Analysis
-
max time kernel
148s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2022 13:18
Static task
static1
Behavioral task
behavioral1
Sample
NEW INQUIRY LIST.PDF.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
NEW INQUIRY LIST.PDF.exe
Resource
win10v2004-20220901-en
General
-
Target
NEW INQUIRY LIST.PDF.exe
-
Size
987KB
-
MD5
a5aa2eac542632dddedfa716b670488f
-
SHA1
9bcb4986eedb690af9ff49b559da536bdaa43aff
-
SHA256
72333871ff2e5b9a7ae7e7c11af0c2ccbac7ac53bb60976cf0bcdfabceb5059f
-
SHA512
4274fd5027c7fad9434590e69ff7959057b5d4922c66be14ebd1281b1348c425f1e3481ba9ec7cb628849b31b4b4bda7ad03a777caece0d819eba2917fad5cd6
-
SSDEEP
24576:SAd18wtkhGN7NtazF50rOHXr9NBO7SiAH2o4sMmFMc3io3F93:JHtkhGntDyXr5O23WoucSoV9
Malware Config
Extracted
remcos
NEW REM STUB
valvesco.duckdns.org:5050
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-48V73L
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
NEW INQUIRY LIST.PDF.exedescription pid process target process PID 4836 set thread context of 4320 4836 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
NEW INQUIRY LIST.PDF.exepid process 4320 NEW INQUIRY LIST.PDF.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
NEW INQUIRY LIST.PDF.exedescription pid process target process PID 4836 wrote to memory of 4320 4836 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe PID 4836 wrote to memory of 4320 4836 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe PID 4836 wrote to memory of 4320 4836 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe PID 4836 wrote to memory of 4320 4836 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe PID 4836 wrote to memory of 4320 4836 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe PID 4836 wrote to memory of 4320 4836 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe PID 4836 wrote to memory of 4320 4836 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe PID 4836 wrote to memory of 4320 4836 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe PID 4836 wrote to memory of 4320 4836 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe PID 4836 wrote to memory of 4320 4836 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe PID 4836 wrote to memory of 4320 4836 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe PID 4836 wrote to memory of 4320 4836 NEW INQUIRY LIST.PDF.exe NEW INQUIRY LIST.PDF.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW INQUIRY LIST.PDF.exe"C:\Users\Admin\AppData\Local\Temp\NEW INQUIRY LIST.PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW INQUIRY LIST.PDF.exe"C:\Users\Admin\AppData\Local\Temp\NEW INQUIRY LIST.PDF.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4320-140-0x0000000000000000-mapping.dmp
-
memory/4320-141-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4320-142-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4320-143-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4320-144-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4320-145-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4836-135-0x0000000000CC0000-0x0000000000DBE000-memory.dmpFilesize
1016KB
-
memory/4836-136-0x0000000005B60000-0x0000000006104000-memory.dmpFilesize
5.6MB
-
memory/4836-137-0x0000000005650000-0x00000000056E2000-memory.dmpFilesize
584KB
-
memory/4836-138-0x0000000005620000-0x000000000562A000-memory.dmpFilesize
40KB
-
memory/4836-139-0x00000000066A0000-0x000000000673C000-memory.dmpFilesize
624KB