Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
08-08-2022 11:57
Static task
static1
Behavioral task
behavioral1
Sample
FAKE SSS ID.exe
Resource
win7-20220715-en
General
-
Target
FAKE SSS ID.exe
-
Size
712KB
-
MD5
c86fd38dbe87872dbb2a51c7b950d2d1
-
SHA1
14c1977cf7606d6d969a2f77e2910a9ad22b4a7d
-
SHA256
277f3d0a1f23b0acf578e45f45cd1f1492a643ec766689ab5493463a1e3fc584
-
SHA512
d26b2d757919f95819e07017189fec3c90de571ce6b47d9aee838cd982282c662b71bb0788f972d92230761bf287982137c8067eb4441d1a8793b40776f5ec65
Malware Config
Extracted
remcos
3.1.5 Pro
NEWS
catomaaaaa.freedynamicdns.org:6603
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-670V4G
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
Photo.exePhoto.exePhoto.exePhoto.exepid process 1972 Photo.exe 1056 Photo.exe 3728 Photo.exe 2648 Photo.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
FAKE SSS ID.exePhoto.exePhoto.exedescription pid process target process PID 4536 set thread context of 4296 4536 FAKE SSS ID.exe FAKE SSS ID.exe PID 1972 set thread context of 1056 1972 Photo.exe Photo.exe PID 3728 set thread context of 2648 3728 Photo.exe Photo.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2100 schtasks.exe 1500 schtasks.exe 3940 schtasks.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
FAKE SSS ID.exepid process 4296 FAKE SSS ID.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
FAKE SSS ID.exePhoto.exePhoto.exedescription pid process Token: SeDebugPrivilege 4536 FAKE SSS ID.exe Token: SeDebugPrivilege 1972 Photo.exe Token: SeDebugPrivilege 3728 Photo.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
FAKE SSS ID.exepid process 4296 FAKE SSS ID.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
FAKE SSS ID.execmd.exePhoto.execmd.exePhoto.exedescription pid process target process PID 4536 wrote to memory of 4296 4536 FAKE SSS ID.exe FAKE SSS ID.exe PID 4536 wrote to memory of 4296 4536 FAKE SSS ID.exe FAKE SSS ID.exe PID 4536 wrote to memory of 4296 4536 FAKE SSS ID.exe FAKE SSS ID.exe PID 4536 wrote to memory of 4296 4536 FAKE SSS ID.exe FAKE SSS ID.exe PID 4536 wrote to memory of 4296 4536 FAKE SSS ID.exe FAKE SSS ID.exe PID 4536 wrote to memory of 4296 4536 FAKE SSS ID.exe FAKE SSS ID.exe PID 4536 wrote to memory of 4296 4536 FAKE SSS ID.exe FAKE SSS ID.exe PID 4536 wrote to memory of 4296 4536 FAKE SSS ID.exe FAKE SSS ID.exe PID 4536 wrote to memory of 4296 4536 FAKE SSS ID.exe FAKE SSS ID.exe PID 4536 wrote to memory of 4296 4536 FAKE SSS ID.exe FAKE SSS ID.exe PID 4536 wrote to memory of 4296 4536 FAKE SSS ID.exe FAKE SSS ID.exe PID 4536 wrote to memory of 4296 4536 FAKE SSS ID.exe FAKE SSS ID.exe PID 4536 wrote to memory of 3304 4536 FAKE SSS ID.exe cmd.exe PID 4536 wrote to memory of 3304 4536 FAKE SSS ID.exe cmd.exe PID 4536 wrote to memory of 3304 4536 FAKE SSS ID.exe cmd.exe PID 4536 wrote to memory of 1076 4536 FAKE SSS ID.exe cmd.exe PID 4536 wrote to memory of 1076 4536 FAKE SSS ID.exe cmd.exe PID 4536 wrote to memory of 1076 4536 FAKE SSS ID.exe cmd.exe PID 4536 wrote to memory of 3076 4536 FAKE SSS ID.exe cmd.exe PID 4536 wrote to memory of 3076 4536 FAKE SSS ID.exe cmd.exe PID 4536 wrote to memory of 3076 4536 FAKE SSS ID.exe cmd.exe PID 1076 wrote to memory of 2100 1076 cmd.exe schtasks.exe PID 1076 wrote to memory of 2100 1076 cmd.exe schtasks.exe PID 1076 wrote to memory of 2100 1076 cmd.exe schtasks.exe PID 1972 wrote to memory of 1056 1972 Photo.exe Photo.exe PID 1972 wrote to memory of 1056 1972 Photo.exe Photo.exe PID 1972 wrote to memory of 1056 1972 Photo.exe Photo.exe PID 1972 wrote to memory of 1056 1972 Photo.exe Photo.exe PID 1972 wrote to memory of 1056 1972 Photo.exe Photo.exe PID 1972 wrote to memory of 1056 1972 Photo.exe Photo.exe PID 1972 wrote to memory of 1056 1972 Photo.exe Photo.exe PID 1972 wrote to memory of 1056 1972 Photo.exe Photo.exe PID 1972 wrote to memory of 1056 1972 Photo.exe Photo.exe PID 1972 wrote to memory of 1056 1972 Photo.exe Photo.exe PID 1972 wrote to memory of 1056 1972 Photo.exe Photo.exe PID 1972 wrote to memory of 1056 1972 Photo.exe Photo.exe PID 1972 wrote to memory of 1816 1972 Photo.exe cmd.exe PID 1972 wrote to memory of 1816 1972 Photo.exe cmd.exe PID 1972 wrote to memory of 1816 1972 Photo.exe cmd.exe PID 1972 wrote to memory of 1372 1972 Photo.exe cmd.exe PID 1972 wrote to memory of 1372 1972 Photo.exe cmd.exe PID 1972 wrote to memory of 1372 1972 Photo.exe cmd.exe PID 1972 wrote to memory of 3760 1972 Photo.exe cmd.exe PID 1972 wrote to memory of 3760 1972 Photo.exe cmd.exe PID 1972 wrote to memory of 3760 1972 Photo.exe cmd.exe PID 1372 wrote to memory of 1500 1372 cmd.exe schtasks.exe PID 1372 wrote to memory of 1500 1372 cmd.exe schtasks.exe PID 1372 wrote to memory of 1500 1372 cmd.exe schtasks.exe PID 3728 wrote to memory of 2648 3728 Photo.exe Photo.exe PID 3728 wrote to memory of 2648 3728 Photo.exe Photo.exe PID 3728 wrote to memory of 2648 3728 Photo.exe Photo.exe PID 3728 wrote to memory of 2648 3728 Photo.exe Photo.exe PID 3728 wrote to memory of 2648 3728 Photo.exe Photo.exe PID 3728 wrote to memory of 2648 3728 Photo.exe Photo.exe PID 3728 wrote to memory of 2648 3728 Photo.exe Photo.exe PID 3728 wrote to memory of 2648 3728 Photo.exe Photo.exe PID 3728 wrote to memory of 2648 3728 Photo.exe Photo.exe PID 3728 wrote to memory of 2648 3728 Photo.exe Photo.exe PID 3728 wrote to memory of 2648 3728 Photo.exe Photo.exe PID 3728 wrote to memory of 2648 3728 Photo.exe Photo.exe PID 3728 wrote to memory of 4656 3728 Photo.exe cmd.exe PID 3728 wrote to memory of 4656 3728 Photo.exe cmd.exe PID 3728 wrote to memory of 4656 3728 Photo.exe cmd.exe PID 3728 wrote to memory of 3432 3728 Photo.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FAKE SSS ID.exe"C:\Users\Admin\AppData\Local\Temp\FAKE SSS ID.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FAKE SSS ID.exe"C:\Users\Admin\AppData\Local\Temp\FAKE SSS ID.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\Photo"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\FAKE SSS ID.exe" "C:\Users\Admin\AppData\Roaming\Photo\Photo.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\Photo\Photo.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\Photo\Photo.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Photo\Photo.exeC:\Users\Admin\AppData\Roaming\Photo\Photo.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Photo\Photo.exe"C:\Users\Admin\AppData\Roaming\Photo\Photo.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\Photo"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\Photo\Photo.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\Photo\Photo.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\Photo\Photo.exe" "C:\Users\Admin\AppData\Roaming\Photo\Photo.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\Photo\Photo.exeC:\Users\Admin\AppData\Roaming\Photo\Photo.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Photo\Photo.exe"C:\Users\Admin\AppData\Roaming\Photo\Photo.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\Photo"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\Photo\Photo.exe'" /f2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\Photo\Photo.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\Photo\Photo.exe" "C:\Users\Admin\AppData\Roaming\Photo\Photo.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Photo.exe.logFilesize
520B
MD503febbff58da1d3318c31657d89c8542
SHA1c9e017bd9d0a4fe533795b227c855935d86c2092
SHA2565164770a37b199a79ccd23b399bb3309228973d9f74c589bc2623dc613b37ac4
SHA5123750c372bbca1892e9c1b34681d592c693e725a8b149c3d6938079cd467628cec42c4293b0d886b57a786abf45f5e7229247b3445001774e3e793ff5a3accfa3
-
C:\Users\Admin\AppData\Roaming\Photo\Photo.exeFilesize
712KB
MD5c86fd38dbe87872dbb2a51c7b950d2d1
SHA114c1977cf7606d6d969a2f77e2910a9ad22b4a7d
SHA256277f3d0a1f23b0acf578e45f45cd1f1492a643ec766689ab5493463a1e3fc584
SHA512d26b2d757919f95819e07017189fec3c90de571ce6b47d9aee838cd982282c662b71bb0788f972d92230761bf287982137c8067eb4441d1a8793b40776f5ec65
-
C:\Users\Admin\AppData\Roaming\Photo\Photo.exeFilesize
712KB
MD5c86fd38dbe87872dbb2a51c7b950d2d1
SHA114c1977cf7606d6d969a2f77e2910a9ad22b4a7d
SHA256277f3d0a1f23b0acf578e45f45cd1f1492a643ec766689ab5493463a1e3fc584
SHA512d26b2d757919f95819e07017189fec3c90de571ce6b47d9aee838cd982282c662b71bb0788f972d92230761bf287982137c8067eb4441d1a8793b40776f5ec65
-
C:\Users\Admin\AppData\Roaming\Photo\Photo.exeFilesize
712KB
MD5c86fd38dbe87872dbb2a51c7b950d2d1
SHA114c1977cf7606d6d969a2f77e2910a9ad22b4a7d
SHA256277f3d0a1f23b0acf578e45f45cd1f1492a643ec766689ab5493463a1e3fc584
SHA512d26b2d757919f95819e07017189fec3c90de571ce6b47d9aee838cd982282c662b71bb0788f972d92230761bf287982137c8067eb4441d1a8793b40776f5ec65
-
C:\Users\Admin\AppData\Roaming\Photo\Photo.exeFilesize
712KB
MD5c86fd38dbe87872dbb2a51c7b950d2d1
SHA114c1977cf7606d6d969a2f77e2910a9ad22b4a7d
SHA256277f3d0a1f23b0acf578e45f45cd1f1492a643ec766689ab5493463a1e3fc584
SHA512d26b2d757919f95819e07017189fec3c90de571ce6b47d9aee838cd982282c662b71bb0788f972d92230761bf287982137c8067eb4441d1a8793b40776f5ec65
-
C:\Users\Admin\AppData\Roaming\Photo\Photo.exeFilesize
712KB
MD5c86fd38dbe87872dbb2a51c7b950d2d1
SHA114c1977cf7606d6d969a2f77e2910a9ad22b4a7d
SHA256277f3d0a1f23b0acf578e45f45cd1f1492a643ec766689ab5493463a1e3fc584
SHA512d26b2d757919f95819e07017189fec3c90de571ce6b47d9aee838cd982282c662b71bb0788f972d92230761bf287982137c8067eb4441d1a8793b40776f5ec65
-
memory/796-164-0x0000000000000000-mapping.dmp
-
memory/1056-148-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1056-150-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1056-145-0x0000000000000000-mapping.dmp
-
memory/1056-149-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/1076-136-0x0000000000000000-mapping.dmp
-
memory/1372-152-0x0000000000000000-mapping.dmp
-
memory/1500-154-0x0000000000000000-mapping.dmp
-
memory/1816-151-0x0000000000000000-mapping.dmp
-
memory/1972-143-0x0000000000C80000-0x0000000000D38000-memory.dmpFilesize
736KB
-
memory/2100-139-0x0000000000000000-mapping.dmp
-
memory/2648-157-0x0000000000000000-mapping.dmp
-
memory/2648-161-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/2648-165-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/2648-162-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/3076-138-0x0000000000000000-mapping.dmp
-
memory/3304-134-0x0000000000000000-mapping.dmp
-
memory/3432-163-0x0000000000000000-mapping.dmp
-
memory/3760-153-0x0000000000000000-mapping.dmp
-
memory/3940-166-0x0000000000000000-mapping.dmp
-
memory/4296-135-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/4296-137-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/4296-132-0x0000000000000000-mapping.dmp
-
memory/4296-140-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/4296-133-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/4296-144-0x0000000000400000-0x0000000000479000-memory.dmpFilesize
484KB
-
memory/4536-131-0x00000000057C0000-0x0000000005D64000-memory.dmpFilesize
5.6MB
-
memory/4536-130-0x0000000000540000-0x00000000005F8000-memory.dmpFilesize
736KB
-
memory/4656-160-0x0000000000000000-mapping.dmp