Analysis
-
max time kernel
181s -
max time network
195s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:29
Static task
static1
Behavioral task
behavioral1
Sample
na.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
na.exe
Resource
win10v2004-20220414-en
General
-
Target
na.exe
-
Size
343KB
-
MD5
9125179a330454ca85b14de64a89faa6
-
SHA1
1965ecfcd7181d6936565ab1f73ec594ed4c71a2
-
SHA256
52360edd07bcd18738ccc44906897ece6c659883978d6ed61bd1e73dca205bd4
-
SHA512
6054701500d7247be4d365be2a8501ff4fc24c5b523e002a8aefec7e01f8434bc62fc59aaabce9e4438cf8dfc623531c988b255a087355b8e7b4e2bfe4361890
Malware Config
Extracted
remcos
2.5.1 Pro
.NET
noapology.myq-see.com:5149
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
vlc
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
app
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remoteaccess-ERAX9A
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
remoteaccess
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
remcos.exeremcos.exepid process 632 remcos.exe 1504 remcos.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 656 cmd.exe -
Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/908-55-0x0000000000320000-0x0000000000334000-memory.dmp agile_net behavioral1/memory/632-82-0x0000000000820000-0x0000000000834000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
na.exeremcos.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\ na.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\remoteaccess = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc\\remcos.exe\"" na.exe Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\ remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\remoteaccess = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc\\remcos.exe\"" remcos.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
na.exeremcos.exedescription pid process target process PID 908 set thread context of 1940 908 na.exe na.exe PID 632 set thread context of 1504 632 remcos.exe remcos.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
na.exeremcos.exepid process 908 na.exe 908 na.exe 908 na.exe 632 remcos.exe 632 remcos.exe 632 remcos.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
na.exeremcos.exedescription pid process Token: SeDebugPrivilege 908 na.exe Token: SeDebugPrivilege 632 remcos.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
remcos.exepid process 1504 remcos.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
na.exena.exeWScript.execmd.exeremcos.exedescription pid process target process PID 908 wrote to memory of 1940 908 na.exe na.exe PID 908 wrote to memory of 1940 908 na.exe na.exe PID 908 wrote to memory of 1940 908 na.exe na.exe PID 908 wrote to memory of 1940 908 na.exe na.exe PID 908 wrote to memory of 1940 908 na.exe na.exe PID 908 wrote to memory of 1940 908 na.exe na.exe PID 908 wrote to memory of 1940 908 na.exe na.exe PID 908 wrote to memory of 1940 908 na.exe na.exe PID 908 wrote to memory of 1940 908 na.exe na.exe PID 908 wrote to memory of 1940 908 na.exe na.exe PID 908 wrote to memory of 1940 908 na.exe na.exe PID 1940 wrote to memory of 1804 1940 na.exe WScript.exe PID 1940 wrote to memory of 1804 1940 na.exe WScript.exe PID 1940 wrote to memory of 1804 1940 na.exe WScript.exe PID 1940 wrote to memory of 1804 1940 na.exe WScript.exe PID 1804 wrote to memory of 656 1804 WScript.exe cmd.exe PID 1804 wrote to memory of 656 1804 WScript.exe cmd.exe PID 1804 wrote to memory of 656 1804 WScript.exe cmd.exe PID 1804 wrote to memory of 656 1804 WScript.exe cmd.exe PID 656 wrote to memory of 632 656 cmd.exe remcos.exe PID 656 wrote to memory of 632 656 cmd.exe remcos.exe PID 656 wrote to memory of 632 656 cmd.exe remcos.exe PID 656 wrote to memory of 632 656 cmd.exe remcos.exe PID 632 wrote to memory of 1504 632 remcos.exe remcos.exe PID 632 wrote to memory of 1504 632 remcos.exe remcos.exe PID 632 wrote to memory of 1504 632 remcos.exe remcos.exe PID 632 wrote to memory of 1504 632 remcos.exe remcos.exe PID 632 wrote to memory of 1504 632 remcos.exe remcos.exe PID 632 wrote to memory of 1504 632 remcos.exe remcos.exe PID 632 wrote to memory of 1504 632 remcos.exe remcos.exe PID 632 wrote to memory of 1504 632 remcos.exe remcos.exe PID 632 wrote to memory of 1504 632 remcos.exe remcos.exe PID 632 wrote to memory of 1504 632 remcos.exe remcos.exe PID 632 wrote to memory of 1504 632 remcos.exe remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\na.exe"C:\Users\Admin\AppData\Local\Temp\na.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\na.exe"C:\Users\Admin\AppData\Local\Temp\na.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\vlc\remcos.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\vlc\remcos.exeC:\Users\Admin\AppData\Roaming\vlc\remcos.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\vlc\remcos.exe"C:\Users\Admin\AppData\Roaming\vlc\remcos.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.vbsFilesize
412B
MD5e20de8eb17668cf226b9b5de03600f6b
SHA1e649c077a6ef4579e7052c4b2df3fab2d979d531
SHA2568371442d7bf0f75983623d8940d8f4b459785db0a17aa8806000d9363e4eeede
SHA5129a22c687ce47c53a3d57dab8bdb362e0c814575027439d8fc2371a1f8a4cda0ae6dda362fdbc91d30a15acf98c5a095f8e4d962e4d7e1081adec536b2b8398f7
-
C:\Users\Admin\AppData\Roaming\vlc\remcos.exeFilesize
343KB
MD59125179a330454ca85b14de64a89faa6
SHA11965ecfcd7181d6936565ab1f73ec594ed4c71a2
SHA25652360edd07bcd18738ccc44906897ece6c659883978d6ed61bd1e73dca205bd4
SHA5126054701500d7247be4d365be2a8501ff4fc24c5b523e002a8aefec7e01f8434bc62fc59aaabce9e4438cf8dfc623531c988b255a087355b8e7b4e2bfe4361890
-
C:\Users\Admin\AppData\Roaming\vlc\remcos.exeFilesize
343KB
MD59125179a330454ca85b14de64a89faa6
SHA11965ecfcd7181d6936565ab1f73ec594ed4c71a2
SHA25652360edd07bcd18738ccc44906897ece6c659883978d6ed61bd1e73dca205bd4
SHA5126054701500d7247be4d365be2a8501ff4fc24c5b523e002a8aefec7e01f8434bc62fc59aaabce9e4438cf8dfc623531c988b255a087355b8e7b4e2bfe4361890
-
C:\Users\Admin\AppData\Roaming\vlc\remcos.exeFilesize
343KB
MD59125179a330454ca85b14de64a89faa6
SHA11965ecfcd7181d6936565ab1f73ec594ed4c71a2
SHA25652360edd07bcd18738ccc44906897ece6c659883978d6ed61bd1e73dca205bd4
SHA5126054701500d7247be4d365be2a8501ff4fc24c5b523e002a8aefec7e01f8434bc62fc59aaabce9e4438cf8dfc623531c988b255a087355b8e7b4e2bfe4361890
-
\Users\Admin\AppData\Roaming\vlc\remcos.exeFilesize
343KB
MD59125179a330454ca85b14de64a89faa6
SHA11965ecfcd7181d6936565ab1f73ec594ed4c71a2
SHA25652360edd07bcd18738ccc44906897ece6c659883978d6ed61bd1e73dca205bd4
SHA5126054701500d7247be4d365be2a8501ff4fc24c5b523e002a8aefec7e01f8434bc62fc59aaabce9e4438cf8dfc623531c988b255a087355b8e7b4e2bfe4361890
-
memory/632-82-0x0000000000820000-0x0000000000834000-memory.dmpFilesize
80KB
-
memory/632-81-0x00000000010D0000-0x000000000112C000-memory.dmpFilesize
368KB
-
memory/632-79-0x0000000000000000-mapping.dmp
-
memory/656-76-0x0000000000000000-mapping.dmp
-
memory/908-54-0x0000000000E60000-0x0000000000EBC000-memory.dmpFilesize
368KB
-
memory/908-57-0x0000000000660000-0x0000000000668000-memory.dmpFilesize
32KB
-
memory/908-56-0x0000000000340000-0x0000000000348000-memory.dmpFilesize
32KB
-
memory/908-55-0x0000000000320000-0x0000000000334000-memory.dmpFilesize
80KB
-
memory/1504-98-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1504-93-0x0000000000413B74-mapping.dmp
-
memory/1504-97-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1804-73-0x0000000000000000-mapping.dmp
-
memory/1940-63-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1940-72-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1940-71-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1940-70-0x0000000075581000-0x0000000075583000-memory.dmpFilesize
8KB
-
memory/1940-68-0x0000000000413B74-mapping.dmp
-
memory/1940-67-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1940-65-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1940-64-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1940-61-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1940-59-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1940-58-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB