Analysis
-
max time kernel
150s -
max time network
167s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
06-12-2022 17:59
Static task
static1
Behavioral task
behavioral1
Sample
RFQ-01.300.TRGVH.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
RFQ-01.300.TRGVH.exe
Resource
win10v2004-20220812-en
General
-
Target
RFQ-01.300.TRGVH.exe
-
Size
1012KB
-
MD5
b6a6fc8a799dd7d74a93685b36e42f94
-
SHA1
96ee3eaf5acd15c65e0ff338a715d177439141fd
-
SHA256
34e71ffe582c188deddcd4d31823cac8abe3c24880a0e85f5806140db9b6c8ab
-
SHA512
bedf43a2dee32d43e71e68a0d47304dda4022589df4d5e93b5a6b623c629d2a6d630c6bb4a13a269969064efa24680ba350957e1c269e68d7b720ac0fa6c6f8f
-
SSDEEP
24576:Uomxi8UzasrFA6QTM4mXdNvuJ65fyIWAAmPPWgHOTB+QF/7:UoKXyhrFCM4mtNvuJ65fymAmPPWgHyMQ
Malware Config
Extracted
remcos
RemoteHost
51.75.209.245:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-CMFPLR
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
RFQ-01.300.TRGVH.exedescription pid process target process PID 2028 set thread context of 292 2028 RFQ-01.300.TRGVH.exe RFQ-01.300.TRGVH.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
RFQ-01.300.TRGVH.exepowershell.exepowershell.exepid process 2028 RFQ-01.300.TRGVH.exe 2028 RFQ-01.300.TRGVH.exe 2028 RFQ-01.300.TRGVH.exe 2028 RFQ-01.300.TRGVH.exe 2028 RFQ-01.300.TRGVH.exe 2028 RFQ-01.300.TRGVH.exe 2028 RFQ-01.300.TRGVH.exe 2028 RFQ-01.300.TRGVH.exe 2028 RFQ-01.300.TRGVH.exe 2028 RFQ-01.300.TRGVH.exe 2028 RFQ-01.300.TRGVH.exe 2028 RFQ-01.300.TRGVH.exe 2028 RFQ-01.300.TRGVH.exe 2028 RFQ-01.300.TRGVH.exe 2028 RFQ-01.300.TRGVH.exe 2028 RFQ-01.300.TRGVH.exe 2028 RFQ-01.300.TRGVH.exe 2028 RFQ-01.300.TRGVH.exe 2028 RFQ-01.300.TRGVH.exe 2028 RFQ-01.300.TRGVH.exe 2028 RFQ-01.300.TRGVH.exe 1264 powershell.exe 376 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
RFQ-01.300.TRGVH.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2028 RFQ-01.300.TRGVH.exe Token: SeDebugPrivilege 1264 powershell.exe Token: SeDebugPrivilege 376 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RFQ-01.300.TRGVH.exepid process 292 RFQ-01.300.TRGVH.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
RFQ-01.300.TRGVH.exedescription pid process target process PID 2028 wrote to memory of 376 2028 RFQ-01.300.TRGVH.exe powershell.exe PID 2028 wrote to memory of 376 2028 RFQ-01.300.TRGVH.exe powershell.exe PID 2028 wrote to memory of 376 2028 RFQ-01.300.TRGVH.exe powershell.exe PID 2028 wrote to memory of 376 2028 RFQ-01.300.TRGVH.exe powershell.exe PID 2028 wrote to memory of 1264 2028 RFQ-01.300.TRGVH.exe powershell.exe PID 2028 wrote to memory of 1264 2028 RFQ-01.300.TRGVH.exe powershell.exe PID 2028 wrote to memory of 1264 2028 RFQ-01.300.TRGVH.exe powershell.exe PID 2028 wrote to memory of 1264 2028 RFQ-01.300.TRGVH.exe powershell.exe PID 2028 wrote to memory of 1656 2028 RFQ-01.300.TRGVH.exe schtasks.exe PID 2028 wrote to memory of 1656 2028 RFQ-01.300.TRGVH.exe schtasks.exe PID 2028 wrote to memory of 1656 2028 RFQ-01.300.TRGVH.exe schtasks.exe PID 2028 wrote to memory of 1656 2028 RFQ-01.300.TRGVH.exe schtasks.exe PID 2028 wrote to memory of 292 2028 RFQ-01.300.TRGVH.exe RFQ-01.300.TRGVH.exe PID 2028 wrote to memory of 292 2028 RFQ-01.300.TRGVH.exe RFQ-01.300.TRGVH.exe PID 2028 wrote to memory of 292 2028 RFQ-01.300.TRGVH.exe RFQ-01.300.TRGVH.exe PID 2028 wrote to memory of 292 2028 RFQ-01.300.TRGVH.exe RFQ-01.300.TRGVH.exe PID 2028 wrote to memory of 292 2028 RFQ-01.300.TRGVH.exe RFQ-01.300.TRGVH.exe PID 2028 wrote to memory of 292 2028 RFQ-01.300.TRGVH.exe RFQ-01.300.TRGVH.exe PID 2028 wrote to memory of 292 2028 RFQ-01.300.TRGVH.exe RFQ-01.300.TRGVH.exe PID 2028 wrote to memory of 292 2028 RFQ-01.300.TRGVH.exe RFQ-01.300.TRGVH.exe PID 2028 wrote to memory of 292 2028 RFQ-01.300.TRGVH.exe RFQ-01.300.TRGVH.exe PID 2028 wrote to memory of 292 2028 RFQ-01.300.TRGVH.exe RFQ-01.300.TRGVH.exe PID 2028 wrote to memory of 292 2028 RFQ-01.300.TRGVH.exe RFQ-01.300.TRGVH.exe PID 2028 wrote to memory of 292 2028 RFQ-01.300.TRGVH.exe RFQ-01.300.TRGVH.exe PID 2028 wrote to memory of 292 2028 RFQ-01.300.TRGVH.exe RFQ-01.300.TRGVH.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ-01.300.TRGVH.exe"C:\Users\Admin\AppData\Local\Temp\RFQ-01.300.TRGVH.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RFQ-01.300.TRGVH.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dnyWDvH.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dnyWDvH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp715A.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\RFQ-01.300.TRGVH.exe"C:\Users\Admin\AppData\Local\Temp\RFQ-01.300.TRGVH.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp715A.tmpFilesize
1KB
MD58465e13e17160f6c056184643a1db804
SHA1d2f3f4bc6e718befad5c392d3f6b0720dccd3cbe
SHA256ca9c3a414001c6572c99ce5d778d2005c27433ddf5132c296103567488c0791d
SHA5122930e311b6bce8dfbf9d16c88a80c79785473df4133b9f48d54777e41596834f5135eaed8ae1de6123c30a7df378a87aa47cb5d67815194a1ef14fea0c3b6f35
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5f1ab36f349048fb97c598eec5795e148
SHA1093b60765173913bceca388c854e70a42e6694ea
SHA256b1fd522c72737136205d99bd33e5826ebd057999a59ad24eff4eaf8aca23b787
SHA512b79f778a737e8227ae42721bc1a8373c962ca3a74285156ce84d85e8e738242abdb8951ca59906d5f21bdd0cc1654e95db3aa98cd12685b1a9155d30b39818d7
-
memory/292-81-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/292-86-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/292-72-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/292-74-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/292-85-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/292-75-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/292-70-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/292-79-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/292-77-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/292-82-0x00000000004327A4-mapping.dmp
-
memory/292-76-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/292-69-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/292-89-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/376-67-0x000000006F8E0000-0x000000006FE8B000-memory.dmpFilesize
5.7MB
-
memory/376-59-0x0000000000000000-mapping.dmp
-
memory/376-88-0x000000006F8E0000-0x000000006FE8B000-memory.dmpFilesize
5.7MB
-
memory/1264-66-0x000000006F8E0000-0x000000006FE8B000-memory.dmpFilesize
5.7MB
-
memory/1264-87-0x000000006F8E0000-0x000000006FE8B000-memory.dmpFilesize
5.7MB
-
memory/1264-61-0x0000000000000000-mapping.dmp
-
memory/1656-62-0x0000000000000000-mapping.dmp
-
memory/2028-58-0x0000000005D20000-0x0000000005DDE000-memory.dmpFilesize
760KB
-
memory/2028-54-0x00000000012A0000-0x00000000013A2000-memory.dmpFilesize
1.0MB
-
memory/2028-57-0x00000000003B0000-0x00000000003BE000-memory.dmpFilesize
56KB
-
memory/2028-68-0x0000000005EE0000-0x0000000005F68000-memory.dmpFilesize
544KB
-
memory/2028-55-0x0000000076651000-0x0000000076653000-memory.dmpFilesize
8KB
-
memory/2028-56-0x0000000000420000-0x000000000043A000-memory.dmpFilesize
104KB