Analysis
-
max time kernel
55s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
06-08-2022 08:07
Static task
static1
Behavioral task
behavioral1
Sample
3bc08e00ecef320c41b327060c3cbd2e.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
3bc08e00ecef320c41b327060c3cbd2e.exe
Resource
win10v2004-20220722-en
General
-
Target
3bc08e00ecef320c41b327060c3cbd2e.exe
-
Size
1.0MB
-
MD5
3bc08e00ecef320c41b327060c3cbd2e
-
SHA1
9806b730358b838eb355efb793b657ff2ecc570a
-
SHA256
fb1947ffed6c5538fc714caa887ad1ef47185a1e76fac318cd7b7a8216561619
-
SHA512
d96d9385297541bac6e7833384ca54601061cc9425c4f7e57a0071796f1cf605110ee38839e9d93275986b000ee4a8e66ab7c1255c3e475ea96d3574c24b95e9
Malware Config
Extracted
remcos
RemoteHost
37.0.14.206:3352
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Remcos-SSCE3Q
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
remcos.exepid process 1152 remcos.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 524 cmd.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
MSBuild.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ MSBuild.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" MSBuild.exe Key created \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\ MSBuild.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" MSBuild.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3bc08e00ecef320c41b327060c3cbd2e.exedescription pid process target process PID 1180 set thread context of 1120 1180 3bc08e00ecef320c41b327060c3cbd2e.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
3bc08e00ecef320c41b327060c3cbd2e.exepowershell.exepid process 1180 3bc08e00ecef320c41b327060c3cbd2e.exe 1180 3bc08e00ecef320c41b327060c3cbd2e.exe 1180 3bc08e00ecef320c41b327060c3cbd2e.exe 1180 3bc08e00ecef320c41b327060c3cbd2e.exe 948 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
3bc08e00ecef320c41b327060c3cbd2e.exepowershell.exedescription pid process Token: SeDebugPrivilege 1180 3bc08e00ecef320c41b327060c3cbd2e.exe Token: SeDebugPrivilege 948 powershell.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
3bc08e00ecef320c41b327060c3cbd2e.exeMSBuild.exeWScript.execmd.exedescription pid process target process PID 1180 wrote to memory of 948 1180 3bc08e00ecef320c41b327060c3cbd2e.exe powershell.exe PID 1180 wrote to memory of 948 1180 3bc08e00ecef320c41b327060c3cbd2e.exe powershell.exe PID 1180 wrote to memory of 948 1180 3bc08e00ecef320c41b327060c3cbd2e.exe powershell.exe PID 1180 wrote to memory of 948 1180 3bc08e00ecef320c41b327060c3cbd2e.exe powershell.exe PID 1180 wrote to memory of 1592 1180 3bc08e00ecef320c41b327060c3cbd2e.exe schtasks.exe PID 1180 wrote to memory of 1592 1180 3bc08e00ecef320c41b327060c3cbd2e.exe schtasks.exe PID 1180 wrote to memory of 1592 1180 3bc08e00ecef320c41b327060c3cbd2e.exe schtasks.exe PID 1180 wrote to memory of 1592 1180 3bc08e00ecef320c41b327060c3cbd2e.exe schtasks.exe PID 1180 wrote to memory of 1692 1180 3bc08e00ecef320c41b327060c3cbd2e.exe MSBuild.exe PID 1180 wrote to memory of 1692 1180 3bc08e00ecef320c41b327060c3cbd2e.exe MSBuild.exe PID 1180 wrote to memory of 1692 1180 3bc08e00ecef320c41b327060c3cbd2e.exe MSBuild.exe PID 1180 wrote to memory of 1692 1180 3bc08e00ecef320c41b327060c3cbd2e.exe MSBuild.exe PID 1180 wrote to memory of 1120 1180 3bc08e00ecef320c41b327060c3cbd2e.exe MSBuild.exe PID 1180 wrote to memory of 1120 1180 3bc08e00ecef320c41b327060c3cbd2e.exe MSBuild.exe PID 1180 wrote to memory of 1120 1180 3bc08e00ecef320c41b327060c3cbd2e.exe MSBuild.exe PID 1180 wrote to memory of 1120 1180 3bc08e00ecef320c41b327060c3cbd2e.exe MSBuild.exe PID 1180 wrote to memory of 1120 1180 3bc08e00ecef320c41b327060c3cbd2e.exe MSBuild.exe PID 1180 wrote to memory of 1120 1180 3bc08e00ecef320c41b327060c3cbd2e.exe MSBuild.exe PID 1180 wrote to memory of 1120 1180 3bc08e00ecef320c41b327060c3cbd2e.exe MSBuild.exe PID 1180 wrote to memory of 1120 1180 3bc08e00ecef320c41b327060c3cbd2e.exe MSBuild.exe PID 1180 wrote to memory of 1120 1180 3bc08e00ecef320c41b327060c3cbd2e.exe MSBuild.exe PID 1180 wrote to memory of 1120 1180 3bc08e00ecef320c41b327060c3cbd2e.exe MSBuild.exe PID 1180 wrote to memory of 1120 1180 3bc08e00ecef320c41b327060c3cbd2e.exe MSBuild.exe PID 1180 wrote to memory of 1120 1180 3bc08e00ecef320c41b327060c3cbd2e.exe MSBuild.exe PID 1180 wrote to memory of 1120 1180 3bc08e00ecef320c41b327060c3cbd2e.exe MSBuild.exe PID 1120 wrote to memory of 1484 1120 MSBuild.exe WScript.exe PID 1120 wrote to memory of 1484 1120 MSBuild.exe WScript.exe PID 1120 wrote to memory of 1484 1120 MSBuild.exe WScript.exe PID 1120 wrote to memory of 1484 1120 MSBuild.exe WScript.exe PID 1484 wrote to memory of 524 1484 WScript.exe cmd.exe PID 1484 wrote to memory of 524 1484 WScript.exe cmd.exe PID 1484 wrote to memory of 524 1484 WScript.exe cmd.exe PID 1484 wrote to memory of 524 1484 WScript.exe cmd.exe PID 524 wrote to memory of 1152 524 cmd.exe remcos.exe PID 524 wrote to memory of 1152 524 cmd.exe remcos.exe PID 524 wrote to memory of 1152 524 cmd.exe remcos.exe PID 524 wrote to memory of 1152 524 cmd.exe remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bc08e00ecef320c41b327060c3cbd2e.exe"C:\Users\Admin\AppData\Local\Temp\3bc08e00ecef320c41b327060c3cbd2e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xWKkbJbWKdl.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xWKkbJbWKdl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9F4C.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Remcos\remcos.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Remcos\remcos.exeC:\ProgramData\Remcos\remcos.exe5⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Remcos\remcos.exeFilesize
255KB
MD59af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
C:\ProgramData\Remcos\remcos.exeFilesize
255KB
MD59af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
C:\Users\Admin\AppData\Local\Temp\install.vbsFilesize
386B
MD51ec6289c6fd4c2ded6b2836ed28cbeb5
SHA1c4e08195e6c640eb8860acc03fda1d649b4fe070
SHA2566efdc40f9eb217f879607614e928b65bff759e424f3efb31faceb2a043c32dc2
SHA51220bc46f4dee22f75f15c402c7c2eaee60fff7dd92548050585571dcbefd59485cc249c06bc3f1aac7a138e5ae67c0c3918b46ffa24c8b0f1b092e2f6b6e21288
-
C:\Users\Admin\AppData\Local\Temp\tmp9F4C.tmpFilesize
1KB
MD51f2b274cbfe01b1f33ff718492b480f0
SHA100be4a207f59b36af967827263caeee7143139e0
SHA2569b84f4280123452f8cfe602be4fbab3a161b95d39f7d079c6dfb119b0a605c15
SHA51272bec8842e1c6dbcfb3e3f52204ed1edfe1637db548d4d70ee259f777744b22c0f4eed2189d0e8509fd4f438c30886705c0b1f5126324b494c1409800ea7fad2
-
\ProgramData\Remcos\remcos.exeFilesize
255KB
MD59af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
memory/524-87-0x0000000000000000-mapping.dmp
-
memory/948-59-0x0000000000000000-mapping.dmp
-
memory/948-86-0x000000006DDF0000-0x000000006E39B000-memory.dmpFilesize
5.7MB
-
memory/948-85-0x000000006DDF0000-0x000000006E39B000-memory.dmpFilesize
5.7MB
-
memory/1120-71-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1120-74-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1120-67-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1120-69-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1120-70-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1120-64-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1120-72-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1120-65-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1120-77-0x000000000043168C-mapping.dmp
-
memory/1120-76-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1120-80-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1120-82-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1152-90-0x0000000000000000-mapping.dmp
-
memory/1152-92-0x0000000000890000-0x00000000008D0000-memory.dmpFilesize
256KB
-
memory/1180-58-0x0000000005EF0000-0x0000000005FB6000-memory.dmpFilesize
792KB
-
memory/1180-63-0x000000000A3A0000-0x000000000A41A000-memory.dmpFilesize
488KB
-
memory/1180-57-0x00000000006B0000-0x00000000006BA000-memory.dmpFilesize
40KB
-
memory/1180-56-0x0000000000500000-0x0000000000516000-memory.dmpFilesize
88KB
-
memory/1180-55-0x0000000075481000-0x0000000075483000-memory.dmpFilesize
8KB
-
memory/1180-54-0x0000000000C10000-0x0000000000D1E000-memory.dmpFilesize
1.1MB
-
memory/1484-81-0x0000000000000000-mapping.dmp
-
memory/1592-60-0x0000000000000000-mapping.dmp