Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
16-09-2022 10:23
Static task
static1
Behavioral task
behavioral1
Sample
rem order.scr.exe
Resource
win7-20220901-en
General
-
Target
rem order.scr.exe
-
Size
1.2MB
-
MD5
03b3d450a89959d30f4bfee50b157ad0
-
SHA1
0f47f3a40e0f2ababb272e54bf49fab8f0990009
-
SHA256
e1951d7c32816561ef8f00f5612a088479e1edb3a8cdbc7b7a48d8b60de5c541
-
SHA512
a5e3d89cb9c621dbb1bf89db362f064a32242a362bfd9b564f1e5d000f4b8ae6f82e1f82ddb7a44b70e6217fe760be2b67f940207b4ee9d3610f022080133d60
-
SSDEEP
24576:YlubgKHsv8FE3UkFDYukPLx1S1cayY6Hnt+I0w4hp:Y4sKMUq3Uk50l1IxyrtAwe
Malware Config
Extracted
remcos
IP-REMCOS
91.192.100.12:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-JS00ZN
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
rem order.scr.exedescription pid process target process PID 4400 set thread context of 4612 4400 rem order.scr.exe rem order.scr.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rem order.scr.exepid process 4400 rem order.scr.exe 4400 rem order.scr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
rem order.scr.exedescription pid process Token: SeDebugPrivilege 4400 rem order.scr.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
rem order.scr.exepid process 4400 rem order.scr.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
rem order.scr.exepid process 4400 rem order.scr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
rem order.scr.exepid process 4612 rem order.scr.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
rem order.scr.exedescription pid process target process PID 4400 wrote to memory of 4188 4400 rem order.scr.exe rem order.scr.exe PID 4400 wrote to memory of 4188 4400 rem order.scr.exe rem order.scr.exe PID 4400 wrote to memory of 4188 4400 rem order.scr.exe rem order.scr.exe PID 4400 wrote to memory of 4612 4400 rem order.scr.exe rem order.scr.exe PID 4400 wrote to memory of 4612 4400 rem order.scr.exe rem order.scr.exe PID 4400 wrote to memory of 4612 4400 rem order.scr.exe rem order.scr.exe PID 4400 wrote to memory of 4612 4400 rem order.scr.exe rem order.scr.exe PID 4400 wrote to memory of 4612 4400 rem order.scr.exe rem order.scr.exe PID 4400 wrote to memory of 4612 4400 rem order.scr.exe rem order.scr.exe PID 4400 wrote to memory of 4612 4400 rem order.scr.exe rem order.scr.exe PID 4400 wrote to memory of 4612 4400 rem order.scr.exe rem order.scr.exe PID 4400 wrote to memory of 4612 4400 rem order.scr.exe rem order.scr.exe PID 4400 wrote to memory of 4612 4400 rem order.scr.exe rem order.scr.exe PID 4400 wrote to memory of 4612 4400 rem order.scr.exe rem order.scr.exe PID 4400 wrote to memory of 4612 4400 rem order.scr.exe rem order.scr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\rem order.scr.exe"C:\Users\Admin\AppData\Local\Temp\rem order.scr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rem order.scr.exe"C:\Users\Admin\AppData\Local\Temp\rem order.scr.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\rem order.scr.exe"C:\Users\Admin\AppData\Local\Temp\rem order.scr.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4188-138-0x0000000000000000-mapping.dmp
-
memory/4400-135-0x0000000005380000-0x000000000538A000-memory.dmpFilesize
40KB
-
memory/4400-134-0x0000000005410000-0x00000000054A2000-memory.dmpFilesize
584KB
-
memory/4400-132-0x00000000008A0000-0x00000000009DE000-memory.dmpFilesize
1.2MB
-
memory/4400-136-0x0000000009000000-0x000000000909C000-memory.dmpFilesize
624KB
-
memory/4400-137-0x00000000090A0000-0x0000000009106000-memory.dmpFilesize
408KB
-
memory/4400-133-0x00000000059C0000-0x0000000005F64000-memory.dmpFilesize
5.6MB
-
memory/4612-139-0x0000000000000000-mapping.dmp
-
memory/4612-140-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4612-141-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4612-142-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4612-143-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4612-144-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB