Analysis
-
max time kernel
148s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-02-2023 04:51
Static task
static1
Behavioral task
behavioral1
Sample
ORDER INQUIRY 20230201.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ORDER INQUIRY 20230201.exe
Resource
win10v2004-20220812-en
General
-
Target
ORDER INQUIRY 20230201.exe
-
Size
1.1MB
-
MD5
4bc918bf6311c5b753c353efd306547e
-
SHA1
9b7301fc448a6d9564e6b984363190ffa88ab891
-
SHA256
89f4203e055ad6d3b40b74d683ed1ca0436ad4df41c3456f23134c4a15eb6c13
-
SHA512
0d9b575c93cb73de5cfc175335f72cefb8b9d3f5d5e90ab1353b0362fbde0bbcfc288fa5039759fb92ad0154e836c3cefb9636e7a108d5706023611e1ac93cfe
-
SSDEEP
24576:peOaJr8zw6RgDlCwwWbYqhseWy97+3A3Me83RAiTH/qc4N34:pAJr8zgDlCww6YqhsOY3OKhAiT
Malware Config
Extracted
remcos
NEW REM STUB
onyem.duckdns.org:5050
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-HFP2Q6
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ORDER INQUIRY 20230201.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation ORDER INQUIRY 20230201.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ORDER INQUIRY 20230201.exedescription pid process target process PID 1300 set thread context of 3032 1300 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
ORDER INQUIRY 20230201.exepowershell.exepid process 1300 ORDER INQUIRY 20230201.exe 1300 ORDER INQUIRY 20230201.exe 1300 ORDER INQUIRY 20230201.exe 1300 ORDER INQUIRY 20230201.exe 1300 ORDER INQUIRY 20230201.exe 1300 ORDER INQUIRY 20230201.exe 1300 ORDER INQUIRY 20230201.exe 4580 powershell.exe 4580 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ORDER INQUIRY 20230201.exepowershell.exedescription pid process Token: SeDebugPrivilege 1300 ORDER INQUIRY 20230201.exe Token: SeDebugPrivilege 4580 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ORDER INQUIRY 20230201.exepid process 3032 ORDER INQUIRY 20230201.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
ORDER INQUIRY 20230201.exedescription pid process target process PID 1300 wrote to memory of 4580 1300 ORDER INQUIRY 20230201.exe powershell.exe PID 1300 wrote to memory of 4580 1300 ORDER INQUIRY 20230201.exe powershell.exe PID 1300 wrote to memory of 4580 1300 ORDER INQUIRY 20230201.exe powershell.exe PID 1300 wrote to memory of 3852 1300 ORDER INQUIRY 20230201.exe schtasks.exe PID 1300 wrote to memory of 3852 1300 ORDER INQUIRY 20230201.exe schtasks.exe PID 1300 wrote to memory of 3852 1300 ORDER INQUIRY 20230201.exe schtasks.exe PID 1300 wrote to memory of 3032 1300 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1300 wrote to memory of 3032 1300 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1300 wrote to memory of 3032 1300 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1300 wrote to memory of 3032 1300 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1300 wrote to memory of 3032 1300 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1300 wrote to memory of 3032 1300 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1300 wrote to memory of 3032 1300 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1300 wrote to memory of 3032 1300 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1300 wrote to memory of 3032 1300 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1300 wrote to memory of 3032 1300 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1300 wrote to memory of 3032 1300 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1300 wrote to memory of 3032 1300 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe"C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VlANzLOhprFUhQ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VlANzLOhprFUhQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3DF3.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe"C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3DF3.tmpFilesize
1KB
MD5c04dc4d7af83862275b2a910e79e8123
SHA15754c42ae4d7183961da614d97d39ba72487009d
SHA256fdc4446208fc91e98bd8d54c7187effa8501dc14f2659066ffb452ca1e57de66
SHA512ee982a0fa589dbef14361309c0ff77990223082b8050c75bf2f993e5f3e71ee00d9c5ac44cb8046a81db4343bfcbb3bb654b905870dfea3700a362f33915b11f
-
memory/1300-133-0x00000000051C0000-0x0000000005764000-memory.dmpFilesize
5.6MB
-
memory/1300-134-0x0000000004CB0000-0x0000000004D42000-memory.dmpFilesize
584KB
-
memory/1300-135-0x0000000004C80000-0x0000000004C8A000-memory.dmpFilesize
40KB
-
memory/1300-136-0x0000000008690000-0x000000000872C000-memory.dmpFilesize
624KB
-
memory/1300-132-0x00000000001B0000-0x00000000002C6000-memory.dmpFilesize
1.1MB
-
memory/3032-141-0x0000000000000000-mapping.dmp
-
memory/3032-149-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3032-145-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3032-161-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3032-143-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3032-144-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3852-138-0x0000000000000000-mapping.dmp
-
memory/4580-146-0x00000000052C0000-0x00000000052E2000-memory.dmpFilesize
136KB
-
memory/4580-154-0x0000000007D50000-0x00000000083CA000-memory.dmpFilesize
6.5MB
-
memory/4580-147-0x0000000005CD0000-0x0000000005D36000-memory.dmpFilesize
408KB
-
memory/4580-148-0x0000000005D40000-0x0000000005DA6000-memory.dmpFilesize
408KB
-
memory/4580-139-0x0000000004DE0000-0x0000000004E16000-memory.dmpFilesize
216KB
-
memory/4580-150-0x0000000006380000-0x000000000639E000-memory.dmpFilesize
120KB
-
memory/4580-151-0x0000000006940000-0x0000000006972000-memory.dmpFilesize
200KB
-
memory/4580-152-0x000000006FF30000-0x000000006FF7C000-memory.dmpFilesize
304KB
-
memory/4580-153-0x0000000006920000-0x000000000693E000-memory.dmpFilesize
120KB
-
memory/4580-142-0x00000000055A0000-0x0000000005BC8000-memory.dmpFilesize
6.2MB
-
memory/4580-155-0x0000000007710000-0x000000000772A000-memory.dmpFilesize
104KB
-
memory/4580-156-0x0000000007780000-0x000000000778A000-memory.dmpFilesize
40KB
-
memory/4580-157-0x0000000007990000-0x0000000007A26000-memory.dmpFilesize
600KB
-
memory/4580-158-0x0000000007940000-0x000000000794E000-memory.dmpFilesize
56KB
-
memory/4580-159-0x0000000007A50000-0x0000000007A6A000-memory.dmpFilesize
104KB
-
memory/4580-160-0x0000000007A30000-0x0000000007A38000-memory.dmpFilesize
32KB
-
memory/4580-137-0x0000000000000000-mapping.dmp