Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
28-12-2022 20:09
Static task
static1
Behavioral task
behavioral1
Sample
Swift copy.exe
Resource
win7-20220812-en
General
-
Target
Swift copy.exe
-
Size
577KB
-
MD5
cdb913e2799fbc69725dfd5f8449d1c7
-
SHA1
00e54606f35a1e4ae40c0507b87b588018098e09
-
SHA256
4660f046efd070aa71962df9b4f89f9ae34a8f49cfb9ebd514690d0efc4fd1ca
-
SHA512
4037c280d922e395c7aa30fb832bf78c2aa9a703098ad0ac699cec382ef81143a07a13bcadb9e92a5690318458a794690919da266457be4e9b6276f13e31a60c
-
SSDEEP
12288:3p6DNj5Z1JCFtOiL9d11qG7mmQh6s16qd06qblCi/:3pwx5Z1gTjD1PAhT1Rm6ulN
Malware Config
Extracted
remcos
UC
ucremcz1.ddns.net:1823
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
BIN.exe
-
copy_folder
BIN
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Rmc-X402GF
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
bin
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Drops startup file 2 IoCs
Processes:
Powershell.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systensnsnm.exe Powershell.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systensnsnm.exe Powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Swift copy.exedescription pid process target process PID 4616 set thread context of 3544 4616 Swift copy.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Powershell.exepid process 4044 Powershell.exe 4044 Powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Swift copy.exePowershell.exedescription pid process Token: SeDebugPrivilege 4616 Swift copy.exe Token: SeDebugPrivilege 4044 Powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 3544 RegSvcs.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Swift copy.exedescription pid process target process PID 4616 wrote to memory of 4044 4616 Swift copy.exe Powershell.exe PID 4616 wrote to memory of 4044 4616 Swift copy.exe Powershell.exe PID 4616 wrote to memory of 4044 4616 Swift copy.exe Powershell.exe PID 4616 wrote to memory of 3544 4616 Swift copy.exe RegSvcs.exe PID 4616 wrote to memory of 3544 4616 Swift copy.exe RegSvcs.exe PID 4616 wrote to memory of 3544 4616 Swift copy.exe RegSvcs.exe PID 4616 wrote to memory of 3544 4616 Swift copy.exe RegSvcs.exe PID 4616 wrote to memory of 3544 4616 Swift copy.exe RegSvcs.exe PID 4616 wrote to memory of 3544 4616 Swift copy.exe RegSvcs.exe PID 4616 wrote to memory of 3544 4616 Swift copy.exe RegSvcs.exe PID 4616 wrote to memory of 3544 4616 Swift copy.exe RegSvcs.exe PID 4616 wrote to memory of 3544 4616 Swift copy.exe RegSvcs.exe PID 4616 wrote to memory of 3544 4616 Swift copy.exe RegSvcs.exe PID 4616 wrote to memory of 3544 4616 Swift copy.exe RegSvcs.exe PID 4616 wrote to memory of 3544 4616 Swift copy.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Swift copy.exe"C:\Users\Admin\AppData\Local\Temp\Swift copy.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\Swift copy.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systensnsnm.exe'2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4044 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:3544
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3544-138-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3544-150-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3544-145-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3544-141-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3544-137-0x0000000000000000-mapping.dmp
-
memory/3544-140-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4044-136-0x0000000000C40000-0x0000000000C76000-memory.dmpFilesize
216KB
-
memory/4044-139-0x00000000050F0000-0x0000000005718000-memory.dmpFilesize
6.2MB
-
memory/4044-135-0x0000000000000000-mapping.dmp
-
memory/4044-142-0x0000000004E20000-0x0000000004E42000-memory.dmpFilesize
136KB
-
memory/4044-143-0x0000000005720000-0x0000000005786000-memory.dmpFilesize
408KB
-
memory/4044-144-0x0000000005790000-0x00000000057F6000-memory.dmpFilesize
408KB
-
memory/4044-146-0x0000000005DB0000-0x0000000005DCE000-memory.dmpFilesize
120KB
-
memory/4044-147-0x0000000006300000-0x0000000006396000-memory.dmpFilesize
600KB
-
memory/4044-148-0x0000000006280000-0x000000000629A000-memory.dmpFilesize
104KB
-
memory/4044-149-0x00000000062D0000-0x00000000062F2000-memory.dmpFilesize
136KB
-
memory/4616-132-0x0000000000EB0000-0x0000000000F48000-memory.dmpFilesize
608KB
-
memory/4616-134-0x0000000005900000-0x000000000599C000-memory.dmpFilesize
624KB
-
memory/4616-133-0x0000000005F80000-0x0000000006524000-memory.dmpFilesize
5.6MB