Analysis
-
max time kernel
272s -
max time network
354s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 22:01
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20221111-en
General
-
Target
tmp.exe
-
Size
1.1MB
-
MD5
1ba90e7c300192092839623d2f04c46f
-
SHA1
faa99a1eb7fa274eeca999979db2010221647dd2
-
SHA256
a855344dd72d07464af4b3ba765d5b5e479c6b6c58e1055e34cdaa3790c2cc67
-
SHA512
521f9c0d578b8e25d046156ae31fc7df46a4d9fe3acff4bc2ef9ec563a652fd76225a49748083a064a66bfc3d6a5bcf042ac42fcae9dbbf1627305e67fecd415
-
SSDEEP
24576:sYPxlBLlEdhm8TFeEJ7HQec8/JnkgD1RC:ZP4zTFei7wghkgD6
Malware Config
Extracted
remcos
BALLER
91.192.100.48:1979
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-2RPM8Z
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
tmp.exedescription pid process target process PID 976 set thread context of 1836 976 tmp.exe tmp.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
tmp.exepid process 1836 tmp.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
tmp.exedescription pid process target process PID 976 wrote to memory of 1836 976 tmp.exe tmp.exe PID 976 wrote to memory of 1836 976 tmp.exe tmp.exe PID 976 wrote to memory of 1836 976 tmp.exe tmp.exe PID 976 wrote to memory of 1836 976 tmp.exe tmp.exe PID 976 wrote to memory of 1836 976 tmp.exe tmp.exe PID 976 wrote to memory of 1836 976 tmp.exe tmp.exe PID 976 wrote to memory of 1836 976 tmp.exe tmp.exe PID 976 wrote to memory of 1836 976 tmp.exe tmp.exe PID 976 wrote to memory of 1836 976 tmp.exe tmp.exe PID 976 wrote to memory of 1836 976 tmp.exe tmp.exe PID 976 wrote to memory of 1836 976 tmp.exe tmp.exe PID 976 wrote to memory of 1836 976 tmp.exe tmp.exe PID 976 wrote to memory of 1836 976 tmp.exe tmp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/976-54-0x0000000000E50000-0x0000000000F72000-memory.dmpFilesize
1.1MB
-
memory/976-55-0x0000000076201000-0x0000000076203000-memory.dmpFilesize
8KB
-
memory/976-56-0x00000000006C0000-0x00000000006D8000-memory.dmpFilesize
96KB
-
memory/976-57-0x0000000000390000-0x000000000039C000-memory.dmpFilesize
48KB
-
memory/976-58-0x0000000008180000-0x000000000826C000-memory.dmpFilesize
944KB
-
memory/976-59-0x0000000007FB0000-0x0000000008068000-memory.dmpFilesize
736KB
-
memory/1836-60-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1836-61-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1836-63-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1836-65-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1836-66-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1836-67-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1836-70-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1836-68-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1836-72-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1836-73-0x0000000000431C27-mapping.dmp
-
memory/1836-76-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1836-77-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/1836-78-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB