Analysis
-
max time kernel
151s -
max time network
161s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
25-01-2022 21:12
Static task
static1
Behavioral task
behavioral1
Sample
CITAPDFRES743960001 CITAPDFRES743960007.exe
Resource
win7-en-20211208
General
-
Target
CITAPDFRES743960001 CITAPDFRES743960007.exe
-
Size
589KB
-
MD5
80d706aa41da2983dc3b80782e22dfaa
-
SHA1
0e6f43dbceae22222d09f5d7848aa4f24ee42c44
-
SHA256
2161a41e36c0bb939dc0203f9e1ada84addcef0e2f31905fad860e16c7603c88
-
SHA512
a8ece67856b180449d16ce98d7c627a1f02a854b6fff2bd03aa72e0119d1d64f3f68f0d4bcd345ff1248c534c9478cce808046230312d30fea09aa3897d80c04
Malware Config
Extracted
remcos
2.7.0 Pro
9
pruebanue97382.duckdns.org:1718
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-B5WISH
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
CITAPDFRES743960001 CITAPDFRES743960007.exedescription pid process target process PID 1664 set thread context of 1928 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
CITAPDFRES743960001 CITAPDFRES743960007.exepid process 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
CITAPDFRES743960001 CITAPDFRES743960007.exedescription pid process Token: SeDebugPrivilege 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 1928 RegSvcs.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
CITAPDFRES743960001 CITAPDFRES743960007.exedescription pid process target process PID 1664 wrote to memory of 292 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe schtasks.exe PID 1664 wrote to memory of 292 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe schtasks.exe PID 1664 wrote to memory of 292 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe schtasks.exe PID 1664 wrote to memory of 292 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe schtasks.exe PID 1664 wrote to memory of 1076 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1076 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1076 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1076 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1076 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1076 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1076 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1548 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1548 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1548 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1548 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1548 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1548 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1548 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1928 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1928 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1928 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1928 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1928 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1928 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1928 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1928 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1928 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1928 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1928 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1928 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1928 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 1664 wrote to memory of 1928 1664 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CITAPDFRES743960001 CITAPDFRES743960007.exe"C:\Users\Admin\AppData\Local\Temp\CITAPDFRES743960001 CITAPDFRES743960007.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dmRXApqOj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE418.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpE418.tmpMD5
bf453668a6a25b46d8f7eb523044e4ee
SHA18d4c98574a05400dc2004d36b0e0ee7b220bf82e
SHA2569f0df3098eb8176b7a967ea5a48b3d129f525b84f5c40b97b12faca41092771a
SHA512f143921bdcab040d9cb306e6122f4997b5482e80b7facb17c6573b3a210db42eb318939a0ff3333b896a9396fc4d2c0e226c84765beb87be6f922ddc26b05434
-
memory/1664-54-0x0000000001120000-0x00000000011BA000-memory.dmpFilesize
616KB
-
memory/1664-55-0x00000000754B1000-0x00000000754B3000-memory.dmpFilesize
8KB
-
memory/1664-56-0x0000000000D50000-0x0000000000D51000-memory.dmpFilesize
4KB
-
memory/1664-57-0x0000000000410000-0x000000000041A000-memory.dmpFilesize
40KB
-
memory/1664-58-0x0000000006120000-0x0000000006194000-memory.dmpFilesize
464KB
-
memory/1664-59-0x0000000000D00000-0x0000000000D26000-memory.dmpFilesize
152KB
-
memory/1928-62-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1928-61-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1928-63-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1928-64-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1928-65-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1928-66-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1928-67-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1928-69-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1928-70-0x0000000000401000-0x0000000000421000-memory.dmpFilesize
128KB