Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
05-10-2022 10:38
Static task
static1
Behavioral task
behavioral1
Sample
341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4.exe
Resource
win10-20220901-en
General
-
Target
341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4.exe
-
Size
1.8MB
-
MD5
ed7fa6ec8aa0602b18ac40bf6abff7e6
-
SHA1
21f14e8533a1143001c0bc1a842cb4f9f4c69a8a
-
SHA256
341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4
-
SHA512
3388db86341f13ed30d40942df6b1844c6ebdbe7a360749edec9b23b87ca106ae90082c08648308fc9a9f78a4ffdd0c92855b090aeca52ddc00a903834d856e7
-
SSDEEP
12288:Lnjo5JZCGepoAgPBEudDgeOYnWZQzjFeM6DJOjB9sTTHyOx+mRfGrwmMeOS34MIy:6ZL0QpfnYQb6VOUROrwE
Malware Config
Extracted
remcos
RemoteHost
mam.mastercoa.co:37824
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-3FCFQU
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\Kbvypcxq = "\"C:\\Users\\Admin\\AppData\\Roaming\\Eygho\\Kbvypcxq.exe\"" 341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4.exedescription pid process target process PID 2744 set thread context of 5048 2744 341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 3436 powershell.exe 3436 powershell.exe 3436 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exe341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4.exedescription pid process Token: SeDebugPrivilege 3436 powershell.exe Token: SeDebugPrivilege 2744 341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 5048 InstallUtil.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4.exedescription pid process target process PID 2744 wrote to memory of 3436 2744 341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4.exe powershell.exe PID 2744 wrote to memory of 3436 2744 341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4.exe powershell.exe PID 2744 wrote to memory of 3436 2744 341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4.exe powershell.exe PID 2744 wrote to memory of 5048 2744 341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4.exe InstallUtil.exe PID 2744 wrote to memory of 5048 2744 341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4.exe InstallUtil.exe PID 2744 wrote to memory of 5048 2744 341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4.exe InstallUtil.exe PID 2744 wrote to memory of 5048 2744 341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4.exe InstallUtil.exe PID 2744 wrote to memory of 5048 2744 341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4.exe InstallUtil.exe PID 2744 wrote to memory of 5048 2744 341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4.exe InstallUtil.exe PID 2744 wrote to memory of 5048 2744 341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4.exe InstallUtil.exe PID 2744 wrote to memory of 5048 2744 341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4.exe InstallUtil.exe PID 2744 wrote to memory of 5048 2744 341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4.exe InstallUtil.exe PID 2744 wrote to memory of 5048 2744 341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4.exe InstallUtil.exe PID 2744 wrote to memory of 5048 2744 341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4.exe InstallUtil.exe PID 2744 wrote to memory of 5048 2744 341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4.exe"C:\Users\Admin\AppData\Local\Temp\341e2d5159578433b9509ab15c1b2acd52162a51531d8c94689286a91eebcdc4.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2744-120-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-121-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-122-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-123-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-124-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-125-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-126-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-128-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-129-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-127-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-130-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-131-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-132-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-133-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-134-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-135-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-136-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-137-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-138-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-139-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-140-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-141-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-142-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-143-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-144-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-145-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-146-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-147-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-148-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-149-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-150-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-151-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-152-0x0000000000150000-0x0000000000316000-memory.dmpFilesize
1.8MB
-
memory/2744-153-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-154-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-155-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-156-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-157-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-158-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-159-0x0000000004C10000-0x0000000004CF2000-memory.dmpFilesize
904KB
-
memory/2744-160-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-161-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-162-0x0000000005480000-0x0000000005512000-memory.dmpFilesize
584KB
-
memory/2744-163-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-164-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-165-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-166-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-167-0x0000000005570000-0x0000000005592000-memory.dmpFilesize
136KB
-
memory/2744-168-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-169-0x00000000055A0000-0x00000000058F0000-memory.dmpFilesize
3.3MB
-
memory/2744-170-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-171-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-172-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-173-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-174-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-175-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-176-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-177-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-178-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-179-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-180-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-181-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-182-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-183-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-184-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-185-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-186-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/2744-187-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/3436-188-0x0000000000000000-mapping.dmp
-
memory/3436-189-0x0000000076F80000-0x000000007710E000-memory.dmpFilesize
1.6MB
-
memory/3436-224-0x0000000004EC0000-0x0000000004EF6000-memory.dmpFilesize
216KB
-
memory/3436-229-0x0000000007650000-0x0000000007C78000-memory.dmpFilesize
6.2MB
-
memory/3436-248-0x0000000007CF0000-0x0000000007D56000-memory.dmpFilesize
408KB
-
memory/3436-249-0x0000000008080000-0x00000000080E6000-memory.dmpFilesize
408KB
-
memory/3436-252-0x0000000007E20000-0x0000000007E3C000-memory.dmpFilesize
112KB
-
memory/3436-253-0x00000000088A0000-0x00000000088EB000-memory.dmpFilesize
300KB
-
memory/3436-257-0x0000000008690000-0x0000000008706000-memory.dmpFilesize
472KB
-
memory/3436-268-0x0000000009EF0000-0x000000000A568000-memory.dmpFilesize
6.5MB
-
memory/3436-269-0x00000000094A0000-0x00000000094BA000-memory.dmpFilesize
104KB
-
memory/5048-277-0x00000000004327A4-mapping.dmp
-
memory/5048-325-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/5048-334-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB