Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-10-2022 16:28
Static task
static1
Behavioral task
behavioral1
Sample
Scanned PO N402201321.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Scanned PO N402201321.exe
Resource
win10v2004-20220812-en
General
-
Target
Scanned PO N402201321.exe
-
Size
1.1MB
-
MD5
be5a3dcd8ac544cc9a5eac17daf5d813
-
SHA1
aa1317d65deca8bd330018e85000069288ce6afc
-
SHA256
70deba92a46f6f3913b10be9eeacfe0c0b89177d4ca6041012bc446ca9bd0acf
-
SHA512
77f0f34476d41108d2bb8d1009c08eb61d906cd13aad9bc3f397ad9d6d96a5f8bcd55181c90b231c707b71a175d531a952649bed9f302d658fb0338754ac5909
-
SSDEEP
24576:QSbKwOzzwHsOzj4j85M1hUQDAxzJX44ws8:QSnJsOzj4jGM1aK4FXys
Malware Config
Extracted
remcos
RemoteHost
harjahwool.ddnsfree.com:8372
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-EGNT8M
-
screenshot_crypt
true
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\ganmuio.exe," reg.exe -
Executes dropped EXE 3 IoCs
Processes:
ganmuio.exegreUgKja.exegreUgKja.exepid process 1508 ganmuio.exe 1632 greUgKja.exe 1520 greUgKja.exe -
Loads dropped DLL 3 IoCs
Processes:
cmd.exeganmuio.exegreUgKja.exepid process 1808 cmd.exe 1508 ganmuio.exe 1632 greUgKja.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ganmuio.exedescription pid process target process PID 1508 set thread context of 1484 1508 ganmuio.exe AddInProcess32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 3 IoCs
Processes:
PING.EXEPING.EXEPING.EXEpid process 864 PING.EXE 1756 PING.EXE 1744 PING.EXE -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
Scanned PO N402201321.exeganmuio.exegreUgKja.exegreUgKja.exepid process 1672 Scanned PO N402201321.exe 1672 Scanned PO N402201321.exe 1672 Scanned PO N402201321.exe 1508 ganmuio.exe 1508 ganmuio.exe 1508 ganmuio.exe 1632 greUgKja.exe 1520 greUgKja.exe 1520 greUgKja.exe 1520 greUgKja.exe 1508 ganmuio.exe 1508 ganmuio.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
Scanned PO N402201321.exeganmuio.exeAUDIODG.EXEgreUgKja.exegreUgKja.exedescription pid process Token: SeDebugPrivilege 1672 Scanned PO N402201321.exe Token: SeDebugPrivilege 1508 ganmuio.exe Token: 33 1452 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1452 AUDIODG.EXE Token: 33 1452 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1452 AUDIODG.EXE Token: SeDebugPrivilege 1632 greUgKja.exe Token: SeDebugPrivilege 1520 greUgKja.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
AddInProcess32.exepid process 1484 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 49 IoCs
Processes:
Scanned PO N402201321.execmd.execmd.exeganmuio.exegreUgKja.exedescription pid process target process PID 1672 wrote to memory of 1640 1672 Scanned PO N402201321.exe cmd.exe PID 1672 wrote to memory of 1640 1672 Scanned PO N402201321.exe cmd.exe PID 1672 wrote to memory of 1640 1672 Scanned PO N402201321.exe cmd.exe PID 1672 wrote to memory of 1640 1672 Scanned PO N402201321.exe cmd.exe PID 1640 wrote to memory of 864 1640 cmd.exe PING.EXE PID 1640 wrote to memory of 864 1640 cmd.exe PING.EXE PID 1640 wrote to memory of 864 1640 cmd.exe PING.EXE PID 1640 wrote to memory of 864 1640 cmd.exe PING.EXE PID 1672 wrote to memory of 1808 1672 Scanned PO N402201321.exe cmd.exe PID 1672 wrote to memory of 1808 1672 Scanned PO N402201321.exe cmd.exe PID 1672 wrote to memory of 1808 1672 Scanned PO N402201321.exe cmd.exe PID 1672 wrote to memory of 1808 1672 Scanned PO N402201321.exe cmd.exe PID 1808 wrote to memory of 1756 1808 cmd.exe PING.EXE PID 1808 wrote to memory of 1756 1808 cmd.exe PING.EXE PID 1808 wrote to memory of 1756 1808 cmd.exe PING.EXE PID 1808 wrote to memory of 1756 1808 cmd.exe PING.EXE PID 1640 wrote to memory of 1156 1640 cmd.exe reg.exe PID 1640 wrote to memory of 1156 1640 cmd.exe reg.exe PID 1640 wrote to memory of 1156 1640 cmd.exe reg.exe PID 1640 wrote to memory of 1156 1640 cmd.exe reg.exe PID 1808 wrote to memory of 1744 1808 cmd.exe PING.EXE PID 1808 wrote to memory of 1744 1808 cmd.exe PING.EXE PID 1808 wrote to memory of 1744 1808 cmd.exe PING.EXE PID 1808 wrote to memory of 1744 1808 cmd.exe PING.EXE PID 1808 wrote to memory of 1508 1808 cmd.exe ganmuio.exe PID 1808 wrote to memory of 1508 1808 cmd.exe ganmuio.exe PID 1808 wrote to memory of 1508 1808 cmd.exe ganmuio.exe PID 1808 wrote to memory of 1508 1808 cmd.exe ganmuio.exe PID 1508 wrote to memory of 1484 1508 ganmuio.exe AddInProcess32.exe PID 1508 wrote to memory of 1484 1508 ganmuio.exe AddInProcess32.exe PID 1508 wrote to memory of 1484 1508 ganmuio.exe AddInProcess32.exe PID 1508 wrote to memory of 1484 1508 ganmuio.exe AddInProcess32.exe PID 1508 wrote to memory of 1484 1508 ganmuio.exe AddInProcess32.exe PID 1508 wrote to memory of 1484 1508 ganmuio.exe AddInProcess32.exe PID 1508 wrote to memory of 1484 1508 ganmuio.exe AddInProcess32.exe PID 1508 wrote to memory of 1484 1508 ganmuio.exe AddInProcess32.exe PID 1508 wrote to memory of 1484 1508 ganmuio.exe AddInProcess32.exe PID 1508 wrote to memory of 1484 1508 ganmuio.exe AddInProcess32.exe PID 1508 wrote to memory of 1484 1508 ganmuio.exe AddInProcess32.exe PID 1508 wrote to memory of 1484 1508 ganmuio.exe AddInProcess32.exe PID 1508 wrote to memory of 1484 1508 ganmuio.exe AddInProcess32.exe PID 1508 wrote to memory of 1632 1508 ganmuio.exe greUgKja.exe PID 1508 wrote to memory of 1632 1508 ganmuio.exe greUgKja.exe PID 1508 wrote to memory of 1632 1508 ganmuio.exe greUgKja.exe PID 1508 wrote to memory of 1632 1508 ganmuio.exe greUgKja.exe PID 1632 wrote to memory of 1520 1632 greUgKja.exe greUgKja.exe PID 1632 wrote to memory of 1520 1632 greUgKja.exe greUgKja.exe PID 1632 wrote to memory of 1520 1632 greUgKja.exe greUgKja.exe PID 1632 wrote to memory of 1520 1632 greUgKja.exe greUgKja.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Scanned PO N402201321.exe"C:\Users\Admin\AppData\Local\Temp\Scanned PO N402201321.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 6 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\ganmuio.exe,"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 63⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\ganmuio.exe,"3⤵
- Modifies WinLogon for persistence
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 11 > nul && copy "C:\Users\Admin\AppData\Local\Temp\Scanned PO N402201321.exe" "C:\Users\Admin\AppData\Roaming\ganmuio.exe" && ping 127.0.0.1 -n 11 > nul && "C:\Users\Admin\AppData\Roaming\ganmuio.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 113⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 113⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\ganmuio.exe"C:\Users\Admin\AppData\Roaming\ganmuio.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\greUgKja.exe"C:\Users\Admin\AppData\Local\Temp\greUgKja.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\greUgKja.exe"C:\Users\Admin\AppData\Local\Temp\greUgKja.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1bc1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\greUgKja.exeFilesize
76KB
MD50e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
C:\Users\Admin\AppData\Local\Temp\greUgKja.exeFilesize
76KB
MD50e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
C:\Users\Admin\AppData\Local\Temp\greUgKja.exeFilesize
76KB
MD50e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
C:\Users\Admin\AppData\Local\Temp\greUgKja.txtFilesize
56B
MD5809043113a4d84e53c2e840f7c938fc8
SHA1c1211aac9dd59cf4a817dfe9962f2d9a8adc0ce9
SHA2562ec2d4e2d046c45faf8308cdd85cd615ae28c2a31c25fac4704918c678b0023f
SHA51288c388b72ce90644871ab4da274ecfe4535c9ba910867a30db8b5538c419ec97e51fc4ed34673fd8ccbf0973aec70e2eb2edff0d62850d0512ca0944537400df
-
C:\Users\Admin\AppData\Local\Temp\greUgKja.txtFilesize
56B
MD5809043113a4d84e53c2e840f7c938fc8
SHA1c1211aac9dd59cf4a817dfe9962f2d9a8adc0ce9
SHA2562ec2d4e2d046c45faf8308cdd85cd615ae28c2a31c25fac4704918c678b0023f
SHA51288c388b72ce90644871ab4da274ecfe4535c9ba910867a30db8b5538c419ec97e51fc4ed34673fd8ccbf0973aec70e2eb2edff0d62850d0512ca0944537400df
-
C:\Users\Admin\AppData\Local\Temp\greUgKja.txtFilesize
56B
MD57c09b2a5ccaa88c844efdf65ed84d8e1
SHA15bdf9158aae89bd0efa68e01bfd845a4535a3937
SHA25683b49f79e67803744ff29e4a115dcdd60ddffc12ebd9ce482820fe9dcd5abc7e
SHA512994288e41e2818717724a8f1ee304389d89668be15f1a449c19997902c747bdf855662cbce7a8234dec80314a99aeb083c12a95555ef994037f08d2a112c6d93
-
C:\Users\Admin\AppData\Roaming\ganmuio.exeFilesize
1.1MB
MD5be5a3dcd8ac544cc9a5eac17daf5d813
SHA1aa1317d65deca8bd330018e85000069288ce6afc
SHA25670deba92a46f6f3913b10be9eeacfe0c0b89177d4ca6041012bc446ca9bd0acf
SHA51277f0f34476d41108d2bb8d1009c08eb61d906cd13aad9bc3f397ad9d6d96a5f8bcd55181c90b231c707b71a175d531a952649bed9f302d658fb0338754ac5909
-
C:\Users\Admin\AppData\Roaming\ganmuio.exeFilesize
1.1MB
MD5be5a3dcd8ac544cc9a5eac17daf5d813
SHA1aa1317d65deca8bd330018e85000069288ce6afc
SHA25670deba92a46f6f3913b10be9eeacfe0c0b89177d4ca6041012bc446ca9bd0acf
SHA51277f0f34476d41108d2bb8d1009c08eb61d906cd13aad9bc3f397ad9d6d96a5f8bcd55181c90b231c707b71a175d531a952649bed9f302d658fb0338754ac5909
-
\Users\Admin\AppData\Local\Temp\greUgKja.exeFilesize
76KB
MD50e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
\Users\Admin\AppData\Local\Temp\greUgKja.exeFilesize
76KB
MD50e362e7005823d0bec3719b902ed6d62
SHA1590d860b909804349e0cdc2f1662b37bd62f7463
SHA2562d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad
SHA512518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3
-
\Users\Admin\AppData\Roaming\ganmuio.exeFilesize
1.1MB
MD5be5a3dcd8ac544cc9a5eac17daf5d813
SHA1aa1317d65deca8bd330018e85000069288ce6afc
SHA25670deba92a46f6f3913b10be9eeacfe0c0b89177d4ca6041012bc446ca9bd0acf
SHA51277f0f34476d41108d2bb8d1009c08eb61d906cd13aad9bc3f397ad9d6d96a5f8bcd55181c90b231c707b71a175d531a952649bed9f302d658fb0338754ac5909
-
memory/864-59-0x0000000000000000-mapping.dmp
-
memory/1156-62-0x0000000000000000-mapping.dmp
-
memory/1484-84-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1484-82-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1484-88-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1484-85-0x00000000004327A4-mapping.dmp
-
memory/1484-72-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1484-73-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1484-75-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1484-77-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1484-78-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1484-79-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1484-80-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1484-89-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1484-102-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1508-68-0x0000000000140000-0x0000000000258000-memory.dmpFilesize
1.1MB
-
memory/1508-65-0x0000000000000000-mapping.dmp
-
memory/1508-71-0x0000000004110000-0x0000000004116000-memory.dmpFilesize
24KB
-
memory/1508-70-0x00000000040F0000-0x000000000410A000-memory.dmpFilesize
104KB
-
memory/1520-98-0x0000000000000000-mapping.dmp
-
memory/1632-91-0x0000000000000000-mapping.dmp
-
memory/1632-94-0x0000000000ED0000-0x0000000000EEA000-memory.dmpFilesize
104KB
-
memory/1640-58-0x0000000000000000-mapping.dmp
-
memory/1672-56-0x00000000006D0000-0x0000000000702000-memory.dmpFilesize
200KB
-
memory/1672-54-0x0000000001080000-0x0000000001198000-memory.dmpFilesize
1.1MB
-
memory/1672-57-0x0000000000B80000-0x0000000000B98000-memory.dmpFilesize
96KB
-
memory/1672-55-0x0000000075BD1000-0x0000000075BD3000-memory.dmpFilesize
8KB
-
memory/1744-63-0x0000000000000000-mapping.dmp
-
memory/1756-61-0x0000000000000000-mapping.dmp
-
memory/1808-60-0x0000000000000000-mapping.dmp