Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 15:04
Static task
static1
Behavioral task
behavioral1
Sample
teexture.exe
Resource
win7-en-20211208
General
-
Target
teexture.exe
-
Size
1024KB
-
MD5
484b0fbe9dcf3de6026aa52b3f26aadf
-
SHA1
53f6c84d89a923127927091d5b0b212845b68f6e
-
SHA256
9d8522fac577756511fd093a7e4f5fd2732e33764b07237b13b770ae79bb9361
-
SHA512
f0ddb4d865ae383b697c9899977b25eb811c409c3afaa9f00cc1bd8031b24b28947bb52fc8a0fe43432e72ea3b2ce3d909dde26d1dba16691813b995d75e680a
Malware Config
Extracted
remcos
3.3.2 Pro
FF-FG
issacc.duckdns.org:30288
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
sms-audio
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
medi-re4vgt-R8LRUI
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
texture.exetexture.exepid process 1012 texture.exe 3736 texture.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
teexture.exetexture.exetexture.exedescription pid process target process PID 2776 set thread context of 2892 2776 teexture.exe AppLaunch.exe PID 1012 set thread context of 376 1012 texture.exe AppLaunch.exe PID 3736 set thread context of 1784 3736 texture.exe AppLaunch.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2392 schtasks.exe 1332 schtasks.exe 2680 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
teexture.exetexture.exetexture.exedescription pid process Token: SeDebugPrivilege 2776 teexture.exe Token: 33 2776 teexture.exe Token: SeIncBasePriorityPrivilege 2776 teexture.exe Token: SeDebugPrivilege 1012 texture.exe Token: 33 1012 texture.exe Token: SeIncBasePriorityPrivilege 1012 texture.exe Token: SeDebugPrivilege 3736 texture.exe Token: 33 3736 texture.exe Token: SeIncBasePriorityPrivilege 3736 texture.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
AppLaunch.exepid process 2892 AppLaunch.exe -
Suspicious use of WriteProcessMemory 63 IoCs
Processes:
teexture.execmd.exetexture.execmd.exetexture.execmd.exedescription pid process target process PID 2776 wrote to memory of 2892 2776 teexture.exe AppLaunch.exe PID 2776 wrote to memory of 2892 2776 teexture.exe AppLaunch.exe PID 2776 wrote to memory of 2892 2776 teexture.exe AppLaunch.exe PID 2776 wrote to memory of 2892 2776 teexture.exe AppLaunch.exe PID 2776 wrote to memory of 2892 2776 teexture.exe AppLaunch.exe PID 2776 wrote to memory of 2892 2776 teexture.exe AppLaunch.exe PID 2776 wrote to memory of 2892 2776 teexture.exe AppLaunch.exe PID 2776 wrote to memory of 2892 2776 teexture.exe AppLaunch.exe PID 2776 wrote to memory of 2892 2776 teexture.exe AppLaunch.exe PID 2776 wrote to memory of 2892 2776 teexture.exe AppLaunch.exe PID 2776 wrote to memory of 2892 2776 teexture.exe AppLaunch.exe PID 2776 wrote to memory of 2892 2776 teexture.exe AppLaunch.exe PID 2776 wrote to memory of 4084 2776 teexture.exe cmd.exe PID 2776 wrote to memory of 4084 2776 teexture.exe cmd.exe PID 2776 wrote to memory of 4084 2776 teexture.exe cmd.exe PID 2776 wrote to memory of 2136 2776 teexture.exe cmd.exe PID 2776 wrote to memory of 2136 2776 teexture.exe cmd.exe PID 2776 wrote to memory of 2136 2776 teexture.exe cmd.exe PID 4084 wrote to memory of 1332 4084 cmd.exe schtasks.exe PID 4084 wrote to memory of 1332 4084 cmd.exe schtasks.exe PID 4084 wrote to memory of 1332 4084 cmd.exe schtasks.exe PID 1012 wrote to memory of 376 1012 texture.exe AppLaunch.exe PID 1012 wrote to memory of 376 1012 texture.exe AppLaunch.exe PID 1012 wrote to memory of 376 1012 texture.exe AppLaunch.exe PID 1012 wrote to memory of 376 1012 texture.exe AppLaunch.exe PID 1012 wrote to memory of 376 1012 texture.exe AppLaunch.exe PID 1012 wrote to memory of 376 1012 texture.exe AppLaunch.exe PID 1012 wrote to memory of 376 1012 texture.exe AppLaunch.exe PID 1012 wrote to memory of 376 1012 texture.exe AppLaunch.exe PID 1012 wrote to memory of 376 1012 texture.exe AppLaunch.exe PID 1012 wrote to memory of 376 1012 texture.exe AppLaunch.exe PID 1012 wrote to memory of 376 1012 texture.exe AppLaunch.exe PID 1012 wrote to memory of 376 1012 texture.exe AppLaunch.exe PID 1012 wrote to memory of 3228 1012 texture.exe cmd.exe PID 1012 wrote to memory of 3228 1012 texture.exe cmd.exe PID 1012 wrote to memory of 3228 1012 texture.exe cmd.exe PID 1012 wrote to memory of 3324 1012 texture.exe cmd.exe PID 1012 wrote to memory of 3324 1012 texture.exe cmd.exe PID 1012 wrote to memory of 3324 1012 texture.exe cmd.exe PID 3228 wrote to memory of 2680 3228 cmd.exe schtasks.exe PID 3228 wrote to memory of 2680 3228 cmd.exe schtasks.exe PID 3228 wrote to memory of 2680 3228 cmd.exe schtasks.exe PID 3736 wrote to memory of 1784 3736 texture.exe AppLaunch.exe PID 3736 wrote to memory of 1784 3736 texture.exe AppLaunch.exe PID 3736 wrote to memory of 1784 3736 texture.exe AppLaunch.exe PID 3736 wrote to memory of 1784 3736 texture.exe AppLaunch.exe PID 3736 wrote to memory of 1784 3736 texture.exe AppLaunch.exe PID 3736 wrote to memory of 1784 3736 texture.exe AppLaunch.exe PID 3736 wrote to memory of 1784 3736 texture.exe AppLaunch.exe PID 3736 wrote to memory of 1784 3736 texture.exe AppLaunch.exe PID 3736 wrote to memory of 1784 3736 texture.exe AppLaunch.exe PID 3736 wrote to memory of 1784 3736 texture.exe AppLaunch.exe PID 3736 wrote to memory of 1784 3736 texture.exe AppLaunch.exe PID 3736 wrote to memory of 1784 3736 texture.exe AppLaunch.exe PID 3736 wrote to memory of 2296 3736 texture.exe cmd.exe PID 3736 wrote to memory of 2296 3736 texture.exe cmd.exe PID 3736 wrote to memory of 2296 3736 texture.exe cmd.exe PID 3736 wrote to memory of 3244 3736 texture.exe cmd.exe PID 3736 wrote to memory of 3244 3736 texture.exe cmd.exe PID 3736 wrote to memory of 3244 3736 texture.exe cmd.exe PID 2296 wrote to memory of 2392 2296 cmd.exe schtasks.exe PID 2296 wrote to memory of 2392 2296 cmd.exe schtasks.exe PID 2296 wrote to memory of 2392 2296 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\teexture.exe"C:\Users\Admin\AppData\Local\Temp\teexture.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\Admin\AppData\Local\Temp\texture.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\Admin\AppData\Local\Temp\texture.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\teexture.exe" "C:\Users\Admin\AppData\Local\Temp\texture.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\texture.exeC:\Users\Admin\AppData\Local\Temp\texture.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\Admin\AppData\Local\Temp\texture.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\Admin\AppData\Local\Temp\texture.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\texture.exe" "C:\Users\Admin\AppData\Local\Temp\texture.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\texture.exeC:\Users\Admin\AppData\Local\Temp\texture.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\Admin\AppData\Local\Temp\texture.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nania" /tr "'C:\Users\Admin\AppData\Local\Temp\texture.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\texture.exe" "C:\Users\Admin\AppData\Local\Temp\texture.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\texture.exe.logMD5
807cb75397a3a9fc38e9fb5f8566eb2d
SHA1367e151fab5a5a80e60202d287ae522ea53e2563
SHA2563e5056b73303b361e6b7b52f5edb2ed1a7e9dc2c762bb91d18046f42bc2ffcf3
SHA51249efef0401ba0e0dc0b30bdff5d414da5494e4194c6269da2cb40b1ab7dc53e7858d29d2b9982bf3ee60ebc9638b5ed2b5ddcbb536bcc57729e79fc81f59f13d
-
C:\Users\Admin\AppData\Local\Temp\texture.exeMD5
484b0fbe9dcf3de6026aa52b3f26aadf
SHA153f6c84d89a923127927091d5b0b212845b68f6e
SHA2569d8522fac577756511fd093a7e4f5fd2732e33764b07237b13b770ae79bb9361
SHA512f0ddb4d865ae383b697c9899977b25eb811c409c3afaa9f00cc1bd8031b24b28947bb52fc8a0fe43432e72ea3b2ce3d909dde26d1dba16691813b995d75e680a
-
C:\Users\Admin\AppData\Local\Temp\texture.exeMD5
484b0fbe9dcf3de6026aa52b3f26aadf
SHA153f6c84d89a923127927091d5b0b212845b68f6e
SHA2569d8522fac577756511fd093a7e4f5fd2732e33764b07237b13b770ae79bb9361
SHA512f0ddb4d865ae383b697c9899977b25eb811c409c3afaa9f00cc1bd8031b24b28947bb52fc8a0fe43432e72ea3b2ce3d909dde26d1dba16691813b995d75e680a
-
C:\Users\Admin\AppData\Local\Temp\texture.exeMD5
484b0fbe9dcf3de6026aa52b3f26aadf
SHA153f6c84d89a923127927091d5b0b212845b68f6e
SHA2569d8522fac577756511fd093a7e4f5fd2732e33764b07237b13b770ae79bb9361
SHA512f0ddb4d865ae383b697c9899977b25eb811c409c3afaa9f00cc1bd8031b24b28947bb52fc8a0fe43432e72ea3b2ce3d909dde26d1dba16691813b995d75e680a
-
memory/376-129-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1012-125-0x00000000052D0000-0x00000000052D1000-memory.dmpFilesize
4KB
-
memory/1784-136-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/2776-118-0x0000000004B20000-0x0000000004B21000-memory.dmpFilesize
4KB
-
memory/2776-115-0x00000000002B0000-0x0000000000340000-memory.dmpFilesize
576KB
-
memory/2776-117-0x0000000004DE0000-0x0000000004E58000-memory.dmpFilesize
480KB
-
memory/2776-116-0x0000000005030000-0x000000000552E000-memory.dmpFilesize
5.0MB
-
memory/2892-122-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/2892-119-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/3736-132-0x00000000056D0000-0x0000000005711000-memory.dmpFilesize
260KB