Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
24-07-2022 06:30
Static task
static1
Behavioral task
behavioral1
Sample
58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe
Resource
win10v2004-20220722-en
General
-
Target
58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe
-
Size
385KB
-
MD5
e8fcccc14df4c8fbde4223b16fdb4e63
-
SHA1
6bb4317b855e9f07c9f63b33455eeaa7335bfade
-
SHA256
58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a
-
SHA512
8cb6aab343972ef7384c6e8e4d2418e168c35e448a4e1183d650776762c407239d265838fe1c03bd10cf4415238c4e7b08ed9a9d95a62f70bcc4f50561b01c1c
Malware Config
Extracted
remcos
2.0.5 Pro
RemoteHost
79.172.242.28:2404
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-6PPTSU
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
- take_screenshot_title
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
svhost.exepid process 600 svhost.exe -
Loads dropped DLL 1 IoCs
Processes:
58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exepid process 1824 58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exesvhost.exedescription pid process target process PID 1824 set thread context of 600 1824 58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe svhost.exe PID 600 set thread context of 1148 600 svhost.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NTFS ADS 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\8778\name.exe:Zone.Identifier cmd.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exepid process 1824 58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe 1824 58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe 1824 58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe 1824 58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exedescription pid process Token: SeDebugPrivilege 1824 58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe Token: 33 1824 58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe Token: SeIncBasePriorityPrivilege 1824 58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.execmd.exesvhost.exedescription pid process target process PID 1824 wrote to memory of 1908 1824 58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe cmd.exe PID 1824 wrote to memory of 1908 1824 58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe cmd.exe PID 1824 wrote to memory of 1908 1824 58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe cmd.exe PID 1824 wrote to memory of 1908 1824 58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe cmd.exe PID 1908 wrote to memory of 1464 1908 cmd.exe reg.exe PID 1908 wrote to memory of 1464 1908 cmd.exe reg.exe PID 1908 wrote to memory of 1464 1908 cmd.exe reg.exe PID 1908 wrote to memory of 1464 1908 cmd.exe reg.exe PID 1824 wrote to memory of 600 1824 58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe svhost.exe PID 1824 wrote to memory of 600 1824 58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe svhost.exe PID 1824 wrote to memory of 600 1824 58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe svhost.exe PID 1824 wrote to memory of 600 1824 58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe svhost.exe PID 1824 wrote to memory of 600 1824 58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe svhost.exe PID 1824 wrote to memory of 600 1824 58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe svhost.exe PID 1824 wrote to memory of 600 1824 58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe svhost.exe PID 1824 wrote to memory of 600 1824 58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe svhost.exe PID 1824 wrote to memory of 600 1824 58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe svhost.exe PID 1824 wrote to memory of 600 1824 58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe svhost.exe PID 600 wrote to memory of 1148 600 svhost.exe iexplore.exe PID 600 wrote to memory of 1148 600 svhost.exe iexplore.exe PID 600 wrote to memory of 1148 600 svhost.exe iexplore.exe PID 600 wrote to memory of 1148 600 svhost.exe iexplore.exe PID 600 wrote to memory of 1148 600 svhost.exe iexplore.exe PID 600 wrote to memory of 1148 600 svhost.exe iexplore.exe PID 600 wrote to memory of 1148 600 svhost.exe iexplore.exe PID 600 wrote to memory of 1148 600 svhost.exe iexplore.exe PID 600 wrote to memory of 1148 600 svhost.exe iexplore.exe PID 600 wrote to memory of 1148 600 svhost.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe"C:\Users\Admin\AppData\Local\Temp\58cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\8778\name.exe.lnk" /f3⤵
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\8778\name.exeFilesize
385KB
MD5e8fcccc14df4c8fbde4223b16fdb4e63
SHA16bb4317b855e9f07c9f63b33455eeaa7335bfade
SHA25658cb07fecced83dfe6a4999921297ad94248f47935568913aa2a1a60de1d330a
SHA5128cb6aab343972ef7384c6e8e4d2418e168c35e448a4e1183d650776762c407239d265838fe1c03bd10cf4415238c4e7b08ed9a9d95a62f70bcc4f50561b01c1c
-
C:\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
1.6MB
MD532827e69b293b99013bbbe37d029245d
SHA1bc9f80a38f09354d71467a05b0c5a82c3f7dac53
SHA2569250b89157770e3ab59a2c7e2dd6b12b3c61d9b7c6620c3b4727e4bfff10f01f
SHA51258c9a072e2bea0a8f22b4e69512abafad271ca91f2e3d2b4233796dd3d83021aad1c6da69fc8f7e7ca7919d34bde941cb8b5d185b668168866d1180558b93cf5
-
\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
1.6MB
MD532827e69b293b99013bbbe37d029245d
SHA1bc9f80a38f09354d71467a05b0c5a82c3f7dac53
SHA2569250b89157770e3ab59a2c7e2dd6b12b3c61d9b7c6620c3b4727e4bfff10f01f
SHA51258c9a072e2bea0a8f22b4e69512abafad271ca91f2e3d2b4233796dd3d83021aad1c6da69fc8f7e7ca7919d34bde941cb8b5d185b668168866d1180558b93cf5
-
memory/600-66-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/600-67-0x0000000000412C84-mapping.dmp
-
memory/600-59-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/600-60-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/600-62-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/600-64-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/600-72-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/600-65-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/600-71-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1464-56-0x0000000000000000-mapping.dmp
-
memory/1824-54-0x0000000075741000-0x0000000075743000-memory.dmpFilesize
8KB
-
memory/1824-73-0x0000000074970000-0x0000000074F1B000-memory.dmpFilesize
5.7MB
-
memory/1824-74-0x0000000074970000-0x0000000074F1B000-memory.dmpFilesize
5.7MB
-
memory/1908-55-0x0000000000000000-mapping.dmp