Analysis
-
max time kernel
159s -
max time network
156s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-01-2022 23:37
Static task
static1
Behavioral task
behavioral1
Sample
35d63d61f12598d5b85475f85cdad05bee0e0afb3c3e65799d1325a224ac66d5.exe
Resource
win7-en-20211208
General
-
Target
35d63d61f12598d5b85475f85cdad05bee0e0afb3c3e65799d1325a224ac66d5.exe
-
Size
405KB
-
MD5
607aacf94113248d45f31e2baba4136c
-
SHA1
7edb738018e0e91c257a6fc94bdba50daf899f90
-
SHA256
35d63d61f12598d5b85475f85cdad05bee0e0afb3c3e65799d1325a224ac66d5
-
SHA512
1ebf580afe38f02ccd6eb9b9875e62e610abf8d826595aaba895deffbab65dba61aba6170a34ffeeb81e4f221be4a4c8073db536ca40afd5731214b2961c1763
Malware Config
Extracted
remcos
2.7.0 Pro
28 AGOSTO
ruthy.qdp6fj1uji.xyz:2047
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
rcm
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-J3WQVO
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1820 rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
rundll32.exepid process 1820 rundll32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
rundll32.exepid process 1820 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
cmd.exepid process 2836 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
35d63d61f12598d5b85475f85cdad05bee0e0afb3c3e65799d1325a224ac66d5.exerundll32.exedescription pid process target process PID 2632 wrote to memory of 1820 2632 35d63d61f12598d5b85475f85cdad05bee0e0afb3c3e65799d1325a224ac66d5.exe rundll32.exe PID 2632 wrote to memory of 1820 2632 35d63d61f12598d5b85475f85cdad05bee0e0afb3c3e65799d1325a224ac66d5.exe rundll32.exe PID 2632 wrote to memory of 1820 2632 35d63d61f12598d5b85475f85cdad05bee0e0afb3c3e65799d1325a224ac66d5.exe rundll32.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe PID 1820 wrote to memory of 2836 1820 rundll32.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35d63d61f12598d5b85475f85cdad05bee0e0afb3c3e65799d1325a224ac66d5.exe"C:\Users\Admin\AppData\Local\Temp\35d63d61f12598d5b85475f85cdad05bee0e0afb3c3e65799d1325a224ac66d5.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe Galvanometry,Pickaninny2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\FirebugMD5
4a2aa776c3969ee16131b2ba39be9f88
SHA155fcc55cbcfdd5bef4d93089aec4945769868258
SHA2565eb32341334c7cde4bec546203b3262a5dbe61754a3178cc7d3771194ad8da4b
SHA5120cff449f3e90e6bf573e9d6f8e495512d6a16d5ef95bdae2f816058f345b4e6935360a0ceb83310664af38b2a2b1ebf5a7ac0b68a43e3819e349a8d225b10bf1
-
C:\Users\Admin\AppData\Local\Temp\Galvanometry.DLLMD5
bc2c79b3780c12c0d508b4fbf37ef15c
SHA15b2328a38ff40d57c78a8174ebdc9a7f5553c35f
SHA256c0852f62db36c97bb577b840dd58eafd4cd579d09114e2f5c5cbd5858378b598
SHA5129c73429153d6a9b546ff210ec1ef13d2302687992bab26192bb735e9557bec94fc4d6f2ba790afc32933277c1a720cd2015aa19e6522c00150f32fe95cc95136
-
\Users\Admin\AppData\Local\Temp\Galvanometry.dllMD5
bc2c79b3780c12c0d508b4fbf37ef15c
SHA15b2328a38ff40d57c78a8174ebdc9a7f5553c35f
SHA256c0852f62db36c97bb577b840dd58eafd4cd579d09114e2f5c5cbd5858378b598
SHA5129c73429153d6a9b546ff210ec1ef13d2302687992bab26192bb735e9557bec94fc4d6f2ba790afc32933277c1a720cd2015aa19e6522c00150f32fe95cc95136
-
memory/1820-121-0x0000000073630000-0x00000000736DD000-memory.dmpFilesize
692KB
-
memory/1820-122-0x0000000002EA0000-0x0000000002EA2000-memory.dmpFilesize
8KB
-
memory/1820-123-0x00000000741E0000-0x0000000074247000-memory.dmpFilesize
412KB
-
memory/1820-124-0x00007FFDB2F50000-0x00007FFDB312B000-memory.dmpFilesize
1.9MB
-
memory/2836-125-0x00000000775C9000-0x00000000775CA000-memory.dmpFilesize
4KB
-
memory/2836-131-0x00007FFDB2F50000-0x00007FFDB312B000-memory.dmpFilesize
1.9MB
-
memory/2836-141-0x00000000033C0000-0x00000000033C6000-memory.dmpFilesize
24KB
-
memory/2836-157-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB