Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
10-01-2023 12:00
Static task
static1
Behavioral task
behavioral1
Sample
fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe
Resource
win10v2004-20220812-en
General
-
Target
fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe
-
Size
1.1MB
-
MD5
992bb973cca802daf8f95c6a0015267b
-
SHA1
b1fdb6f34f989930ef0b7d8b090f52591ac4d316
-
SHA256
fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c
-
SHA512
094b2e0ec3209694201d937f7c25aef8cdbe75144d3a51214e1f7bd99b8e35a240da7ca3a16370c4ddd0660421a8f49ded13f0bdf294d18e2b79866e5faee4f2
-
SSDEEP
24576:mPskkedT3pe/HfSOuFYZXsdWikf745uo4W18XO:mwy3o/wFCx3zuIWK+
Malware Config
Extracted
remcos
Eric-Host
craigjonson91211.freedynamicdns.net:2011
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
wee.exe
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Rmc-3CS7D1
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
qos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
wee.exewee.exepid process 3084 wee.exe 4712 wee.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exefd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
wee.exefd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ wee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qos = "\"C:\\Users\\Admin\\AppData\\Roaming\\wee.exe\"" wee.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\ fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qos = "\"C:\\Users\\Admin\\AppData\\Roaming\\wee.exe\"" fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qos = "\"C:\\Users\\Admin\\AppData\\Roaming\\wee.exe\"" fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\ wee.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qos = "\"C:\\Users\\Admin\\AppData\\Roaming\\wee.exe\"" wee.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exewee.exedescription pid process target process PID 2992 set thread context of 1156 2992 fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe PID 3084 set thread context of 4712 3084 wee.exe wee.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
wee.exepid process 4712 wee.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exefd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exeWScript.execmd.exewee.exedescription pid process target process PID 2992 wrote to memory of 1156 2992 fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe PID 2992 wrote to memory of 1156 2992 fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe PID 2992 wrote to memory of 1156 2992 fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe PID 2992 wrote to memory of 1156 2992 fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe PID 2992 wrote to memory of 1156 2992 fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe PID 2992 wrote to memory of 1156 2992 fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe PID 2992 wrote to memory of 1156 2992 fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe PID 2992 wrote to memory of 1156 2992 fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe PID 2992 wrote to memory of 1156 2992 fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe PID 2992 wrote to memory of 1156 2992 fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe PID 2992 wrote to memory of 1156 2992 fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe PID 2992 wrote to memory of 1156 2992 fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe PID 1156 wrote to memory of 2388 1156 fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe WScript.exe PID 1156 wrote to memory of 2388 1156 fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe WScript.exe PID 1156 wrote to memory of 2388 1156 fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe WScript.exe PID 2388 wrote to memory of 4472 2388 WScript.exe cmd.exe PID 2388 wrote to memory of 4472 2388 WScript.exe cmd.exe PID 2388 wrote to memory of 4472 2388 WScript.exe cmd.exe PID 4472 wrote to memory of 3084 4472 cmd.exe wee.exe PID 4472 wrote to memory of 3084 4472 cmd.exe wee.exe PID 4472 wrote to memory of 3084 4472 cmd.exe wee.exe PID 3084 wrote to memory of 4712 3084 wee.exe wee.exe PID 3084 wrote to memory of 4712 3084 wee.exe wee.exe PID 3084 wrote to memory of 4712 3084 wee.exe wee.exe PID 3084 wrote to memory of 4712 3084 wee.exe wee.exe PID 3084 wrote to memory of 4712 3084 wee.exe wee.exe PID 3084 wrote to memory of 4712 3084 wee.exe wee.exe PID 3084 wrote to memory of 4712 3084 wee.exe wee.exe PID 3084 wrote to memory of 4712 3084 wee.exe wee.exe PID 3084 wrote to memory of 4712 3084 wee.exe wee.exe PID 3084 wrote to memory of 4712 3084 wee.exe wee.exe PID 3084 wrote to memory of 4712 3084 wee.exe wee.exe PID 3084 wrote to memory of 4712 3084 wee.exe wee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe"C:\Users\Admin\AppData\Local\Temp\fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe"C:\Users\Admin\AppData\Local\Temp\fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\wsmoc.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\wee.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\wee.exeC:\Users\Admin\AppData\Roaming\wee.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\wee.exe"C:\Users\Admin\AppData\Roaming\wee.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\wsmoc.vbsFilesize
398B
MD5f1536fc12b615b3b046757ce09cc2b41
SHA1c67cacdb7dd2a1aa58ec9d2f554a831935fea0a2
SHA256c03a7b60b1a4a6d06dbe6d1fc3444f68a64e1b9e48e1967b60003b0b02c78502
SHA51239d0bfce41381099628b3d7f184c0aa49a98a9eef90da3b4be953530f3115bb4b72f871c6cf5026cce8d760b088865b63bbab3d8911d3e4513855712a3062207
-
C:\Users\Admin\AppData\Roaming\wee.exeFilesize
1.1MB
MD5992bb973cca802daf8f95c6a0015267b
SHA1b1fdb6f34f989930ef0b7d8b090f52591ac4d316
SHA256fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c
SHA512094b2e0ec3209694201d937f7c25aef8cdbe75144d3a51214e1f7bd99b8e35a240da7ca3a16370c4ddd0660421a8f49ded13f0bdf294d18e2b79866e5faee4f2
-
C:\Users\Admin\AppData\Roaming\wee.exeFilesize
1.1MB
MD5992bb973cca802daf8f95c6a0015267b
SHA1b1fdb6f34f989930ef0b7d8b090f52591ac4d316
SHA256fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c
SHA512094b2e0ec3209694201d937f7c25aef8cdbe75144d3a51214e1f7bd99b8e35a240da7ca3a16370c4ddd0660421a8f49ded13f0bdf294d18e2b79866e5faee4f2
-
C:\Users\Admin\AppData\Roaming\wee.exeFilesize
1.1MB
MD5992bb973cca802daf8f95c6a0015267b
SHA1b1fdb6f34f989930ef0b7d8b090f52591ac4d316
SHA256fd268ac25b0f2a211b7538d2be175f27833b058f16437a8c2625e7762074db7c
SHA512094b2e0ec3209694201d937f7c25aef8cdbe75144d3a51214e1f7bd99b8e35a240da7ca3a16370c4ddd0660421a8f49ded13f0bdf294d18e2b79866e5faee4f2
-
memory/1156-143-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1156-137-0x0000000000000000-mapping.dmp
-
memory/1156-138-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1156-139-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1156-140-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1156-141-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2388-142-0x0000000000000000-mapping.dmp
-
memory/2992-132-0x0000000000DE0000-0x0000000000F06000-memory.dmpFilesize
1.1MB
-
memory/2992-136-0x0000000005BB0000-0x0000000005C4C000-memory.dmpFilesize
624KB
-
memory/2992-135-0x00000000058B0000-0x00000000058BA000-memory.dmpFilesize
40KB
-
memory/2992-134-0x0000000005950000-0x00000000059E2000-memory.dmpFilesize
584KB
-
memory/2992-133-0x0000000005E60000-0x0000000006404000-memory.dmpFilesize
5.6MB
-
memory/3084-146-0x0000000000000000-mapping.dmp
-
memory/4472-145-0x0000000000000000-mapping.dmp
-
memory/4712-149-0x0000000000000000-mapping.dmp
-
memory/4712-152-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4712-153-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4712-154-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4712-155-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB