 wrote to memory of 2432 2236 IMG_4100047645799946532.scr logagent.exe PID 2236 wrote to memory of 2432 2236 IMG_4100047645799946532.scr logagent.exe PID 2236 wrote to memory of 2432 2236 IMG_4100047645799946532.scr logagent.exe PID 2236 wrote to memory of 2432 2236 IMG_4100047645799946532.scr logagent.exe PID 2236 wrote to memory of 2432 2236 IMG_4100047645799946532.scr logagent.exe PID 2236 wrote to memory of 2432 2236 IMG_4100047645799946532.scr logagent.exe PID 2236 wrote to memory of 2432 2236 IMG_4100047645799946532.scr logagent.exe PID 2236 wrote to memory of 2432 2236 IMG_4100047645799946532.scr logagent.exe PID 2236 wrote to memory of 2432 2236 IMG_4100047645799946532.scr logagent.exe PID 2236 wrote to memory of 2432 2236 IMG_4100047645799946532.scr logagent.exe PID 2236 wrote to memory of 2432 2236 IMG_4100047645799946532.scr logagent.exe PID 2236 wrote to memory of 2432 2236 IMG_4100047645799946532.scr logagent.exe PID 2236 wrote to memory of 2432 2236 IMG_4100047645799946532.scr logagent.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IMG_4100047645799946532.scr"C:\Users\Admin\AppData\Local\Temp\IMG_4100047645799946532.scr" /S1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe2⤵
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 7d97cd7a1ee89ec0d0e2fb02f2edb7de omc2//L2GE+ip2xL58nQkA.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2236-130-0x0000000002280000-0x0000000002281000-memory.dmpFilesize
4KB
-
memory/2432-283-0x0000000002B10000-0x0000000002B11000-memory.dmpFilesize
4KB
-
memory/2432-282-0x0000000002BD0000-0x0000000002BD1000-memory.dmpFilesize
4KB
-
memory/2432-284-0x0000000002B70000-0x0000000002B71000-memory.dmpFilesize
4KB
-
memory/2432-285-0x0000000072600000-0x000000007267E000-memory.dmpFilesize
504KB
-
memory/2432-288-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB