Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
30-07-2022 20:49
Static task
static1
Behavioral task
behavioral1
Sample
618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe
Resource
win10v2004-20220722-en
General
-
Target
618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe
-
Size
218KB
-
MD5
25f290634a8092cc13820b1ade6ec33c
-
SHA1
3d4913172fedc50d9654effeab0fdcec9bb36014
-
SHA256
618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4
-
SHA512
22d9aaa2ab0780eab101a7c387e491e36f9672c59dc4b97a92488685dc3b62e585d004d8550f44a17034dc12e2dc6f08a2406991418452cb01e417f2b5e6da29
Malware Config
Extracted
remcos
2.0.5 Pro
RemoteHost
79.172.242.28:2404
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-6PPTSU
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
remcos
RemoteHost
79.172.242.28:2404
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-6PPTSU
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
tmp.exe.exepid process 1712 tmp.exe 1908 .exe -
Loads dropped DLL 4 IoCs
Processes:
618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exepid process 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exedescription pid process target process PID 1112 set thread context of 1908 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe .exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NTFS ADS 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\vf45\b9876.exe:Zone.Identifier cmd.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exepid process 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exedescription pid process Token: SeDebugPrivilege 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.execmd.exetmp.exedescription pid process target process PID 1112 wrote to memory of 884 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe cmd.exe PID 1112 wrote to memory of 884 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe cmd.exe PID 1112 wrote to memory of 884 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe cmd.exe PID 1112 wrote to memory of 884 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe cmd.exe PID 884 wrote to memory of 788 884 cmd.exe reg.exe PID 884 wrote to memory of 788 884 cmd.exe reg.exe PID 884 wrote to memory of 788 884 cmd.exe reg.exe PID 884 wrote to memory of 788 884 cmd.exe reg.exe PID 1112 wrote to memory of 1712 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe tmp.exe PID 1112 wrote to memory of 1712 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe tmp.exe PID 1112 wrote to memory of 1712 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe tmp.exe PID 1112 wrote to memory of 1712 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe tmp.exe PID 1112 wrote to memory of 1908 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe .exe PID 1112 wrote to memory of 1908 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe .exe PID 1112 wrote to memory of 1908 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe .exe PID 1112 wrote to memory of 1908 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe .exe PID 1112 wrote to memory of 1908 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe .exe PID 1112 wrote to memory of 1908 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe .exe PID 1112 wrote to memory of 1908 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe .exe PID 1112 wrote to memory of 1908 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe .exe PID 1112 wrote to memory of 1908 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe .exe PID 1112 wrote to memory of 1908 1112 618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe .exe PID 1712 wrote to memory of 1876 1712 tmp.exe iexplore.exe PID 1712 wrote to memory of 1876 1712 tmp.exe iexplore.exe PID 1712 wrote to memory of 1876 1712 tmp.exe iexplore.exe PID 1712 wrote to memory of 1876 1712 tmp.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe"C:\Users\Admin\AppData\Local\Temp\618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\vf45\b9876.exe.lnk" /f3⤵
-
C:\Users\Admin\AppData\Roaming\tmp.exe"C:\Users\Admin\AppData\Roaming\tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\.exe"C:\Users\Admin\AppData\Local\Temp\.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\.exeFilesize
1.6MB
MD532827e69b293b99013bbbe37d029245d
SHA1bc9f80a38f09354d71467a05b0c5a82c3f7dac53
SHA2569250b89157770e3ab59a2c7e2dd6b12b3c61d9b7c6620c3b4727e4bfff10f01f
SHA51258c9a072e2bea0a8f22b4e69512abafad271ca91f2e3d2b4233796dd3d83021aad1c6da69fc8f7e7ca7919d34bde941cb8b5d185b668168866d1180558b93cf5
-
C:\Users\Admin\AppData\Local\Temp\vf45\b9876.exeFilesize
218KB
MD525f290634a8092cc13820b1ade6ec33c
SHA13d4913172fedc50d9654effeab0fdcec9bb36014
SHA256618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4
SHA51222d9aaa2ab0780eab101a7c387e491e36f9672c59dc4b97a92488685dc3b62e585d004d8550f44a17034dc12e2dc6f08a2406991418452cb01e417f2b5e6da29
-
C:\Users\Admin\AppData\Roaming\tmp.exeFilesize
108KB
MD507dafacf45c8e2fe217985a20c1ee89d
SHA1f62ec5fdd8a397465399b8d20a9196ebbbfe5a1c
SHA25671f4ff98b5c43912e39c9b68c0ae1ed894903e94756f41cf5631445499356527
SHA51208c3a614f2e44bde9610519e0f751f131d80d2dd1c4939921f1b4455d2e7095d96d0c21f9c854dcdc4abf0d1e20c2de4a9e2cb602367f7efa5f4c524909c4074
-
\Users\Admin\AppData\Local\Temp\.exeFilesize
1.6MB
MD532827e69b293b99013bbbe37d029245d
SHA1bc9f80a38f09354d71467a05b0c5a82c3f7dac53
SHA2569250b89157770e3ab59a2c7e2dd6b12b3c61d9b7c6620c3b4727e4bfff10f01f
SHA51258c9a072e2bea0a8f22b4e69512abafad271ca91f2e3d2b4233796dd3d83021aad1c6da69fc8f7e7ca7919d34bde941cb8b5d185b668168866d1180558b93cf5
-
\Users\Admin\AppData\Local\Temp\vf45\b9876.exeFilesize
218KB
MD525f290634a8092cc13820b1ade6ec33c
SHA13d4913172fedc50d9654effeab0fdcec9bb36014
SHA256618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4
SHA51222d9aaa2ab0780eab101a7c387e491e36f9672c59dc4b97a92488685dc3b62e585d004d8550f44a17034dc12e2dc6f08a2406991418452cb01e417f2b5e6da29
-
\Users\Admin\AppData\Roaming\tmp.exeFilesize
108KB
MD507dafacf45c8e2fe217985a20c1ee89d
SHA1f62ec5fdd8a397465399b8d20a9196ebbbfe5a1c
SHA25671f4ff98b5c43912e39c9b68c0ae1ed894903e94756f41cf5631445499356527
SHA51208c3a614f2e44bde9610519e0f751f131d80d2dd1c4939921f1b4455d2e7095d96d0c21f9c854dcdc4abf0d1e20c2de4a9e2cb602367f7efa5f4c524909c4074
-
\Users\Admin\AppData\Roaming\tmp.exeFilesize
108KB
MD507dafacf45c8e2fe217985a20c1ee89d
SHA1f62ec5fdd8a397465399b8d20a9196ebbbfe5a1c
SHA25671f4ff98b5c43912e39c9b68c0ae1ed894903e94756f41cf5631445499356527
SHA51208c3a614f2e44bde9610519e0f751f131d80d2dd1c4939921f1b4455d2e7095d96d0c21f9c854dcdc4abf0d1e20c2de4a9e2cb602367f7efa5f4c524909c4074
-
memory/788-58-0x0000000000000000-mapping.dmp
-
memory/884-57-0x0000000000000000-mapping.dmp
-
memory/1112-55-0x0000000074080000-0x000000007462B000-memory.dmpFilesize
5.7MB
-
memory/1112-54-0x0000000075681000-0x0000000075683000-memory.dmpFilesize
8KB
-
memory/1112-56-0x0000000074080000-0x000000007462B000-memory.dmpFilesize
5.7MB
-
memory/1112-80-0x0000000074080000-0x000000007462B000-memory.dmpFilesize
5.7MB
-
memory/1712-63-0x0000000000000000-mapping.dmp
-
memory/1908-67-0x0000000000080000-0x000000000009B000-memory.dmpFilesize
108KB
-
memory/1908-72-0x0000000000080000-0x000000000009B000-memory.dmpFilesize
108KB
-
memory/1908-73-0x0000000000080000-0x000000000009B000-memory.dmpFilesize
108KB
-
memory/1908-77-0x0000000000080000-0x000000000009B000-memory.dmpFilesize
108KB
-
memory/1908-70-0x0000000000080000-0x000000000009B000-memory.dmpFilesize
108KB
-
memory/1908-75-0x0000000000412C84-mapping.dmp
-
memory/1908-68-0x0000000000080000-0x000000000009B000-memory.dmpFilesize
108KB