Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
27-01-2022 15:04
Static task
static1
Behavioral task
behavioral1
Sample
teexture.exe
Resource
win7-en-20211208
General
-
Target
teexture.exe
-
Size
1024KB
-
MD5
484b0fbe9dcf3de6026aa52b3f26aadf
-
SHA1
53f6c84d89a923127927091d5b0b212845b68f6e
-
SHA256
9d8522fac577756511fd093a7e4f5fd2732e33764b07237b13b770ae79bb9361
-
SHA512
f0ddb4d865ae383b697c9899977b25eb811c409c3afaa9f00cc1bd8031b24b28947bb52fc8a0fe43432e72ea3b2ce3d909dde26d1dba16691813b995d75e680a
Malware Config
Extracted
remcos
3.3.2 Pro
FF-FG
issacc.duckdns.org:30288
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
sms-audio
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
medi-re4vgt-R8LRUI
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
texture.exetexture.exepid process 364 texture.exe 1116 texture.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
teexture.exetexture.exetexture.exedescription pid process target process PID 1648 set thread context of 320 1648 teexture.exe AppLaunch.exe PID 364 set thread context of 1880 364 texture.exe AppLaunch.exe PID 1116 set thread context of 1664 1116 texture.exe AppLaunch.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1352 schtasks.exe 960 schtasks.exe 1696 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
teexture.exetexture.exetexture.exedescription pid process Token: SeDebugPrivilege 1648 teexture.exe Token: 33 1648 teexture.exe Token: SeIncBasePriorityPrivilege 1648 teexture.exe Token: SeDebugPrivilege 364 texture.exe Token: 33 364 texture.exe Token: SeIncBasePriorityPrivilege 364 texture.exe Token: SeDebugPrivilege 1116 texture.exe Token: 33 1116 texture.exe Token: SeIncBasePriorityPrivilege 1116 texture.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
AppLaunch.exepid process 320 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
teexture.execmd.exetaskeng.exetexture.execmd.exedescription pid process target process PID 1648 wrote to memory of 320 1648 teexture.exe AppLaunch.exe PID 1648 wrote to memory of 320 1648 teexture.exe AppLaunch.exe PID 1648 wrote to memory of 320 1648 teexture.exe AppLaunch.exe PID 1648 wrote to memory of 320 1648 teexture.exe AppLaunch.exe PID 1648 wrote to memory of 320 1648 teexture.exe AppLaunch.exe PID 1648 wrote to memory of 320 1648 teexture.exe AppLaunch.exe PID 1648 wrote to memory of 320 1648 teexture.exe AppLaunch.exe PID 1648 wrote to memory of 320 1648 teexture.exe AppLaunch.exe PID 1648 wrote to memory of 320 1648 teexture.exe AppLaunch.exe PID 1648 wrote to memory of 320 1648 teexture.exe AppLaunch.exe PID 1648 wrote to memory of 320 1648 teexture.exe AppLaunch.exe PID 1648 wrote to memory of 320 1648 teexture.exe AppLaunch.exe PID 1648 wrote to memory of 320 1648 teexture.exe AppLaunch.exe PID 1648 wrote to memory of 320 1648 teexture.exe AppLaunch.exe PID 1648 wrote to memory of 320 1648 teexture.exe AppLaunch.exe PID 1648 wrote to memory of 320 1648 teexture.exe AppLaunch.exe PID 1648 wrote to memory of 564 1648 teexture.exe cmd.exe PID 1648 wrote to memory of 564 1648 teexture.exe cmd.exe PID 1648 wrote to memory of 564 1648 teexture.exe cmd.exe PID 1648 wrote to memory of 564 1648 teexture.exe cmd.exe PID 1648 wrote to memory of 620 1648 teexture.exe cmd.exe PID 1648 wrote to memory of 620 1648 teexture.exe cmd.exe PID 1648 wrote to memory of 620 1648 teexture.exe cmd.exe PID 1648 wrote to memory of 620 1648 teexture.exe cmd.exe PID 564 wrote to memory of 960 564 cmd.exe schtasks.exe PID 564 wrote to memory of 960 564 cmd.exe schtasks.exe PID 564 wrote to memory of 960 564 cmd.exe schtasks.exe PID 564 wrote to memory of 960 564 cmd.exe schtasks.exe PID 1164 wrote to memory of 364 1164 taskeng.exe texture.exe PID 1164 wrote to memory of 364 1164 taskeng.exe texture.exe PID 1164 wrote to memory of 364 1164 taskeng.exe texture.exe PID 1164 wrote to memory of 364 1164 taskeng.exe texture.exe PID 1164 wrote to memory of 364 1164 taskeng.exe texture.exe PID 1164 wrote to memory of 364 1164 taskeng.exe texture.exe PID 1164 wrote to memory of 364 1164 taskeng.exe texture.exe PID 364 wrote to memory of 1880 364 texture.exe AppLaunch.exe PID 364 wrote to memory of 1880 364 texture.exe AppLaunch.exe PID 364 wrote to memory of 1880 364 texture.exe AppLaunch.exe PID 364 wrote to memory of 1880 364 texture.exe AppLaunch.exe PID 364 wrote to memory of 1880 364 texture.exe AppLaunch.exe PID 364 wrote to memory of 1880 364 texture.exe AppLaunch.exe PID 364 wrote to memory of 1880 364 texture.exe AppLaunch.exe PID 364 wrote to memory of 1880 364 texture.exe AppLaunch.exe PID 364 wrote to memory of 1880 364 texture.exe AppLaunch.exe PID 364 wrote to memory of 1880 364 texture.exe AppLaunch.exe PID 364 wrote to memory of 1880 364 texture.exe AppLaunch.exe PID 364 wrote to memory of 1880 364 texture.exe AppLaunch.exe PID 364 wrote to memory of 1880 364 texture.exe AppLaunch.exe PID 364 wrote to memory of 1880 364 texture.exe AppLaunch.exe PID 364 wrote to memory of 1880 364 texture.exe AppLaunch.exe PID 364 wrote to memory of 1880 364 texture.exe AppLaunch.exe PID 364 wrote to memory of 2028 364 texture.exe cmd.exe PID 364 wrote to memory of 2028 364 texture.exe cmd.exe PID 364 wrote to memory of 2028 364 texture.exe cmd.exe PID 364 wrote to memory of 2028 364 texture.exe cmd.exe PID 364 wrote to memory of 1924 364 texture.exe cmd.exe PID 364 wrote to memory of 1924 364 texture.exe cmd.exe PID 364 wrote to memory of 1924 364 texture.exe cmd.exe PID 364 wrote to memory of 1924 364 texture.exe cmd.exe PID 2028 wrote to memory of 1696 2028 cmd.exe schtasks.exe PID 2028 wrote to memory of 1696 2028 cmd.exe schtasks.exe PID 2028 wrote to memory of 1696 2028 cmd.exe schtasks.exe PID 2028 wrote to memory of 1696 2028 cmd.exe schtasks.exe PID 1164 wrote to memory of 1116 1164 taskeng.exe texture.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\teexture.exe"C:\Users\Admin\AppData\Local\Temp\teexture.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\Admin\AppData\Local\Temp\texture.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\Admin\AppData\Local\Temp\texture.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\teexture.exe" "C:\Users\Admin\AppData\Local\Temp\texture.exe"2⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {82007533-C33B-42AB-8618-FE7BD6A637B4} S-1-5-21-2329389628-4064185017-3901522362-1000:QSKGHMYQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\texture.exeC:\Users\Admin\AppData\Local\Temp\texture.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\Admin\AppData\Local\Temp\texture.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\Admin\AppData\Local\Temp\texture.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\texture.exe" "C:\Users\Admin\AppData\Local\Temp\texture.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\texture.exeC:\Users\Admin\AppData\Local\Temp\texture.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\Admin\AppData\Local\Temp\texture.exe'" /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\Admin\AppData\Local\Temp\texture.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\texture.exe" "C:\Users\Admin\AppData\Local\Temp\texture.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\texture.exeMD5
484b0fbe9dcf3de6026aa52b3f26aadf
SHA153f6c84d89a923127927091d5b0b212845b68f6e
SHA2569d8522fac577756511fd093a7e4f5fd2732e33764b07237b13b770ae79bb9361
SHA512f0ddb4d865ae383b697c9899977b25eb811c409c3afaa9f00cc1bd8031b24b28947bb52fc8a0fe43432e72ea3b2ce3d909dde26d1dba16691813b995d75e680a
-
C:\Users\Admin\AppData\Local\Temp\texture.exeMD5
484b0fbe9dcf3de6026aa52b3f26aadf
SHA153f6c84d89a923127927091d5b0b212845b68f6e
SHA2569d8522fac577756511fd093a7e4f5fd2732e33764b07237b13b770ae79bb9361
SHA512f0ddb4d865ae383b697c9899977b25eb811c409c3afaa9f00cc1bd8031b24b28947bb52fc8a0fe43432e72ea3b2ce3d909dde26d1dba16691813b995d75e680a
-
C:\Users\Admin\AppData\Local\Temp\texture.exeMD5
484b0fbe9dcf3de6026aa52b3f26aadf
SHA153f6c84d89a923127927091d5b0b212845b68f6e
SHA2569d8522fac577756511fd093a7e4f5fd2732e33764b07237b13b770ae79bb9361
SHA512f0ddb4d865ae383b697c9899977b25eb811c409c3afaa9f00cc1bd8031b24b28947bb52fc8a0fe43432e72ea3b2ce3d909dde26d1dba16691813b995d75e680a
-
memory/320-67-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/320-70-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/320-60-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/320-61-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/320-62-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/320-63-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/320-64-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/320-65-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/320-66-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/320-59-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/320-69-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/364-73-0x00000000002C0000-0x0000000000350000-memory.dmpFilesize
576KB
-
memory/364-83-0x0000000001FA0000-0x0000000001FA1000-memory.dmpFilesize
4KB
-
memory/1116-89-0x0000000000C70000-0x0000000000D00000-memory.dmpFilesize
576KB
-
memory/1116-99-0x00000000048E0000-0x00000000048E1000-memory.dmpFilesize
4KB
-
memory/1648-55-0x0000000000AA0000-0x0000000000B30000-memory.dmpFilesize
576KB
-
memory/1648-58-0x00000000009D0000-0x00000000009D1000-memory.dmpFilesize
4KB
-
memory/1648-57-0x0000000004AF0000-0x0000000004B68000-memory.dmpFilesize
480KB
-
memory/1648-56-0x0000000075DF1000-0x0000000075DF3000-memory.dmpFilesize
8KB
-
memory/1664-103-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1880-87-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB