Analysis
-
max time kernel
154s -
max time network
154s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 21:12
Static task
static1
Behavioral task
behavioral1
Sample
CITAPDFRES743960001 CITAPDFRES743960007.exe
Resource
win7-en-20211208
General
-
Target
CITAPDFRES743960001 CITAPDFRES743960007.exe
-
Size
589KB
-
MD5
80d706aa41da2983dc3b80782e22dfaa
-
SHA1
0e6f43dbceae22222d09f5d7848aa4f24ee42c44
-
SHA256
2161a41e36c0bb939dc0203f9e1ada84addcef0e2f31905fad860e16c7603c88
-
SHA512
a8ece67856b180449d16ce98d7c627a1f02a854b6fff2bd03aa72e0119d1d64f3f68f0d4bcd345ff1248c534c9478cce808046230312d30fea09aa3897d80c04
Malware Config
Extracted
remcos
2.7.0 Pro
9
pruebanue97382.duckdns.org:1718
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-B5WISH
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
CITAPDFRES743960001 CITAPDFRES743960007.exedescription pid process target process PID 3792 set thread context of 412 3792 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
CITAPDFRES743960001 CITAPDFRES743960007.exepid process 3792 CITAPDFRES743960001 CITAPDFRES743960007.exe 3792 CITAPDFRES743960001 CITAPDFRES743960007.exe 3792 CITAPDFRES743960001 CITAPDFRES743960007.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
CITAPDFRES743960001 CITAPDFRES743960007.exedescription pid process Token: SeDebugPrivilege 3792 CITAPDFRES743960001 CITAPDFRES743960007.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 412 RegSvcs.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
CITAPDFRES743960001 CITAPDFRES743960007.exedescription pid process target process PID 3792 wrote to memory of 3744 3792 CITAPDFRES743960001 CITAPDFRES743960007.exe schtasks.exe PID 3792 wrote to memory of 3744 3792 CITAPDFRES743960001 CITAPDFRES743960007.exe schtasks.exe PID 3792 wrote to memory of 3744 3792 CITAPDFRES743960001 CITAPDFRES743960007.exe schtasks.exe PID 3792 wrote to memory of 1940 3792 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 3792 wrote to memory of 1940 3792 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 3792 wrote to memory of 1940 3792 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 3792 wrote to memory of 412 3792 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 3792 wrote to memory of 412 3792 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 3792 wrote to memory of 412 3792 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 3792 wrote to memory of 412 3792 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 3792 wrote to memory of 412 3792 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 3792 wrote to memory of 412 3792 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 3792 wrote to memory of 412 3792 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 3792 wrote to memory of 412 3792 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 3792 wrote to memory of 412 3792 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe PID 3792 wrote to memory of 412 3792 CITAPDFRES743960001 CITAPDFRES743960007.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CITAPDFRES743960001 CITAPDFRES743960007.exe"C:\Users\Admin\AppData\Local\Temp\CITAPDFRES743960001 CITAPDFRES743960007.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dmRXApqOj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC83E.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC83E.tmpMD5
70f26d13b1357fcddcfabc185a3dce19
SHA1415ce2024cf234064b100f6717391da0e974e78c
SHA256714a4f69bfd845bc559c6293b89f36e103d213f1764efc783880ca6bfd442837
SHA51235995b6894226ef096c11546ff62661d0bdf40c3b7f8b978d99c5ac3071c8237265502e5d952f4c61d5d97a3e868e4b5efc4f2a4f2c040cd454f8b7b1b61313f
-
memory/412-127-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/412-126-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/3792-121-0x0000000004F60000-0x0000000004FB6000-memory.dmpFilesize
344KB
-
memory/3792-119-0x0000000004E50000-0x000000000534E000-memory.dmpFilesize
5.0MB
-
memory/3792-120-0x0000000004D70000-0x0000000004D7A000-memory.dmpFilesize
40KB
-
memory/3792-115-0x0000000000410000-0x00000000004AA000-memory.dmpFilesize
616KB
-
memory/3792-122-0x00000000052D0000-0x00000000052DA000-memory.dmpFilesize
40KB
-
memory/3792-123-0x00000000088B0000-0x0000000008924000-memory.dmpFilesize
464KB
-
memory/3792-124-0x000000000B090000-0x000000000B0B6000-memory.dmpFilesize
152KB
-
memory/3792-118-0x0000000004E50000-0x0000000004EE2000-memory.dmpFilesize
584KB
-
memory/3792-117-0x0000000005350000-0x000000000584E000-memory.dmpFilesize
5.0MB
-
memory/3792-116-0x0000000004DB0000-0x0000000004E4C000-memory.dmpFilesize
624KB