Analysis
-
max time kernel
165s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 01:28
Behavioral task
behavioral1
Sample
FDA_CERT.exe
Resource
win7-20220414-en
General
-
Target
FDA_CERT.exe
-
Size
371KB
-
MD5
9c547767c3059a4aa991b4b4413725bb
-
SHA1
fd83c2cf73a959255d01abca9d681af4c62d5dbf
-
SHA256
246fb765947ed62ef616f5f714642ff0db639983582c0fa2cbab9ad251669b78
-
SHA512
1a3e2250804bc524750cdf3517b51af04e6988bc080a2d35468fc2e16758b6cd8970ff416ce0a009cbda387b31aaa0e698e8e5d1aba3f60c6110e069e4c1b1b7
Malware Config
Extracted
remcos
1.7 Pro
Host
kmt.duckdns.org:3039
kmt-2.duckdns.org:3039
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_vejtzxohypibcpz
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
- take_screenshot_title
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
FDA_CERT.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation FDA_CERT.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
FDA_CERT.exedescription pid process target process PID 3284 set thread context of 3244 3284 FDA_CERT.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
FDA_CERT.exepid process 3284 FDA_CERT.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
FDA_CERT.exedescription pid process Token: SeDebugPrivilege 3284 FDA_CERT.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
FDA_CERT.exepid process 3284 FDA_CERT.exe 3284 FDA_CERT.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
FDA_CERT.exedescription pid process target process PID 3284 wrote to memory of 4612 3284 FDA_CERT.exe schtasks.exe PID 3284 wrote to memory of 4612 3284 FDA_CERT.exe schtasks.exe PID 3284 wrote to memory of 4612 3284 FDA_CERT.exe schtasks.exe PID 3284 wrote to memory of 3244 3284 FDA_CERT.exe MSBuild.exe PID 3284 wrote to memory of 3244 3284 FDA_CERT.exe MSBuild.exe PID 3284 wrote to memory of 3244 3284 FDA_CERT.exe MSBuild.exe PID 3284 wrote to memory of 3244 3284 FDA_CERT.exe MSBuild.exe PID 3284 wrote to memory of 3244 3284 FDA_CERT.exe MSBuild.exe PID 3284 wrote to memory of 3244 3284 FDA_CERT.exe MSBuild.exe PID 3284 wrote to memory of 3244 3284 FDA_CERT.exe MSBuild.exe PID 3284 wrote to memory of 3244 3284 FDA_CERT.exe MSBuild.exe PID 3284 wrote to memory of 3244 3284 FDA_CERT.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FDA_CERT.exe"C:\Users\Admin\AppData\Local\Temp\FDA_CERT.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HXAjzs" /XML "C:\Users\Admin\AppData\Local\Temp\tmpADAA.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpADAA.tmpFilesize
1KB
MD507fde2b53a26272360c348010614dbb3
SHA15a11dc719476704b2cc35321793b7ce168d53828
SHA2568fbf8dbb8fd8c94643db96d4dd16a1048416dbea92d8ecaf077b2120492169f2
SHA512ee9b925ed30f075514f60e5c1aa370cd7f2087949a0f220ba46ec2d23de6a271a4de7c9d9c9bd79dfb810536fdc03d4b4cbf24ace01872bae95465ef87c9f13b
-
memory/3244-133-0x0000000000000000-mapping.dmp
-
memory/3244-134-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3244-136-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3244-137-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3284-130-0x0000000074F50000-0x0000000075501000-memory.dmpFilesize
5.7MB
-
memory/4612-131-0x0000000000000000-mapping.dmp