Analysis
-
max time kernel
148s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
15-10-2022 14:27
Static task
static1
Behavioral task
behavioral1
Sample
AIF 500 unit Distribution 2018ECA - ProfoInve.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
AIF 500 unit Distribution 2018ECA - ProfoInve.exe
Resource
win10v2004-20220812-en
General
-
Target
AIF 500 unit Distribution 2018ECA - ProfoInve.exe
-
Size
986KB
-
MD5
f72d0995ccf16a2481cb2966e3e05f19
-
SHA1
7b40fd28569cd4517c3a6bb91ce11a7e26cde71c
-
SHA256
c046fc938166fd34c8041ff7c93f98f0ac3f68486aa844178e720c14dbbde625
-
SHA512
cb3243354cd56725a498ec5b60b6737bc15c72ff4b8e24dae378d98636abc9c00b14ebffee1cbf079580d8b16df467e701ea6571089f10830b0833f163017c90
-
SSDEEP
12288:DR7Vgp6llBxZ/sAu0ximzRLQgR//Y0ceWaJKv6gQuF:DR79lP5HRLQgR/g0ceLcCgQg
Malware Config
Extracted
remcos
manup
91.193.75.188:60005
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-Y6KFVO
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
WindowsWorkflowselection.exepid process 1784 WindowsWorkflowselection.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsWorkflowselection = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsWorkflowselection\\WindowsWorkflowselection.exe" reg.exe -
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{6AA5414C-F44E-4A87-90EE-945DB27543F3}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{F63183B7-DC23-4EAA-9CD1-A66D682B7992}.catalogItem svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
WindowsWorkflowselection.exedescription pid process target process PID 1784 set thread context of 2184 1784 WindowsWorkflowselection.exe AddInProcess32.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe -
Runs ping.exe 1 TTPs 3 IoCs
Processes:
PING.EXEPING.EXEPING.EXEpid process 316 PING.EXE 4364 PING.EXE 2888 PING.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
AIF 500 unit Distribution 2018ECA - ProfoInve.exeWindowsWorkflowselection.exepid process 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe 1784 WindowsWorkflowselection.exe 1784 WindowsWorkflowselection.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AddInProcess32.exepid process 2184 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AIF 500 unit Distribution 2018ECA - ProfoInve.exeWindowsWorkflowselection.exedescription pid process Token: SeDebugPrivilege 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe Token: SeDebugPrivilege 1784 WindowsWorkflowselection.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
AddInProcess32.exepid process 2184 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
AIF 500 unit Distribution 2018ECA - ProfoInve.execmd.execmd.exeWindowsWorkflowselection.exedescription pid process target process PID 2668 wrote to memory of 4560 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe cmd.exe PID 2668 wrote to memory of 4560 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe cmd.exe PID 2668 wrote to memory of 4560 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe cmd.exe PID 4560 wrote to memory of 316 4560 cmd.exe PING.EXE PID 4560 wrote to memory of 316 4560 cmd.exe PING.EXE PID 4560 wrote to memory of 316 4560 cmd.exe PING.EXE PID 2668 wrote to memory of 2764 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe cmd.exe PID 2668 wrote to memory of 2764 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe cmd.exe PID 2668 wrote to memory of 2764 2668 AIF 500 unit Distribution 2018ECA - ProfoInve.exe cmd.exe PID 2764 wrote to memory of 4364 2764 cmd.exe PING.EXE PID 2764 wrote to memory of 4364 2764 cmd.exe PING.EXE PID 2764 wrote to memory of 4364 2764 cmd.exe PING.EXE PID 4560 wrote to memory of 2284 4560 cmd.exe reg.exe PID 4560 wrote to memory of 2284 4560 cmd.exe reg.exe PID 4560 wrote to memory of 2284 4560 cmd.exe reg.exe PID 2764 wrote to memory of 2888 2764 cmd.exe PING.EXE PID 2764 wrote to memory of 2888 2764 cmd.exe PING.EXE PID 2764 wrote to memory of 2888 2764 cmd.exe PING.EXE PID 2764 wrote to memory of 1784 2764 cmd.exe WindowsWorkflowselection.exe PID 2764 wrote to memory of 1784 2764 cmd.exe WindowsWorkflowselection.exe PID 2764 wrote to memory of 1784 2764 cmd.exe WindowsWorkflowselection.exe PID 1784 wrote to memory of 2184 1784 WindowsWorkflowselection.exe AddInProcess32.exe PID 1784 wrote to memory of 2184 1784 WindowsWorkflowselection.exe AddInProcess32.exe PID 1784 wrote to memory of 2184 1784 WindowsWorkflowselection.exe AddInProcess32.exe PID 1784 wrote to memory of 2184 1784 WindowsWorkflowselection.exe AddInProcess32.exe PID 1784 wrote to memory of 2184 1784 WindowsWorkflowselection.exe AddInProcess32.exe PID 1784 wrote to memory of 2184 1784 WindowsWorkflowselection.exe AddInProcess32.exe PID 1784 wrote to memory of 2184 1784 WindowsWorkflowselection.exe AddInProcess32.exe PID 1784 wrote to memory of 2184 1784 WindowsWorkflowselection.exe AddInProcess32.exe PID 1784 wrote to memory of 2184 1784 WindowsWorkflowselection.exe AddInProcess32.exe PID 1784 wrote to memory of 2184 1784 WindowsWorkflowselection.exe AddInProcess32.exe PID 1784 wrote to memory of 2184 1784 WindowsWorkflowselection.exe AddInProcess32.exe PID 1784 wrote to memory of 2184 1784 WindowsWorkflowselection.exe AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AIF 500 unit Distribution 2018ECA - ProfoInve.exe"C:\Users\Admin\AppData\Local\Temp\AIF 500 unit Distribution 2018ECA - ProfoInve.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 6 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "WindowsWorkflowselection" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WindowsWorkflowselection\WindowsWorkflowselection.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 63⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "WindowsWorkflowselection" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\WindowsWorkflowselection\WindowsWorkflowselection.exe"3⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 20 > nul && copy "C:\Users\Admin\AppData\Local\Temp\AIF 500 unit Distribution 2018ECA - ProfoInve.exe" "C:\Users\Admin\AppData\Roaming\WindowsWorkflowselection\WindowsWorkflowselection.exe" && ping 127.0.0.1 -n 20 > nul && "C:\Users\Admin\AppData\Roaming\WindowsWorkflowselection\WindowsWorkflowselection.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 203⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 203⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\WindowsWorkflowselection\WindowsWorkflowselection.exe"C:\Users\Admin\AppData\Roaming\WindowsWorkflowselection\WindowsWorkflowselection.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"4⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\WindowsWorkflowselection\WindowsWorkflowselection.exeFilesize
986KB
MD5f72d0995ccf16a2481cb2966e3e05f19
SHA17b40fd28569cd4517c3a6bb91ce11a7e26cde71c
SHA256c046fc938166fd34c8041ff7c93f98f0ac3f68486aa844178e720c14dbbde625
SHA512cb3243354cd56725a498ec5b60b6737bc15c72ff4b8e24dae378d98636abc9c00b14ebffee1cbf079580d8b16df467e701ea6571089f10830b0833f163017c90
-
C:\Users\Admin\AppData\Roaming\WindowsWorkflowselection\WindowsWorkflowselection.exeFilesize
986KB
MD5f72d0995ccf16a2481cb2966e3e05f19
SHA17b40fd28569cd4517c3a6bb91ce11a7e26cde71c
SHA256c046fc938166fd34c8041ff7c93f98f0ac3f68486aa844178e720c14dbbde625
SHA512cb3243354cd56725a498ec5b60b6737bc15c72ff4b8e24dae378d98636abc9c00b14ebffee1cbf079580d8b16df467e701ea6571089f10830b0833f163017c90
-
memory/316-138-0x0000000000000000-mapping.dmp
-
memory/1784-146-0x0000000000040000-0x000000000013C000-memory.dmpFilesize
1008KB
-
memory/1784-143-0x0000000000000000-mapping.dmp
-
memory/2184-151-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2184-152-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2184-150-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2184-147-0x0000000000000000-mapping.dmp
-
memory/2184-148-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2184-149-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2284-141-0x0000000000000000-mapping.dmp
-
memory/2668-132-0x00000000009D0000-0x0000000000ACC000-memory.dmpFilesize
1008KB
-
memory/2668-136-0x0000000005BE0000-0x0000000005BEA000-memory.dmpFilesize
40KB
-
memory/2668-135-0x0000000005F20000-0x00000000064C4000-memory.dmpFilesize
5.6MB
-
memory/2668-134-0x00000000058D0000-0x0000000005962000-memory.dmpFilesize
584KB
-
memory/2668-133-0x0000000004B70000-0x0000000004C0C000-memory.dmpFilesize
624KB
-
memory/2764-139-0x0000000000000000-mapping.dmp
-
memory/2888-142-0x0000000000000000-mapping.dmp
-
memory/4364-140-0x0000000000000000-mapping.dmp
-
memory/4560-137-0x0000000000000000-mapping.dmp