Analysis
-
max time kernel
148s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2022 06:12
Static task
static1
Behavioral task
behavioral1
Sample
Swift Copy.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Swift Copy.exe
Resource
win10v2004-20220901-en
General
-
Target
Swift Copy.exe
-
Size
1.2MB
-
MD5
73db0b68d9a703228f986163df19a13f
-
SHA1
ae022b0f0b764cf206e3bc8efcbcacd3ea0289ca
-
SHA256
baa066cb46b609f26467f391334b1a685b210153aaca187cd7ac55cdb11e32e4
-
SHA512
825645d7b0c4a7dbb3c17d8be36703ff3ac108836a6446a4f5423d27438021dbca2cca88cd0d48382f989c4e357aab90101c29388874a979077c2c22fb2ab0d9
-
SSDEEP
24576:Jj4veM7w0ucEccT5icJZMQpnrA6NpNei9PgiRepcXjB:B4pwtRIcJ6WrAOpNeyPBYqjB
Malware Config
Extracted
remcos
StarMoneyNew
185.252.178.35:41900
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-6RGOTF
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Swift Copy.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Swift Copy.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Swift Copy.exedescription pid process target process PID 2296 set thread context of 4772 2296 Swift Copy.exe Swift Copy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Swift Copy.exepowershell.exepid process 2296 Swift Copy.exe 2296 Swift Copy.exe 976 powershell.exe 976 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Swift Copy.exepowershell.exedescription pid process Token: SeDebugPrivilege 2296 Swift Copy.exe Token: SeDebugPrivilege 976 powershell.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Swift Copy.exedescription pid process target process PID 2296 wrote to memory of 976 2296 Swift Copy.exe powershell.exe PID 2296 wrote to memory of 976 2296 Swift Copy.exe powershell.exe PID 2296 wrote to memory of 976 2296 Swift Copy.exe powershell.exe PID 2296 wrote to memory of 4148 2296 Swift Copy.exe schtasks.exe PID 2296 wrote to memory of 4148 2296 Swift Copy.exe schtasks.exe PID 2296 wrote to memory of 4148 2296 Swift Copy.exe schtasks.exe PID 2296 wrote to memory of 4772 2296 Swift Copy.exe Swift Copy.exe PID 2296 wrote to memory of 4772 2296 Swift Copy.exe Swift Copy.exe PID 2296 wrote to memory of 4772 2296 Swift Copy.exe Swift Copy.exe PID 2296 wrote to memory of 4772 2296 Swift Copy.exe Swift Copy.exe PID 2296 wrote to memory of 4772 2296 Swift Copy.exe Swift Copy.exe PID 2296 wrote to memory of 4772 2296 Swift Copy.exe Swift Copy.exe PID 2296 wrote to memory of 4772 2296 Swift Copy.exe Swift Copy.exe PID 2296 wrote to memory of 4772 2296 Swift Copy.exe Swift Copy.exe PID 2296 wrote to memory of 4772 2296 Swift Copy.exe Swift Copy.exe PID 2296 wrote to memory of 4772 2296 Swift Copy.exe Swift Copy.exe PID 2296 wrote to memory of 4772 2296 Swift Copy.exe Swift Copy.exe PID 2296 wrote to memory of 4772 2296 Swift Copy.exe Swift Copy.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wxqSpIAt.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wxqSpIAt" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6551.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"C:\Users\Admin\AppData\Local\Temp\Swift Copy.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6551.tmpFilesize
1KB
MD5bf41435838e5dd7a9b4fc8841e074c4d
SHA15761c1d43db312863d78a2ed23406f090ae86d88
SHA2561cb6f44b5f1ee3bc626d3125fc3f6e992953d66ff0908cbe63d4a969b610bc6b
SHA51219a99aae111df5a0f423ab7fdf56bd33cd43d8a074887b1bc472411ebb65bf4773c240530899704939bccbd01b55b9adab43a7449856dc53a1c1931181257b92
-
memory/976-147-0x0000000005420000-0x0000000005442000-memory.dmpFilesize
136KB
-
memory/976-140-0x00000000022F0000-0x0000000002326000-memory.dmpFilesize
216KB
-
memory/976-159-0x0000000007260000-0x000000000727A000-memory.dmpFilesize
104KB
-
memory/976-160-0x0000000007240000-0x0000000007248000-memory.dmpFilesize
32KB
-
memory/976-153-0x00000000061B0000-0x00000000061CE000-memory.dmpFilesize
120KB
-
memory/976-138-0x0000000000000000-mapping.dmp
-
memory/976-152-0x0000000071790000-0x00000000717DC000-memory.dmpFilesize
304KB
-
memory/976-156-0x0000000006F90000-0x0000000006F9A000-memory.dmpFilesize
40KB
-
memory/976-158-0x0000000007150000-0x000000000715E000-memory.dmpFilesize
56KB
-
memory/976-142-0x0000000004CF0000-0x0000000005318000-memory.dmpFilesize
6.2MB
-
memory/976-154-0x0000000007560000-0x0000000007BDA000-memory.dmpFilesize
6.5MB
-
memory/976-151-0x0000000006DD0000-0x0000000006E02000-memory.dmpFilesize
200KB
-
memory/976-150-0x0000000005C20000-0x0000000005C3E000-memory.dmpFilesize
120KB
-
memory/976-157-0x00000000071A0000-0x0000000007236000-memory.dmpFilesize
600KB
-
memory/976-155-0x0000000006F20000-0x0000000006F3A000-memory.dmpFilesize
104KB
-
memory/976-148-0x0000000005510000-0x0000000005576000-memory.dmpFilesize
408KB
-
memory/2296-132-0x0000000000A50000-0x0000000000B8A000-memory.dmpFilesize
1.2MB
-
memory/2296-133-0x0000000005A90000-0x0000000006034000-memory.dmpFilesize
5.6MB
-
memory/2296-135-0x00000000053D0000-0x00000000053DA000-memory.dmpFilesize
40KB
-
memory/2296-134-0x00000000053F0000-0x0000000005482000-memory.dmpFilesize
584KB
-
memory/2296-137-0x00000000094D0000-0x0000000009536000-memory.dmpFilesize
408KB
-
memory/2296-136-0x0000000009160000-0x00000000091FC000-memory.dmpFilesize
624KB
-
memory/4148-139-0x0000000000000000-mapping.dmp
-
memory/4772-149-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4772-146-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4772-145-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4772-144-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4772-143-0x0000000000000000-mapping.dmp
-
memory/4772-161-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB