Analysis
-
max time kernel
150s -
max time network
169s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-12-2022 00:11
Static task
static1
Behavioral task
behavioral1
Sample
4d83e58ab22eda61302b755a827ffa57.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4d83e58ab22eda61302b755a827ffa57.exe
Resource
win10v2004-20220812-en
General
-
Target
4d83e58ab22eda61302b755a827ffa57.exe
-
Size
1.2MB
-
MD5
4d83e58ab22eda61302b755a827ffa57
-
SHA1
e1bfd5c9493aac048af6a03d2003abdfbf64d31c
-
SHA256
0359874ac9be35e969500ffe552298ea0c8056b51c8eac0e3e835c564ef39148
-
SHA512
bdb653eab74b49f31c4e9519c0812fb60d6cbd78e982deda74a2a5254140cb7e439bc944faef0daae8917df4918def18ceb02683741f742b39653022ebd99d3a
-
SSDEEP
24576:QwqpTiwAAgEEY4+FsS9ous35qIw9L7Zl1V3fWGKso5KF9Qgs:ATQp+GZJ/w9Ln1VnzuU9Qgs
Malware Config
Extracted
remcos
RemoteHost
45.139.105.174:3111
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-XI5CH7
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
remcos.exeremcos.exepid process 1552 remcos.exe 584 remcos.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 2032 cmd.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
remcos.exe4d83e58ab22eda61302b755a827ffa57.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" remcos.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 4d83e58ab22eda61302b755a827ffa57.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" 4d83e58ab22eda61302b755a827ffa57.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ 4d83e58ab22eda61302b755a827ffa57.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" 4d83e58ab22eda61302b755a827ffa57.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" remcos.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ remcos.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
4d83e58ab22eda61302b755a827ffa57.exeremcos.exeremcos.exedescription pid process target process PID 1392 set thread context of 2044 1392 4d83e58ab22eda61302b755a827ffa57.exe 4d83e58ab22eda61302b755a827ffa57.exe PID 1552 set thread context of 584 1552 remcos.exe remcos.exe PID 584 set thread context of 1972 584 remcos.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8FE37B91-71DE-11ED-99B1-EA25B6F29539} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
remcos.exepid process 584 remcos.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 880 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 880 iexplore.exe 880 iexplore.exe 1000 IEXPLORE.EXE 1000 IEXPLORE.EXE 1000 IEXPLORE.EXE 1000 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
4d83e58ab22eda61302b755a827ffa57.exe4d83e58ab22eda61302b755a827ffa57.exeWScript.execmd.exeremcos.exeremcos.exeiexplore.exeiexplore.exedescription pid process target process PID 1392 wrote to memory of 2044 1392 4d83e58ab22eda61302b755a827ffa57.exe 4d83e58ab22eda61302b755a827ffa57.exe PID 1392 wrote to memory of 2044 1392 4d83e58ab22eda61302b755a827ffa57.exe 4d83e58ab22eda61302b755a827ffa57.exe PID 1392 wrote to memory of 2044 1392 4d83e58ab22eda61302b755a827ffa57.exe 4d83e58ab22eda61302b755a827ffa57.exe PID 1392 wrote to memory of 2044 1392 4d83e58ab22eda61302b755a827ffa57.exe 4d83e58ab22eda61302b755a827ffa57.exe PID 1392 wrote to memory of 2044 1392 4d83e58ab22eda61302b755a827ffa57.exe 4d83e58ab22eda61302b755a827ffa57.exe PID 1392 wrote to memory of 2044 1392 4d83e58ab22eda61302b755a827ffa57.exe 4d83e58ab22eda61302b755a827ffa57.exe PID 1392 wrote to memory of 2044 1392 4d83e58ab22eda61302b755a827ffa57.exe 4d83e58ab22eda61302b755a827ffa57.exe PID 1392 wrote to memory of 2044 1392 4d83e58ab22eda61302b755a827ffa57.exe 4d83e58ab22eda61302b755a827ffa57.exe PID 1392 wrote to memory of 2044 1392 4d83e58ab22eda61302b755a827ffa57.exe 4d83e58ab22eda61302b755a827ffa57.exe PID 1392 wrote to memory of 2044 1392 4d83e58ab22eda61302b755a827ffa57.exe 4d83e58ab22eda61302b755a827ffa57.exe PID 1392 wrote to memory of 2044 1392 4d83e58ab22eda61302b755a827ffa57.exe 4d83e58ab22eda61302b755a827ffa57.exe PID 1392 wrote to memory of 2044 1392 4d83e58ab22eda61302b755a827ffa57.exe 4d83e58ab22eda61302b755a827ffa57.exe PID 1392 wrote to memory of 2044 1392 4d83e58ab22eda61302b755a827ffa57.exe 4d83e58ab22eda61302b755a827ffa57.exe PID 2044 wrote to memory of 1932 2044 4d83e58ab22eda61302b755a827ffa57.exe WScript.exe PID 2044 wrote to memory of 1932 2044 4d83e58ab22eda61302b755a827ffa57.exe WScript.exe PID 2044 wrote to memory of 1932 2044 4d83e58ab22eda61302b755a827ffa57.exe WScript.exe PID 2044 wrote to memory of 1932 2044 4d83e58ab22eda61302b755a827ffa57.exe WScript.exe PID 1932 wrote to memory of 2032 1932 WScript.exe cmd.exe PID 1932 wrote to memory of 2032 1932 WScript.exe cmd.exe PID 1932 wrote to memory of 2032 1932 WScript.exe cmd.exe PID 1932 wrote to memory of 2032 1932 WScript.exe cmd.exe PID 2032 wrote to memory of 1552 2032 cmd.exe remcos.exe PID 2032 wrote to memory of 1552 2032 cmd.exe remcos.exe PID 2032 wrote to memory of 1552 2032 cmd.exe remcos.exe PID 2032 wrote to memory of 1552 2032 cmd.exe remcos.exe PID 1552 wrote to memory of 584 1552 remcos.exe remcos.exe PID 1552 wrote to memory of 584 1552 remcos.exe remcos.exe PID 1552 wrote to memory of 584 1552 remcos.exe remcos.exe PID 1552 wrote to memory of 584 1552 remcos.exe remcos.exe PID 1552 wrote to memory of 584 1552 remcos.exe remcos.exe PID 1552 wrote to memory of 584 1552 remcos.exe remcos.exe PID 1552 wrote to memory of 584 1552 remcos.exe remcos.exe PID 1552 wrote to memory of 584 1552 remcos.exe remcos.exe PID 1552 wrote to memory of 584 1552 remcos.exe remcos.exe PID 1552 wrote to memory of 584 1552 remcos.exe remcos.exe PID 1552 wrote to memory of 584 1552 remcos.exe remcos.exe PID 1552 wrote to memory of 584 1552 remcos.exe remcos.exe PID 1552 wrote to memory of 584 1552 remcos.exe remcos.exe PID 584 wrote to memory of 1972 584 remcos.exe iexplore.exe PID 584 wrote to memory of 1972 584 remcos.exe iexplore.exe PID 584 wrote to memory of 1972 584 remcos.exe iexplore.exe PID 584 wrote to memory of 1972 584 remcos.exe iexplore.exe PID 584 wrote to memory of 1972 584 remcos.exe iexplore.exe PID 1972 wrote to memory of 880 1972 iexplore.exe iexplore.exe PID 1972 wrote to memory of 880 1972 iexplore.exe iexplore.exe PID 1972 wrote to memory of 880 1972 iexplore.exe iexplore.exe PID 1972 wrote to memory of 880 1972 iexplore.exe iexplore.exe PID 880 wrote to memory of 1000 880 iexplore.exe IEXPLORE.EXE PID 880 wrote to memory of 1000 880 iexplore.exe IEXPLORE.EXE PID 880 wrote to memory of 1000 880 iexplore.exe IEXPLORE.EXE PID 880 wrote to memory of 1000 880 iexplore.exe IEXPLORE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d83e58ab22eda61302b755a827ffa57.exe"C:\Users\Admin\AppData\Local\Temp\4d83e58ab22eda61302b755a827ffa57.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4d83e58ab22eda61302b755a827ffa57.exe"C:\Users\Admin\AppData\Local\Temp\4d83e58ab22eda61302b755a827ffa57.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fybsyvmovphykzlbtxirzbeeuylar.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Remcos\remcos.exe"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Remcos\remcos.exeC:\ProgramData\Remcos\remcos.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Remcos\remcos.exe"C:\ProgramData\Remcos\remcos.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=iexplore.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.08⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:880 CREDAT:275457 /prefetch:29⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Remcos\remcos.exeFilesize
1.2MB
MD54d83e58ab22eda61302b755a827ffa57
SHA1e1bfd5c9493aac048af6a03d2003abdfbf64d31c
SHA2560359874ac9be35e969500ffe552298ea0c8056b51c8eac0e3e835c564ef39148
SHA512bdb653eab74b49f31c4e9519c0812fb60d6cbd78e982deda74a2a5254140cb7e439bc944faef0daae8917df4918def18ceb02683741f742b39653022ebd99d3a
-
C:\ProgramData\Remcos\remcos.exeFilesize
1.2MB
MD54d83e58ab22eda61302b755a827ffa57
SHA1e1bfd5c9493aac048af6a03d2003abdfbf64d31c
SHA2560359874ac9be35e969500ffe552298ea0c8056b51c8eac0e3e835c564ef39148
SHA512bdb653eab74b49f31c4e9519c0812fb60d6cbd78e982deda74a2a5254140cb7e439bc944faef0daae8917df4918def18ceb02683741f742b39653022ebd99d3a
-
C:\ProgramData\Remcos\remcos.exeFilesize
1.2MB
MD54d83e58ab22eda61302b755a827ffa57
SHA1e1bfd5c9493aac048af6a03d2003abdfbf64d31c
SHA2560359874ac9be35e969500ffe552298ea0c8056b51c8eac0e3e835c564ef39148
SHA512bdb653eab74b49f31c4e9519c0812fb60d6cbd78e982deda74a2a5254140cb7e439bc944faef0daae8917df4918def18ceb02683741f742b39653022ebd99d3a
-
C:\Users\Admin\AppData\Local\Temp\fybsyvmovphykzlbtxirzbeeuylar.vbsFilesize
386B
MD51ec6289c6fd4c2ded6b2836ed28cbeb5
SHA1c4e08195e6c640eb8860acc03fda1d649b4fe070
SHA2566efdc40f9eb217f879607614e928b65bff759e424f3efb31faceb2a043c32dc2
SHA51220bc46f4dee22f75f15c402c7c2eaee60fff7dd92548050585571dcbefd59485cc249c06bc3f1aac7a138e5ae67c0c3918b46ffa24c8b0f1b092e2f6b6e21288
-
\ProgramData\Remcos\remcos.exeFilesize
1.2MB
MD54d83e58ab22eda61302b755a827ffa57
SHA1e1bfd5c9493aac048af6a03d2003abdfbf64d31c
SHA2560359874ac9be35e969500ffe552298ea0c8056b51c8eac0e3e835c564ef39148
SHA512bdb653eab74b49f31c4e9519c0812fb60d6cbd78e982deda74a2a5254140cb7e439bc944faef0daae8917df4918def18ceb02683741f742b39653022ebd99d3a
-
memory/584-108-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/584-110-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/584-103-0x000000000043292E-mapping.dmp
-
memory/584-107-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1392-59-0x0000000007F20000-0x0000000007FBE000-memory.dmpFilesize
632KB
-
memory/1392-54-0x0000000000260000-0x0000000000396000-memory.dmpFilesize
1.2MB
-
memory/1392-58-0x0000000005F60000-0x0000000006032000-memory.dmpFilesize
840KB
-
memory/1392-57-0x00000000003B0000-0x00000000003BE000-memory.dmpFilesize
56KB
-
memory/1392-56-0x0000000000250000-0x0000000000266000-memory.dmpFilesize
88KB
-
memory/1392-55-0x0000000075601000-0x0000000075603000-memory.dmpFilesize
8KB
-
memory/1552-89-0x0000000000390000-0x00000000003A6000-memory.dmpFilesize
88KB
-
memory/1552-87-0x0000000001350000-0x0000000001486000-memory.dmpFilesize
1.2MB
-
memory/1552-85-0x0000000000000000-mapping.dmp
-
memory/1932-78-0x0000000000000000-mapping.dmp
-
memory/1972-109-0x00000000003E1ADE-mapping.dmp
-
memory/2032-82-0x0000000000000000-mapping.dmp
-
memory/2044-63-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2044-79-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2044-77-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2044-76-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2044-73-0x000000000043292E-mapping.dmp
-
memory/2044-72-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2044-70-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2044-68-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2044-67-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2044-66-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2044-65-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2044-60-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2044-61-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB