Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
11-07-2022 09:24
Static task
static1
Behavioral task
behavioral1
Sample
4841f41452ae6adfbfdcaa30e253261f.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4841f41452ae6adfbfdcaa30e253261f.exe
Resource
win10v2004-20220414-en
General
-
Target
4841f41452ae6adfbfdcaa30e253261f.exe
-
Size
480KB
-
MD5
4841f41452ae6adfbfdcaa30e253261f
-
SHA1
5a51f6bddb0e890a710fe8c13017e8902e7123fd
-
SHA256
5d97621e71741cf4e2b90ebd16281ddb2c1fe806b3c4e6be5aef738cdf79089b
-
SHA512
220bca133859810728fc6d2df5ad8f789e4e1138ca76d51c809474ca721259863cbb9b81435fd9e9379a61f615816607eaa9414349625762a02ce60271444e1d
Malware Config
Extracted
remcos
06192022
nikahuve.ac.ug:6968
kalskala.ac.ug:6968
tuekisaa.ac.ug:6968
parthaha.ac.ug:6968
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
scxs.dat
-
keylog_flag
false
-
keylog_folder
forbas
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
cvxyttydfsgbghfgfhtd-RXTSAM
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4841f41452ae6adfbfdcaa30e253261f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yjlgdlfzs = "\"C:\\Users\\Admin\\AppData\\Roaming\\Dgzivqk\\Yjlgdlfzs.exe\"" 4841f41452ae6adfbfdcaa30e253261f.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4841f41452ae6adfbfdcaa30e253261f.exedescription pid process target process PID 1092 set thread context of 1952 1092 4841f41452ae6adfbfdcaa30e253261f.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
4841f41452ae6adfbfdcaa30e253261f.exepid process 1092 4841f41452ae6adfbfdcaa30e253261f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4841f41452ae6adfbfdcaa30e253261f.exedescription pid process Token: SeDebugPrivilege 1092 4841f41452ae6adfbfdcaa30e253261f.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 1952 InstallUtil.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
4841f41452ae6adfbfdcaa30e253261f.exedescription pid process target process PID 1092 wrote to memory of 1952 1092 4841f41452ae6adfbfdcaa30e253261f.exe InstallUtil.exe PID 1092 wrote to memory of 1952 1092 4841f41452ae6adfbfdcaa30e253261f.exe InstallUtil.exe PID 1092 wrote to memory of 1952 1092 4841f41452ae6adfbfdcaa30e253261f.exe InstallUtil.exe PID 1092 wrote to memory of 1952 1092 4841f41452ae6adfbfdcaa30e253261f.exe InstallUtil.exe PID 1092 wrote to memory of 1952 1092 4841f41452ae6adfbfdcaa30e253261f.exe InstallUtil.exe PID 1092 wrote to memory of 1952 1092 4841f41452ae6adfbfdcaa30e253261f.exe InstallUtil.exe PID 1092 wrote to memory of 1952 1092 4841f41452ae6adfbfdcaa30e253261f.exe InstallUtil.exe PID 1092 wrote to memory of 1952 1092 4841f41452ae6adfbfdcaa30e253261f.exe InstallUtil.exe PID 1092 wrote to memory of 1952 1092 4841f41452ae6adfbfdcaa30e253261f.exe InstallUtil.exe PID 1092 wrote to memory of 1952 1092 4841f41452ae6adfbfdcaa30e253261f.exe InstallUtil.exe PID 1092 wrote to memory of 1952 1092 4841f41452ae6adfbfdcaa30e253261f.exe InstallUtil.exe PID 1092 wrote to memory of 1952 1092 4841f41452ae6adfbfdcaa30e253261f.exe InstallUtil.exe PID 1092 wrote to memory of 1952 1092 4841f41452ae6adfbfdcaa30e253261f.exe InstallUtil.exe PID 1092 wrote to memory of 1952 1092 4841f41452ae6adfbfdcaa30e253261f.exe InstallUtil.exe PID 1092 wrote to memory of 1952 1092 4841f41452ae6adfbfdcaa30e253261f.exe InstallUtil.exe PID 1092 wrote to memory of 1952 1092 4841f41452ae6adfbfdcaa30e253261f.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4841f41452ae6adfbfdcaa30e253261f.exe"C:\Users\Admin\AppData\Local\Temp\4841f41452ae6adfbfdcaa30e253261f.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1092-54-0x0000000001090000-0x000000000110E000-memory.dmpFilesize
504KB
-
memory/1092-55-0x0000000076571000-0x0000000076573000-memory.dmpFilesize
8KB
-
memory/1092-56-0x00000000006D0000-0x000000000075A000-memory.dmpFilesize
552KB
-
memory/1092-57-0x00000000004F0000-0x000000000053C000-memory.dmpFilesize
304KB
-
memory/1952-58-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1952-59-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1952-61-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1952-63-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1952-64-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1952-65-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1952-66-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1952-68-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1952-71-0x000000000043133D-mapping.dmp
-
memory/1952-70-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1952-74-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1952-75-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1952-76-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB