Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
28-12-2022 01:18
Static task
static1
Behavioral task
behavioral1
Sample
PRICE QUOTATION 20221213.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
PRICE QUOTATION 20221213.exe
Resource
win10v2004-20221111-en
General
-
Target
PRICE QUOTATION 20221213.exe
-
Size
1.4MB
-
MD5
bd7e3b9eaff60e5729b3744cf7216f5b
-
SHA1
21db492e46494e622b41f59949b5efc987bdf341
-
SHA256
3369eb912edf7df233e2a70803ef0cee6d914a6e40ac6da0e54e20c72c32f65f
-
SHA512
742d0d74f23d25c02f2ce4b6535aa770022d0f3a2744cddf86e55349e40faa5a19ea1c5cda29511448e9f131aea6e60222ddf7bed1e6c1983824869c2452a534
-
SSDEEP
6144:Rp45B+dKiTNSNvLmgquzl5+ElI1lF/0mDPQAcg2zVd/Pn5XxZLffm49GFbNWjob9:RuVDTpGDma
Malware Config
Extracted
remcos
NEW REM STUB
valvesco.duckdns.org:5050
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-48V73L
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
Processes:
PRICE QUOTATION 20221213.exedescription pid process target process PID 4724 created 2616 4724 PRICE QUOTATION 20221213.exe Explorer.EXE PID 4724 created 2616 4724 PRICE QUOTATION 20221213.exe Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PRICE QUOTATION 20221213.exedescription pid process target process PID 4724 set thread context of 2128 4724 PRICE QUOTATION 20221213.exe PRICE QUOTATION 20221213.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
PRICE QUOTATION 20221213.exepid process 4724 PRICE QUOTATION 20221213.exe 4724 PRICE QUOTATION 20221213.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PRICE QUOTATION 20221213.exedescription pid process Token: SeDebugPrivilege 4724 PRICE QUOTATION 20221213.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
PRICE QUOTATION 20221213.exepid process 2128 PRICE QUOTATION 20221213.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
PRICE QUOTATION 20221213.exedescription pid process target process PID 4724 wrote to memory of 4604 4724 PRICE QUOTATION 20221213.exe PRICE QUOTATION 20221213.exe PID 4724 wrote to memory of 4604 4724 PRICE QUOTATION 20221213.exe PRICE QUOTATION 20221213.exe PID 4724 wrote to memory of 4604 4724 PRICE QUOTATION 20221213.exe PRICE QUOTATION 20221213.exe PID 4724 wrote to memory of 2128 4724 PRICE QUOTATION 20221213.exe PRICE QUOTATION 20221213.exe PID 4724 wrote to memory of 2128 4724 PRICE QUOTATION 20221213.exe PRICE QUOTATION 20221213.exe PID 4724 wrote to memory of 2128 4724 PRICE QUOTATION 20221213.exe PRICE QUOTATION 20221213.exe PID 4724 wrote to memory of 2128 4724 PRICE QUOTATION 20221213.exe PRICE QUOTATION 20221213.exe PID 4724 wrote to memory of 2128 4724 PRICE QUOTATION 20221213.exe PRICE QUOTATION 20221213.exe PID 4724 wrote to memory of 2128 4724 PRICE QUOTATION 20221213.exe PRICE QUOTATION 20221213.exe PID 4724 wrote to memory of 2128 4724 PRICE QUOTATION 20221213.exe PRICE QUOTATION 20221213.exe PID 4724 wrote to memory of 2128 4724 PRICE QUOTATION 20221213.exe PRICE QUOTATION 20221213.exe PID 4724 wrote to memory of 2128 4724 PRICE QUOTATION 20221213.exe PRICE QUOTATION 20221213.exe PID 4724 wrote to memory of 2128 4724 PRICE QUOTATION 20221213.exe PRICE QUOTATION 20221213.exe PID 4724 wrote to memory of 2128 4724 PRICE QUOTATION 20221213.exe PRICE QUOTATION 20221213.exe PID 4724 wrote to memory of 2128 4724 PRICE QUOTATION 20221213.exe PRICE QUOTATION 20221213.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\PRICE QUOTATION 20221213.exe"C:\Users\Admin\AppData\Local\Temp\PRICE QUOTATION 20221213.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PRICE QUOTATION 20221213.exe"C:\Users\Admin\AppData\Local\Temp\PRICE QUOTATION 20221213.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PRICE QUOTATION 20221213.exe"C:\Users\Admin\AppData\Local\Temp\PRICE QUOTATION 20221213.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2128-134-0x0000000000000000-mapping.dmp
-
memory/2128-136-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2128-135-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2128-137-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2128-138-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2128-139-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4724-132-0x00000000003C0000-0x000000000052A000-memory.dmpFilesize
1.4MB
-
memory/4724-133-0x000000000C7C0000-0x000000000CD64000-memory.dmpFilesize
5.6MB