Analysis
-
max time kernel
299s -
max time network
303s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
30-06-2022 04:03
Static task
static1
Behavioral task
behavioral1
Sample
eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe
Resource
win10-20220414-en
General
-
Target
eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe
-
Size
718KB
-
MD5
972334f0c55d0aeab0b32efe41ea3470
-
SHA1
e9097b5cd1f976ecaf0accedf14f1d22bd72e6fa
-
SHA256
eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb
-
SHA512
df120f43fa17b2c37ad6d31e528495241146420cd017c18116bd074498cef3834f408c50d289f8bdce2955c464664a6c446800cb7b55c1461fb3cc0accc7fe10
Malware Config
Extracted
remcos
06192022
nikahuve.ac.ug:6968
kalskala.ac.ug:6968
tuekisaa.ac.ug:6968
parthaha.ac.ug:6968
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
scxs.dat
-
keylog_flag
false
-
keylog_folder
forbas
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
cvxyttydfsgbghfgfhtd-RXTSAM
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Qerdo = "\"C:\\Users\\Admin\\AppData\\Roaming\\Ppjollp\\Qerdo.exe\"" eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exedescription pid process target process PID 2040 set thread context of 1924 2040 eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exeeb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exepid process 1488 powershell.exe 2040 eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exepowershell.exedescription pid process Token: SeDebugPrivilege 2040 eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe Token: SeDebugPrivilege 1488 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 1924 InstallUtil.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exedescription pid process target process PID 2040 wrote to memory of 1488 2040 eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe powershell.exe PID 2040 wrote to memory of 1488 2040 eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe powershell.exe PID 2040 wrote to memory of 1488 2040 eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe powershell.exe PID 2040 wrote to memory of 1488 2040 eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe powershell.exe PID 2040 wrote to memory of 1924 2040 eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe InstallUtil.exe PID 2040 wrote to memory of 1924 2040 eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe InstallUtil.exe PID 2040 wrote to memory of 1924 2040 eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe InstallUtil.exe PID 2040 wrote to memory of 1924 2040 eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe InstallUtil.exe PID 2040 wrote to memory of 1924 2040 eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe InstallUtil.exe PID 2040 wrote to memory of 1924 2040 eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe InstallUtil.exe PID 2040 wrote to memory of 1924 2040 eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe InstallUtil.exe PID 2040 wrote to memory of 1924 2040 eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe InstallUtil.exe PID 2040 wrote to memory of 1924 2040 eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe InstallUtil.exe PID 2040 wrote to memory of 1924 2040 eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe InstallUtil.exe PID 2040 wrote to memory of 1924 2040 eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe InstallUtil.exe PID 2040 wrote to memory of 1924 2040 eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe InstallUtil.exe PID 2040 wrote to memory of 1924 2040 eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe InstallUtil.exe PID 2040 wrote to memory of 1924 2040 eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe InstallUtil.exe PID 2040 wrote to memory of 1924 2040 eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe InstallUtil.exe PID 2040 wrote to memory of 1924 2040 eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe"C:\Users\Admin\AppData\Local\Temp\eb91bf1e2eb3877f0942cef113bb0fb76e2c2fd2c2651dbf09f6da6df649e8fb.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXAAnAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1488-58-0x0000000000000000-mapping.dmp
-
memory/1488-61-0x000000006FC10000-0x00000000701BB000-memory.dmpFilesize
5.7MB
-
memory/1488-60-0x000000006FC10000-0x00000000701BB000-memory.dmpFilesize
5.7MB
-
memory/1924-67-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1924-69-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1924-80-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1924-79-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1924-62-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1924-63-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1924-65-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1924-78-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1924-68-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1924-74-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1924-70-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1924-72-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1924-75-0x000000000043133D-mapping.dmp
-
memory/2040-57-0x0000000075FE1000-0x0000000075FE3000-memory.dmpFilesize
8KB
-
memory/2040-54-0x00000000010B0000-0x000000000116A000-memory.dmpFilesize
744KB
-
memory/2040-55-0x00000000049D0000-0x0000000004AC8000-memory.dmpFilesize
992KB
-
memory/2040-56-0x0000000000E80000-0x0000000000ECC000-memory.dmpFilesize
304KB