Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
10-11-2022 13:18
Static task
static1
Behavioral task
behavioral1
Sample
NEW INQUIRY LIST.PDF.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
NEW INQUIRY LIST.PDF.exe
Resource
win10v2004-20220901-en
General
-
Target
NEW INQUIRY LIST.PDF.exe
-
Size
987KB
-
MD5
a5aa2eac542632dddedfa716b670488f
-
SHA1
9bcb4986eedb690af9ff49b559da536bdaa43aff
-
SHA256
72333871ff2e5b9a7ae7e7c11af0c2ccbac7ac53bb60976cf0bcdfabceb5059f
-
SHA512
4274fd5027c7fad9434590e69ff7959057b5d4922c66be14ebd1281b1348c425f1e3481ba9ec7cb628849b31b4b4bda7ad03a777caece0d819eba2917fad5cd6
-
SSDEEP
24576:SAd18wtkhGN7NtazF50rOHXr9NBO7SiAH2o4sMmFMc3io3F93:JHtkhGntDyXr5O23WoucSoV9
Malware Config
Extracted
remcos
NEW REM STUB
valvesco.duckdns.org:5050
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-48V73L
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
NEW INQUIRY LIST.PDF.exedescription pid process target process PID 1504 set thread context of 888 1504 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
NEW INQUIRY LIST.PDF.exepid process 888 NEW INQUIRY LIST.PDF.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
NEW INQUIRY LIST.PDF.exedescription pid process target process PID 1504 wrote to memory of 888 1504 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe PID 1504 wrote to memory of 888 1504 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe PID 1504 wrote to memory of 888 1504 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe PID 1504 wrote to memory of 888 1504 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe PID 1504 wrote to memory of 888 1504 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe PID 1504 wrote to memory of 888 1504 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe PID 1504 wrote to memory of 888 1504 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe PID 1504 wrote to memory of 888 1504 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe PID 1504 wrote to memory of 888 1504 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe PID 1504 wrote to memory of 888 1504 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe PID 1504 wrote to memory of 888 1504 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe PID 1504 wrote to memory of 888 1504 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe PID 1504 wrote to memory of 888 1504 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW INQUIRY LIST.PDF.exe"C:\Users\Admin\AppData\Local\Temp\NEW INQUIRY LIST.PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW INQUIRY LIST.PDF.exe"C:\Users\Admin\AppData\Local\Temp\NEW INQUIRY LIST.PDF.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/888-68-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/888-70-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/888-63-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/888-65-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/888-77-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/888-76-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/888-60-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/888-61-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/888-73-0x00000000004327A4-mapping.dmp
-
memory/888-78-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/888-67-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/888-66-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/888-72-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1504-55-0x00000000768A1000-0x00000000768A3000-memory.dmpFilesize
8KB
-
memory/1504-54-0x0000000001230000-0x000000000132E000-memory.dmpFilesize
1016KB
-
memory/1504-56-0x0000000000260000-0x0000000000278000-memory.dmpFilesize
96KB
-
memory/1504-59-0x00000000053E0000-0x0000000005468000-memory.dmpFilesize
544KB
-
memory/1504-58-0x0000000005640000-0x00000000056FE000-memory.dmpFilesize
760KB
-
memory/1504-57-0x0000000000220000-0x000000000022C000-memory.dmpFilesize
48KB