Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 14:54
Static task
static1
Behavioral task
behavioral1
Sample
lucerne as at 28 Nov 2022.exe
Resource
win7-20220901-en
General
-
Target
lucerne as at 28 Nov 2022.exe
-
Size
579KB
-
MD5
796280ec19f4cabce99bbb14b4a43f28
-
SHA1
537bedfbb6f6f2b544bc4892437f4a6050d932a9
-
SHA256
eeb4e124303b10a370d6c20f70c17303dfe1cd6de4b255d85061804ad6902db0
-
SHA512
6afca105404a50684a9a4b37646b2bbd17339120849aad6f9c8ef8e2abc4d28ba6ad144195b3db1e676c3d7a3335751b134ed58397d62991895b04a9f6498eb8
-
SSDEEP
12288:VmwtkzfN9A6V20TKzB32n/3Ki0mGXq7mclWKpNCi/g:ltkzf3A6VR6O/OrXqicvN
Malware Config
Extracted
remcos
awa
gdyhjjdhbvxgsfe.gotdns.ch:2718
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-J6C5A7
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Drops startup file 2 IoCs
Processes:
Powershell.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysteJHuJm.exe Powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysteJHuJm.exe Powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
lucerne as at 28 Nov 2022.exedescription pid process target process PID 5080 set thread context of 476 5080 lucerne as at 28 Nov 2022.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Powershell.exepid process 3760 Powershell.exe 3760 Powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
lucerne as at 28 Nov 2022.exePowershell.exedescription pid process Token: SeDebugPrivilege 5080 lucerne as at 28 Nov 2022.exe Token: SeDebugPrivilege 3760 Powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
RegSvcs.exepid process 476 RegSvcs.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
RegSvcs.exepid process 476 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 476 RegSvcs.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
lucerne as at 28 Nov 2022.exedescription pid process target process PID 5080 wrote to memory of 3760 5080 lucerne as at 28 Nov 2022.exe Powershell.exe PID 5080 wrote to memory of 3760 5080 lucerne as at 28 Nov 2022.exe Powershell.exe PID 5080 wrote to memory of 3760 5080 lucerne as at 28 Nov 2022.exe Powershell.exe PID 5080 wrote to memory of 476 5080 lucerne as at 28 Nov 2022.exe RegSvcs.exe PID 5080 wrote to memory of 476 5080 lucerne as at 28 Nov 2022.exe RegSvcs.exe PID 5080 wrote to memory of 476 5080 lucerne as at 28 Nov 2022.exe RegSvcs.exe PID 5080 wrote to memory of 476 5080 lucerne as at 28 Nov 2022.exe RegSvcs.exe PID 5080 wrote to memory of 476 5080 lucerne as at 28 Nov 2022.exe RegSvcs.exe PID 5080 wrote to memory of 476 5080 lucerne as at 28 Nov 2022.exe RegSvcs.exe PID 5080 wrote to memory of 476 5080 lucerne as at 28 Nov 2022.exe RegSvcs.exe PID 5080 wrote to memory of 476 5080 lucerne as at 28 Nov 2022.exe RegSvcs.exe PID 5080 wrote to memory of 476 5080 lucerne as at 28 Nov 2022.exe RegSvcs.exe PID 5080 wrote to memory of 476 5080 lucerne as at 28 Nov 2022.exe RegSvcs.exe PID 5080 wrote to memory of 476 5080 lucerne as at 28 Nov 2022.exe RegSvcs.exe PID 5080 wrote to memory of 476 5080 lucerne as at 28 Nov 2022.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\lucerne as at 28 Nov 2022.exe"C:\Users\Admin\AppData\Local\Temp\lucerne as at 28 Nov 2022.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\lucerne as at 28 Nov 2022.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysteJHuJm.exe'2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/476-138-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/476-150-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/476-146-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/476-141-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/476-139-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/476-137-0x0000000000000000-mapping.dmp
-
memory/3760-140-0x0000000004E50000-0x0000000005478000-memory.dmpFilesize
6.2MB
-
memory/3760-136-0x0000000004790000-0x00000000047C6000-memory.dmpFilesize
216KB
-
memory/3760-135-0x0000000000000000-mapping.dmp
-
memory/3760-142-0x0000000004DA0000-0x0000000004DC2000-memory.dmpFilesize
136KB
-
memory/3760-143-0x0000000005670000-0x00000000056D6000-memory.dmpFilesize
408KB
-
memory/3760-144-0x00000000056E0000-0x0000000005746000-memory.dmpFilesize
408KB
-
memory/3760-145-0x0000000005D70000-0x0000000005D8E000-memory.dmpFilesize
120KB
-
memory/3760-147-0x0000000006DE0000-0x0000000006E76000-memory.dmpFilesize
600KB
-
memory/3760-148-0x0000000006240000-0x000000000625A000-memory.dmpFilesize
104KB
-
memory/3760-149-0x00000000062A0000-0x00000000062C2000-memory.dmpFilesize
136KB
-
memory/5080-132-0x0000000000EE0000-0x0000000000F76000-memory.dmpFilesize
600KB
-
memory/5080-134-0x0000000005970000-0x0000000005A0C000-memory.dmpFilesize
624KB
-
memory/5080-133-0x0000000005E80000-0x0000000006424000-memory.dmpFilesize
5.6MB