Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
01-02-2023 04:51
Static task
static1
Behavioral task
behavioral1
Sample
ORDER INQUIRY 20230201.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ORDER INQUIRY 20230201.exe
Resource
win10v2004-20220812-en
General
-
Target
ORDER INQUIRY 20230201.exe
-
Size
1.1MB
-
MD5
4bc918bf6311c5b753c353efd306547e
-
SHA1
9b7301fc448a6d9564e6b984363190ffa88ab891
-
SHA256
89f4203e055ad6d3b40b74d683ed1ca0436ad4df41c3456f23134c4a15eb6c13
-
SHA512
0d9b575c93cb73de5cfc175335f72cefb8b9d3f5d5e90ab1353b0362fbde0bbcfc288fa5039759fb92ad0154e836c3cefb9636e7a108d5706023611e1ac93cfe
-
SSDEEP
24576:peOaJr8zw6RgDlCwwWbYqhseWy97+3A3Me83RAiTH/qc4N34:pAJr8zgDlCww6YqhsOY3OKhAiT
Malware Config
Extracted
remcos
NEW REM STUB
onyem.duckdns.org:5050
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-HFP2Q6
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
ORDER INQUIRY 20230201.exedescription pid process target process PID 1720 set thread context of 1784 1720 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
ORDER INQUIRY 20230201.exepowershell.exepid process 1720 ORDER INQUIRY 20230201.exe 1720 ORDER INQUIRY 20230201.exe 1720 ORDER INQUIRY 20230201.exe 1720 ORDER INQUIRY 20230201.exe 1720 ORDER INQUIRY 20230201.exe 1720 ORDER INQUIRY 20230201.exe 512 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ORDER INQUIRY 20230201.exepowershell.exedescription pid process Token: SeDebugPrivilege 1720 ORDER INQUIRY 20230201.exe Token: SeDebugPrivilege 512 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ORDER INQUIRY 20230201.exepid process 1784 ORDER INQUIRY 20230201.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
ORDER INQUIRY 20230201.exedescription pid process target process PID 1720 wrote to memory of 512 1720 ORDER INQUIRY 20230201.exe powershell.exe PID 1720 wrote to memory of 512 1720 ORDER INQUIRY 20230201.exe powershell.exe PID 1720 wrote to memory of 512 1720 ORDER INQUIRY 20230201.exe powershell.exe PID 1720 wrote to memory of 512 1720 ORDER INQUIRY 20230201.exe powershell.exe PID 1720 wrote to memory of 2036 1720 ORDER INQUIRY 20230201.exe schtasks.exe PID 1720 wrote to memory of 2036 1720 ORDER INQUIRY 20230201.exe schtasks.exe PID 1720 wrote to memory of 2036 1720 ORDER INQUIRY 20230201.exe schtasks.exe PID 1720 wrote to memory of 2036 1720 ORDER INQUIRY 20230201.exe schtasks.exe PID 1720 wrote to memory of 1784 1720 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1720 wrote to memory of 1784 1720 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1720 wrote to memory of 1784 1720 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1720 wrote to memory of 1784 1720 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1720 wrote to memory of 1784 1720 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1720 wrote to memory of 1784 1720 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1720 wrote to memory of 1784 1720 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1720 wrote to memory of 1784 1720 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1720 wrote to memory of 1784 1720 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1720 wrote to memory of 1784 1720 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1720 wrote to memory of 1784 1720 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1720 wrote to memory of 1784 1720 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1720 wrote to memory of 1784 1720 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe"C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VlANzLOhprFUhQ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VlANzLOhprFUhQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC801.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe"C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC801.tmpFilesize
1KB
MD5022c3269b36f468fae1d42abab85c7f0
SHA1a13651bf59978005e4ca882064b1888cfbd87af5
SHA256788806b4f3a7c75231b459f21a199537ccf662aae9f8f3fd8bc2e39ace60e3f2
SHA512d19f3c67d31105a8299ed71c47ad1b1e43783b62758b5ab05ebdf8482ddc4ecd3c0ac4cef265239ec1f72396c2986f229cff162b6990131b46d8a31a981bf5bd
-
memory/512-59-0x0000000000000000-mapping.dmp
-
memory/512-82-0x000000006EB70000-0x000000006F11B000-memory.dmpFilesize
5.7MB
-
memory/512-81-0x000000006EB70000-0x000000006F11B000-memory.dmpFilesize
5.7MB
-
memory/1720-54-0x00000000010A0000-0x00000000011B6000-memory.dmpFilesize
1.1MB
-
memory/1720-55-0x0000000075D51000-0x0000000075D53000-memory.dmpFilesize
8KB
-
memory/1720-56-0x0000000000490000-0x00000000004A4000-memory.dmpFilesize
80KB
-
memory/1720-57-0x00000000008D0000-0x00000000008DA000-memory.dmpFilesize
40KB
-
memory/1720-58-0x0000000007F50000-0x0000000008002000-memory.dmpFilesize
712KB
-
memory/1720-63-0x0000000008070000-0x00000000080EC000-memory.dmpFilesize
496KB
-
memory/1784-77-0x00000000004327A4-mapping.dmp
-
memory/1784-76-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1784-67-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1784-70-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1784-71-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1784-72-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1784-74-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1784-69-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1784-65-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1784-80-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1784-64-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1784-84-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1784-83-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/2036-60-0x0000000000000000-mapping.dmp