Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
08-08-2022 11:57
Static task
static1
Behavioral task
behavioral1
Sample
FAKE SSS ID.exe
Resource
win7-20220715-en
General
-
Target
FAKE SSS ID.exe
-
Size
712KB
-
MD5
c86fd38dbe87872dbb2a51c7b950d2d1
-
SHA1
14c1977cf7606d6d969a2f77e2910a9ad22b4a7d
-
SHA256
277f3d0a1f23b0acf578e45f45cd1f1492a643ec766689ab5493463a1e3fc584
-
SHA512
d26b2d757919f95819e07017189fec3c90de571ce6b47d9aee838cd982282c662b71bb0788f972d92230761bf287982137c8067eb4441d1a8793b40776f5ec65
Malware Config
Extracted
remcos
3.1.5 Pro
NEWS
catomaaaaa.freedynamicdns.org:6603
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-670V4G
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
Photo.exePhoto.exePhoto.exePhoto.exepid process 1544 Photo.exe 1160 Photo.exe 1592 Photo.exe 1312 Photo.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
FAKE SSS ID.exePhoto.exePhoto.exedescription pid process target process PID 1752 set thread context of 1464 1752 FAKE SSS ID.exe FAKE SSS ID.exe PID 1544 set thread context of 1160 1544 Photo.exe Photo.exe PID 1592 set thread context of 1312 1592 Photo.exe Photo.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1692 schtasks.exe 536 schtasks.exe 1680 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
FAKE SSS ID.exePhoto.exePhoto.exedescription pid process Token: SeDebugPrivilege 1752 FAKE SSS ID.exe Token: SeDebugPrivilege 1544 Photo.exe Token: SeDebugPrivilege 1592 Photo.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
FAKE SSS ID.exepid process 1464 FAKE SSS ID.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
FAKE SSS ID.execmd.exetaskeng.exePhoto.execmd.exedescription pid process target process PID 1752 wrote to memory of 1464 1752 FAKE SSS ID.exe FAKE SSS ID.exe PID 1752 wrote to memory of 1464 1752 FAKE SSS ID.exe FAKE SSS ID.exe PID 1752 wrote to memory of 1464 1752 FAKE SSS ID.exe FAKE SSS ID.exe PID 1752 wrote to memory of 1464 1752 FAKE SSS ID.exe FAKE SSS ID.exe PID 1752 wrote to memory of 1464 1752 FAKE SSS ID.exe FAKE SSS ID.exe PID 1752 wrote to memory of 1464 1752 FAKE SSS ID.exe FAKE SSS ID.exe PID 1752 wrote to memory of 1464 1752 FAKE SSS ID.exe FAKE SSS ID.exe PID 1752 wrote to memory of 1464 1752 FAKE SSS ID.exe FAKE SSS ID.exe PID 1752 wrote to memory of 1464 1752 FAKE SSS ID.exe FAKE SSS ID.exe PID 1752 wrote to memory of 1464 1752 FAKE SSS ID.exe FAKE SSS ID.exe PID 1752 wrote to memory of 1464 1752 FAKE SSS ID.exe FAKE SSS ID.exe PID 1752 wrote to memory of 1464 1752 FAKE SSS ID.exe FAKE SSS ID.exe PID 1752 wrote to memory of 1464 1752 FAKE SSS ID.exe FAKE SSS ID.exe PID 1752 wrote to memory of 1112 1752 FAKE SSS ID.exe cmd.exe PID 1752 wrote to memory of 1112 1752 FAKE SSS ID.exe cmd.exe PID 1752 wrote to memory of 1112 1752 FAKE SSS ID.exe cmd.exe PID 1752 wrote to memory of 1112 1752 FAKE SSS ID.exe cmd.exe PID 1752 wrote to memory of 516 1752 FAKE SSS ID.exe cmd.exe PID 1752 wrote to memory of 516 1752 FAKE SSS ID.exe cmd.exe PID 1752 wrote to memory of 516 1752 FAKE SSS ID.exe cmd.exe PID 1752 wrote to memory of 516 1752 FAKE SSS ID.exe cmd.exe PID 1752 wrote to memory of 1672 1752 FAKE SSS ID.exe cmd.exe PID 1752 wrote to memory of 1672 1752 FAKE SSS ID.exe cmd.exe PID 1752 wrote to memory of 1672 1752 FAKE SSS ID.exe cmd.exe PID 1752 wrote to memory of 1672 1752 FAKE SSS ID.exe cmd.exe PID 516 wrote to memory of 1692 516 cmd.exe schtasks.exe PID 516 wrote to memory of 1692 516 cmd.exe schtasks.exe PID 516 wrote to memory of 1692 516 cmd.exe schtasks.exe PID 516 wrote to memory of 1692 516 cmd.exe schtasks.exe PID 1616 wrote to memory of 1544 1616 taskeng.exe Photo.exe PID 1616 wrote to memory of 1544 1616 taskeng.exe Photo.exe PID 1616 wrote to memory of 1544 1616 taskeng.exe Photo.exe PID 1616 wrote to memory of 1544 1616 taskeng.exe Photo.exe PID 1544 wrote to memory of 1160 1544 Photo.exe Photo.exe PID 1544 wrote to memory of 1160 1544 Photo.exe Photo.exe PID 1544 wrote to memory of 1160 1544 Photo.exe Photo.exe PID 1544 wrote to memory of 1160 1544 Photo.exe Photo.exe PID 1544 wrote to memory of 1160 1544 Photo.exe Photo.exe PID 1544 wrote to memory of 1160 1544 Photo.exe Photo.exe PID 1544 wrote to memory of 1160 1544 Photo.exe Photo.exe PID 1544 wrote to memory of 1160 1544 Photo.exe Photo.exe PID 1544 wrote to memory of 1160 1544 Photo.exe Photo.exe PID 1544 wrote to memory of 1160 1544 Photo.exe Photo.exe PID 1544 wrote to memory of 1160 1544 Photo.exe Photo.exe PID 1544 wrote to memory of 1160 1544 Photo.exe Photo.exe PID 1544 wrote to memory of 1160 1544 Photo.exe Photo.exe PID 1544 wrote to memory of 1104 1544 Photo.exe cmd.exe PID 1544 wrote to memory of 1104 1544 Photo.exe cmd.exe PID 1544 wrote to memory of 1104 1544 Photo.exe cmd.exe PID 1544 wrote to memory of 1104 1544 Photo.exe cmd.exe PID 1544 wrote to memory of 816 1544 Photo.exe cmd.exe PID 1544 wrote to memory of 816 1544 Photo.exe cmd.exe PID 1544 wrote to memory of 816 1544 Photo.exe cmd.exe PID 1544 wrote to memory of 816 1544 Photo.exe cmd.exe PID 1544 wrote to memory of 1900 1544 Photo.exe cmd.exe PID 1544 wrote to memory of 1900 1544 Photo.exe cmd.exe PID 1544 wrote to memory of 1900 1544 Photo.exe cmd.exe PID 1544 wrote to memory of 1900 1544 Photo.exe cmd.exe PID 816 wrote to memory of 536 816 cmd.exe schtasks.exe PID 816 wrote to memory of 536 816 cmd.exe schtasks.exe PID 816 wrote to memory of 536 816 cmd.exe schtasks.exe PID 816 wrote to memory of 536 816 cmd.exe schtasks.exe PID 1616 wrote to memory of 1592 1616 taskeng.exe Photo.exe PID 1616 wrote to memory of 1592 1616 taskeng.exe Photo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FAKE SSS ID.exe"C:\Users\Admin\AppData\Local\Temp\FAKE SSS ID.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FAKE SSS ID.exe"C:\Users\Admin\AppData\Local\Temp\FAKE SSS ID.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\Photo"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\Photo\Photo.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\Photo\Photo.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\FAKE SSS ID.exe" "C:\Users\Admin\AppData\Roaming\Photo\Photo.exe"2⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {6C68D439-DA69-4CF0-8383-868C8C5844AE} S-1-5-21-3440072777-2118400376-1759599358-1000:NKWDSIWE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Photo\Photo.exeC:\Users\Admin\AppData\Roaming\Photo\Photo.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Photo\Photo.exe"C:\Users\Admin\AppData\Roaming\Photo\Photo.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\Photo"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\Photo\Photo.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\Photo\Photo.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\Photo\Photo.exe" "C:\Users\Admin\AppData\Roaming\Photo\Photo.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\Photo\Photo.exeC:\Users\Admin\AppData\Roaming\Photo\Photo.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Photo\Photo.exe"C:\Users\Admin\AppData\Roaming\Photo\Photo.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\Photo"3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\Photo\Photo.exe'" /f3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\Photo\Photo.exe'" /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\Photo\Photo.exe" "C:\Users\Admin\AppData\Roaming\Photo\Photo.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Photo\Photo.exeFilesize
712KB
MD5c86fd38dbe87872dbb2a51c7b950d2d1
SHA114c1977cf7606d6d969a2f77e2910a9ad22b4a7d
SHA256277f3d0a1f23b0acf578e45f45cd1f1492a643ec766689ab5493463a1e3fc584
SHA512d26b2d757919f95819e07017189fec3c90de571ce6b47d9aee838cd982282c662b71bb0788f972d92230761bf287982137c8067eb4441d1a8793b40776f5ec65
-
C:\Users\Admin\AppData\Roaming\Photo\Photo.exeFilesize
712KB
MD5c86fd38dbe87872dbb2a51c7b950d2d1
SHA114c1977cf7606d6d969a2f77e2910a9ad22b4a7d
SHA256277f3d0a1f23b0acf578e45f45cd1f1492a643ec766689ab5493463a1e3fc584
SHA512d26b2d757919f95819e07017189fec3c90de571ce6b47d9aee838cd982282c662b71bb0788f972d92230761bf287982137c8067eb4441d1a8793b40776f5ec65
-
C:\Users\Admin\AppData\Roaming\Photo\Photo.exeFilesize
712KB
MD5c86fd38dbe87872dbb2a51c7b950d2d1
SHA114c1977cf7606d6d969a2f77e2910a9ad22b4a7d
SHA256277f3d0a1f23b0acf578e45f45cd1f1492a643ec766689ab5493463a1e3fc584
SHA512d26b2d757919f95819e07017189fec3c90de571ce6b47d9aee838cd982282c662b71bb0788f972d92230761bf287982137c8067eb4441d1a8793b40776f5ec65
-
C:\Users\Admin\AppData\Roaming\Photo\Photo.exeFilesize
712KB
MD5c86fd38dbe87872dbb2a51c7b950d2d1
SHA114c1977cf7606d6d969a2f77e2910a9ad22b4a7d
SHA256277f3d0a1f23b0acf578e45f45cd1f1492a643ec766689ab5493463a1e3fc584
SHA512d26b2d757919f95819e07017189fec3c90de571ce6b47d9aee838cd982282c662b71bb0788f972d92230761bf287982137c8067eb4441d1a8793b40776f5ec65
-
C:\Users\Admin\AppData\Roaming\Photo\Photo.exeFilesize
712KB
MD5c86fd38dbe87872dbb2a51c7b950d2d1
SHA114c1977cf7606d6d969a2f77e2910a9ad22b4a7d
SHA256277f3d0a1f23b0acf578e45f45cd1f1492a643ec766689ab5493463a1e3fc584
SHA512d26b2d757919f95819e07017189fec3c90de571ce6b47d9aee838cd982282c662b71bb0788f972d92230761bf287982137c8067eb4441d1a8793b40776f5ec65
-
memory/516-74-0x0000000000000000-mapping.dmp
-
memory/536-103-0x0000000000000000-mapping.dmp
-
memory/580-128-0x0000000000000000-mapping.dmp
-
memory/816-101-0x0000000000000000-mapping.dmp
-
memory/824-127-0x0000000000000000-mapping.dmp
-
memory/1104-100-0x0000000000000000-mapping.dmp
-
memory/1112-73-0x0000000000000000-mapping.dmp
-
memory/1160-109-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1160-97-0x000000000042F075-mapping.dmp
-
memory/1312-124-0x000000000042F075-mapping.dmp
-
memory/1312-132-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1464-68-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1464-69-0x000000000042F075-mapping.dmp
-
memory/1464-57-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1464-56-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1464-82-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1464-62-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1464-72-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1464-77-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1464-59-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1464-66-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1464-64-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1464-63-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1464-61-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1544-81-0x0000000000850000-0x0000000000908000-memory.dmpFilesize
736KB
-
memory/1544-79-0x0000000000000000-mapping.dmp
-
memory/1592-106-0x0000000000850000-0x0000000000908000-memory.dmpFilesize
736KB
-
memory/1592-104-0x0000000000000000-mapping.dmp
-
memory/1672-75-0x0000000000000000-mapping.dmp
-
memory/1680-133-0x0000000000000000-mapping.dmp
-
memory/1692-76-0x0000000000000000-mapping.dmp
-
memory/1752-55-0x0000000075741000-0x0000000075743000-memory.dmpFilesize
8KB
-
memory/1752-54-0x0000000000E80000-0x0000000000F38000-memory.dmpFilesize
736KB
-
memory/1900-102-0x0000000000000000-mapping.dmp
-
memory/1932-126-0x0000000000000000-mapping.dmp