Analysis
-
max time kernel
659s -
max time network
635s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
03-08-2022 19:35
Static task
static1
Behavioral task
behavioral1
Sample
Envision Digital.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
Envision Digital.exe
Resource
win10v2004-20220721-en
General
-
Target
Envision Digital.exe
-
Size
996KB
-
MD5
e52cf82f435602239c33092829fcf8f1
-
SHA1
1469f0e7c2129ba105f6bb50b9dcde23d67443ad
-
SHA256
a6e5730f0bedf158a97f59955ac607c227cd7c3acbb1ad9c6f92c553c71d2283
-
SHA512
93e1f9e9b890861ba795dc5defb19b1c1fb993940277ad8347c9a3a1d89ff6292a8f9780365d45ecd2a5c0104a8f7b96345a3496c7c2acabf3cfcb893722b4e6
Malware Config
Extracted
remcos
uka
micenaxus.com:2404
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
uka
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
uka-RQ2V95
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Blocklisted process makes network request 2 IoCs
Processes:
cmd.exeflow pid process 30 4040 cmd.exe 32 4040 cmd.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Envision Digital.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation Envision Digital.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Envision Digital.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wiupbu = "C:\\Users\\Public\\Libraries\\ubpuiW.url" Envision Digital.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exeEnvision Digital.exepid process 2240 powershell.exe 2240 powershell.exe 4676 Envision Digital.exe 4676 Envision Digital.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
cmd.exepid process 4040 cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2240 powershell.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
Envision Digital.execmd.execmd.exenet.exedescription pid process target process PID 4676 wrote to memory of 1120 4676 Envision Digital.exe cmd.exe PID 4676 wrote to memory of 1120 4676 Envision Digital.exe cmd.exe PID 4676 wrote to memory of 1120 4676 Envision Digital.exe cmd.exe PID 1120 wrote to memory of 3120 1120 cmd.exe cmd.exe PID 1120 wrote to memory of 3120 1120 cmd.exe cmd.exe PID 1120 wrote to memory of 3120 1120 cmd.exe cmd.exe PID 3120 wrote to memory of 1132 3120 cmd.exe net.exe PID 3120 wrote to memory of 1132 3120 cmd.exe net.exe PID 3120 wrote to memory of 1132 3120 cmd.exe net.exe PID 1132 wrote to memory of 1252 1132 net.exe net1.exe PID 1132 wrote to memory of 1252 1132 net.exe net1.exe PID 1132 wrote to memory of 1252 1132 net.exe net1.exe PID 3120 wrote to memory of 2240 3120 cmd.exe powershell.exe PID 3120 wrote to memory of 2240 3120 cmd.exe powershell.exe PID 3120 wrote to memory of 2240 3120 cmd.exe powershell.exe PID 4676 wrote to memory of 4040 4676 Envision Digital.exe cmd.exe PID 4676 wrote to memory of 4040 4676 Envision Digital.exe cmd.exe PID 4676 wrote to memory of 4040 4676 Envision Digital.exe cmd.exe PID 4676 wrote to memory of 4040 4676 Envision Digital.exe cmd.exe PID 4676 wrote to memory of 4040 4676 Envision Digital.exe cmd.exe PID 4676 wrote to memory of 4040 4676 Envision Digital.exe cmd.exe PID 4676 wrote to memory of 4040 4676 Envision Digital.exe cmd.exe PID 4676 wrote to memory of 4040 4676 Envision Digital.exe cmd.exe PID 4676 wrote to memory of 4040 4676 Envision Digital.exe cmd.exe PID 4676 wrote to memory of 4040 4676 Envision Digital.exe cmd.exe PID 4676 wrote to memory of 4040 4676 Envision Digital.exe cmd.exe PID 4676 wrote to memory of 4040 4676 Envision Digital.exe cmd.exe PID 4676 wrote to memory of 4040 4676 Envision Digital.exe cmd.exe PID 4676 wrote to memory of 4040 4676 Envision Digital.exe cmd.exe PID 4676 wrote to memory of 4040 4676 Envision Digital.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Envision Digital.exe"C:\Users\Admin\AppData\Local\Temp\Envision Digital.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\Wiupbut.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Public\Libraries\WiupbuO.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet session4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 session5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"2⤵
- Blocklisted process makes network request
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Libraries\Cdex.batFilesize
155B
MD5213c60adf1c9ef88dc3c9b2d579959d2
SHA1e4d2ad7b22b1a8b5b1f7a702b303c7364b0ee021
SHA25637c59c8398279916cfce45f8c5e3431058248f5e3bef4d9f5c0f44a7d564f82e
SHA512fe897d9caa306b0e761b2fd61bb5dc32a53bfaad1ce767c6860af4e3ad59c8f3257228a6e1072dab0f990cb51c59c648084ba419ac6bc5c0a99bdffa569217b7
-
C:\Users\Public\Libraries\WiupbuO.batFilesize
1KB
MD5df48c09f243ebcc8a165f77a1c2bf889
SHA1455f7db0adcc2a58d006f1630fb0bd55cd868c07
SHA2564ef9821678da07138c19405387f3fb95e409fbd461c7b8d847c05075facd63ca
SHA512735838c7cca953697ded48adfcd037b7f198072a8962f5940ce12e1bb1c7dd8c1f257a829276f5f5456f776f5bd13342222dd6e0dfc8f18a23f464f2c8d8f1cc
-
C:\Users\Public\Libraries\Wiupbut.batFilesize
55B
MD57a7f354e24916d4e8d330fce027c58f8
SHA1b3e2520fab475a4aa8e8c3714e2bfb75734f52c2
SHA256ca09c539ffa0f07d4b96f76cce849521f6ce6b267a23f693d92f97da8f632341
SHA51240ace6566fff2b435067a4044a2c83424d7a40074804ca719831f30a6c7234b036cd5f5ee4b1cda84e729fb74ac774d3495fe6ac0d92ca46625da226557e31d5
-
memory/1120-158-0x0000000000000000-mapping.dmp
-
memory/1132-162-0x0000000000000000-mapping.dmp
-
memory/1252-163-0x0000000000000000-mapping.dmp
-
memory/2240-172-0x0000000006950000-0x0000000006982000-memory.dmpFilesize
200KB
-
memory/2240-175-0x0000000007CF0000-0x000000000836A000-memory.dmpFilesize
6.5MB
-
memory/2240-166-0x0000000002EF0000-0x0000000002F26000-memory.dmpFilesize
216KB
-
memory/2240-167-0x0000000005670000-0x0000000005C98000-memory.dmpFilesize
6.2MB
-
memory/2240-168-0x0000000005520000-0x0000000005542000-memory.dmpFilesize
136KB
-
memory/2240-169-0x0000000005D10000-0x0000000005D76000-memory.dmpFilesize
408KB
-
memory/2240-170-0x0000000005DF0000-0x0000000005E56000-memory.dmpFilesize
408KB
-
memory/2240-171-0x00000000063A0000-0x00000000063BE000-memory.dmpFilesize
120KB
-
memory/2240-181-0x00000000079D0000-0x00000000079D8000-memory.dmpFilesize
32KB
-
memory/2240-173-0x000000006F570000-0x000000006F5BC000-memory.dmpFilesize
304KB
-
memory/2240-174-0x0000000006920000-0x000000000693E000-memory.dmpFilesize
120KB
-
memory/2240-165-0x0000000000000000-mapping.dmp
-
memory/2240-176-0x00000000076B0000-0x00000000076CA000-memory.dmpFilesize
104KB
-
memory/2240-177-0x0000000007730000-0x000000000773A000-memory.dmpFilesize
40KB
-
memory/2240-178-0x0000000007920000-0x00000000079B6000-memory.dmpFilesize
600KB
-
memory/2240-179-0x00000000078E0000-0x00000000078EE000-memory.dmpFilesize
56KB
-
memory/2240-180-0x00000000079E0000-0x00000000079FA000-memory.dmpFilesize
104KB
-
memory/3120-160-0x0000000000000000-mapping.dmp
-
memory/4040-182-0x0000000000000000-mapping.dmp
-
memory/4040-183-0x0000000050590000-0x0000000050618000-memory.dmpFilesize
544KB
-
memory/4040-184-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/4040-185-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB