Analysis
-
max time kernel
204s -
max time network
221s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 07:30
Static task
static1
Behavioral task
behavioral1
Sample
ENQUIRY 20222511.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ENQUIRY 20222511.exe
Resource
win10v2004-20221111-en
General
-
Target
ENQUIRY 20222511.exe
-
Size
969KB
-
MD5
c276da9fb72e85e8ded5a8ae567d118f
-
SHA1
c8506923cb55e41f514ad2573ef3d32fc68e3a54
-
SHA256
8e2730f5984afe0586003190249b7c9e5c51a3ef2ba0c2194db5dcd21242c20b
-
SHA512
78fb550e3c815cb1214b2f67622444770d50c4e6764d55a900588ece4e3d586d61761982c0d9eb5a2ea157aed92c7fe5e992691781a6ee8b7c00310f718114e4
-
SSDEEP
12288:ycejSCW48Poy5s1yqroLh2RCWZ8Lltwb4/fpYP2zf0Q+iWNq4Wc7QBrg8KnJmZJl:xlCWDoInS/xuwE/BYQsil4W4fJ
Malware Config
Extracted
remcos
NEW REM STUB
valvesco.duckdns.org:5050
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-48V73L
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
ENQUIRY 20222511.exedescription pid process target process PID 1888 set thread context of 1948 1888 ENQUIRY 20222511.exe ENQUIRY 20222511.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ENQUIRY 20222511.exepid process 1948 ENQUIRY 20222511.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
ENQUIRY 20222511.exedescription pid process target process PID 1888 wrote to memory of 1948 1888 ENQUIRY 20222511.exe ENQUIRY 20222511.exe PID 1888 wrote to memory of 1948 1888 ENQUIRY 20222511.exe ENQUIRY 20222511.exe PID 1888 wrote to memory of 1948 1888 ENQUIRY 20222511.exe ENQUIRY 20222511.exe PID 1888 wrote to memory of 1948 1888 ENQUIRY 20222511.exe ENQUIRY 20222511.exe PID 1888 wrote to memory of 1948 1888 ENQUIRY 20222511.exe ENQUIRY 20222511.exe PID 1888 wrote to memory of 1948 1888 ENQUIRY 20222511.exe ENQUIRY 20222511.exe PID 1888 wrote to memory of 1948 1888 ENQUIRY 20222511.exe ENQUIRY 20222511.exe PID 1888 wrote to memory of 1948 1888 ENQUIRY 20222511.exe ENQUIRY 20222511.exe PID 1888 wrote to memory of 1948 1888 ENQUIRY 20222511.exe ENQUIRY 20222511.exe PID 1888 wrote to memory of 1948 1888 ENQUIRY 20222511.exe ENQUIRY 20222511.exe PID 1888 wrote to memory of 1948 1888 ENQUIRY 20222511.exe ENQUIRY 20222511.exe PID 1888 wrote to memory of 1948 1888 ENQUIRY 20222511.exe ENQUIRY 20222511.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ENQUIRY 20222511.exe"C:\Users\Admin\AppData\Local\Temp\ENQUIRY 20222511.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ENQUIRY 20222511.exe"C:\Users\Admin\AppData\Local\Temp\ENQUIRY 20222511.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1888-132-0x0000000000990000-0x0000000000A88000-memory.dmpFilesize
992KB
-
memory/1888-133-0x0000000005A80000-0x0000000006024000-memory.dmpFilesize
5.6MB
-
memory/1888-134-0x0000000005400000-0x0000000005492000-memory.dmpFilesize
584KB
-
memory/1888-135-0x00000000055C0000-0x00000000055CA000-memory.dmpFilesize
40KB
-
memory/1888-136-0x0000000008E20000-0x0000000008EBC000-memory.dmpFilesize
624KB
-
memory/1948-137-0x0000000000000000-mapping.dmp
-
memory/1948-138-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1948-139-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1948-140-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1948-141-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1948-142-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB