Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:40
Static task
static1
Behavioral task
behavioral1
Sample
ORDEZTECH202067.exe
Resource
win7-20220414-en
General
-
Target
ORDEZTECH202067.exe
-
Size
729KB
-
MD5
5e03e07d2701ae88f1d072d7c1102762
-
SHA1
8c50f5333bfe34d846de0df1782386c0ffcf0667
-
SHA256
4ad47d37f0033d71887d69f3dfdb0961c10e98d7db1928beab71d6540db95c03
-
SHA512
754d1df02ff15072f182956491b97eb45e11c835555d67279176fafe15026ee3a1fc9dfae33e4fa12860d84ca6f88032d9e54a9e1d70f5be160895005db627b7
Malware Config
Extracted
remcos
2.5.1 Pro
Amazone
79.134.225.43:5908
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
-JSKOGA
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
AddInProcess32.exepid process 4092 AddInProcess32.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ORDEZTECH202067.exedescription pid process target process PID 2784 set thread context of 4092 2784 ORDEZTECH202067.exe AddInProcess32.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
ORDEZTECH202067.exepid process 2784 ORDEZTECH202067.exe 2784 ORDEZTECH202067.exe 2784 ORDEZTECH202067.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ORDEZTECH202067.exedescription pid process Token: SeDebugPrivilege 2784 ORDEZTECH202067.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
AddInProcess32.exepid process 4092 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
ORDEZTECH202067.exedescription pid process target process PID 2784 wrote to memory of 4092 2784 ORDEZTECH202067.exe AddInProcess32.exe PID 2784 wrote to memory of 4092 2784 ORDEZTECH202067.exe AddInProcess32.exe PID 2784 wrote to memory of 4092 2784 ORDEZTECH202067.exe AddInProcess32.exe PID 2784 wrote to memory of 4092 2784 ORDEZTECH202067.exe AddInProcess32.exe PID 2784 wrote to memory of 4092 2784 ORDEZTECH202067.exe AddInProcess32.exe PID 2784 wrote to memory of 4092 2784 ORDEZTECH202067.exe AddInProcess32.exe PID 2784 wrote to memory of 4092 2784 ORDEZTECH202067.exe AddInProcess32.exe PID 2784 wrote to memory of 4092 2784 ORDEZTECH202067.exe AddInProcess32.exe PID 2784 wrote to memory of 4092 2784 ORDEZTECH202067.exe AddInProcess32.exe PID 2784 wrote to memory of 4092 2784 ORDEZTECH202067.exe AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORDEZTECH202067.exe"C:\Users\Admin\AppData\Local\Temp\ORDEZTECH202067.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exeFilesize
42KB
MD59827ff3cdf4b83f9c86354606736ca9c
SHA1e73d73f42bb2a310f03eb1bcbb22be2b8eb7c723
SHA256c1cf3dc8fa1c7fc00f88e07ad539979b3706ca8d69223cffd1d58bc8f521f63a
SHA5128261828d55f3b5134c0aeb98311c04e20c5395d4347251746f3be0fb854f36cc7e118713cd00c9867537e6e47d5e71f2b2384fc00c67f0ae1b285b8310321579
-
memory/2784-130-0x0000000000F50000-0x000000000100C000-memory.dmpFilesize
752KB
-
memory/2784-131-0x0000000005F70000-0x0000000006514000-memory.dmpFilesize
5.6MB
-
memory/2784-132-0x0000000005AD0000-0x0000000005B62000-memory.dmpFilesize
584KB
-
memory/2784-133-0x0000000005CA0000-0x0000000005CE4000-memory.dmpFilesize
272KB
-
memory/4092-134-0x0000000000000000-mapping.dmp
-
memory/4092-135-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4092-138-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4092-139-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB