Analysis
-
max time kernel
175s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 09:30
Static task
static1
Behavioral task
behavioral1
Sample
ACHUBABALO.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ACHUBABALO.exe
Resource
win10v2004-20221111-en
General
-
Target
ACHUBABALO.exe
-
Size
2.3MB
-
MD5
e70b644872ce35311bb5195272075c04
-
SHA1
dbd7db712fd3eb5f018cbe5bc6d5899f0c0e7024
-
SHA256
77832184096060c1e05b236138b162b009218c3ba698573c32939fe1456a3c1d
-
SHA512
0cef88c2a00522e5a56fec62e5096740ffdd864ce1c476ab51b9948633bd456b59f0f8824245e5bc71b75b24e483be3e0f3a4e889f2eb3fa79b394f122d8574c
-
SSDEEP
49152:qI0qyQ4xwGa38JIhZrOrJ/DpKzPW5NJV050+aZTzJRAle:YVMI/DaP09FTlae
Malware Config
Extracted
remcos
mimi
185.206.225.51:18853
127.0.0.1:18853
10.16.225.165:18853
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-UVAOQ7
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ACHUBABALO.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation ACHUBABALO.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ACHUBABALO.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Vucxjxyxas = "\"C:\\Users\\Admin\\AppData\\Roaming\\Bvgew\\Vucxjxyxas.exe\"" ACHUBABALO.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ACHUBABALO.exedescription pid process target process PID 1880 set thread context of 2500 1880 ACHUBABALO.exe ACHUBABALO.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exeACHUBABALO.exepid process 1220 powershell.exe 1220 powershell.exe 1880 ACHUBABALO.exe 1880 ACHUBABALO.exe 1880 ACHUBABALO.exe 1880 ACHUBABALO.exe 1880 ACHUBABALO.exe 1880 ACHUBABALO.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ACHUBABALO.exepowershell.exedescription pid process Token: SeDebugPrivilege 1880 ACHUBABALO.exe Token: SeDebugPrivilege 1220 powershell.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
ACHUBABALO.exedescription pid process target process PID 1880 wrote to memory of 1220 1880 ACHUBABALO.exe powershell.exe PID 1880 wrote to memory of 1220 1880 ACHUBABALO.exe powershell.exe PID 1880 wrote to memory of 1220 1880 ACHUBABALO.exe powershell.exe PID 1880 wrote to memory of 3096 1880 ACHUBABALO.exe ACHUBABALO.exe PID 1880 wrote to memory of 3096 1880 ACHUBABALO.exe ACHUBABALO.exe PID 1880 wrote to memory of 3096 1880 ACHUBABALO.exe ACHUBABALO.exe PID 1880 wrote to memory of 1804 1880 ACHUBABALO.exe ACHUBABALO.exe PID 1880 wrote to memory of 1804 1880 ACHUBABALO.exe ACHUBABALO.exe PID 1880 wrote to memory of 1804 1880 ACHUBABALO.exe ACHUBABALO.exe PID 1880 wrote to memory of 3516 1880 ACHUBABALO.exe ACHUBABALO.exe PID 1880 wrote to memory of 3516 1880 ACHUBABALO.exe ACHUBABALO.exe PID 1880 wrote to memory of 3516 1880 ACHUBABALO.exe ACHUBABALO.exe PID 1880 wrote to memory of 2500 1880 ACHUBABALO.exe ACHUBABALO.exe PID 1880 wrote to memory of 2500 1880 ACHUBABALO.exe ACHUBABALO.exe PID 1880 wrote to memory of 2500 1880 ACHUBABALO.exe ACHUBABALO.exe PID 1880 wrote to memory of 2500 1880 ACHUBABALO.exe ACHUBABALO.exe PID 1880 wrote to memory of 2500 1880 ACHUBABALO.exe ACHUBABALO.exe PID 1880 wrote to memory of 2500 1880 ACHUBABALO.exe ACHUBABALO.exe PID 1880 wrote to memory of 2500 1880 ACHUBABALO.exe ACHUBABALO.exe PID 1880 wrote to memory of 2500 1880 ACHUBABALO.exe ACHUBABALO.exe PID 1880 wrote to memory of 2500 1880 ACHUBABALO.exe ACHUBABALO.exe PID 1880 wrote to memory of 2500 1880 ACHUBABALO.exe ACHUBABALO.exe PID 1880 wrote to memory of 2500 1880 ACHUBABALO.exe ACHUBABALO.exe PID 1880 wrote to memory of 2500 1880 ACHUBABALO.exe ACHUBABALO.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ACHUBABALO.exe"C:\Users\Admin\AppData\Local\Temp\ACHUBABALO.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\ACHUBABALO.exeC:\Users\Admin\AppData\Local\Temp\ACHUBABALO.exe2⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\ACHUBABALO.exeC:\Users\Admin\AppData\Local\Temp\ACHUBABALO.exe2⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\ACHUBABALO.exeC:\Users\Admin\AppData\Local\Temp\ACHUBABALO.exe2⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\ACHUBABALO.exeC:\Users\Admin\AppData\Local\Temp\ACHUBABALO.exe2⤵PID:2500