Analysis
-
max time kernel
147s -
max time network
58s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
01-02-2023 04:52
Static task
static1
Behavioral task
behavioral1
Sample
ORDER INQUIRY 20230201.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ORDER INQUIRY 20230201.exe
Resource
win10v2004-20220812-en
General
-
Target
ORDER INQUIRY 20230201.exe
-
Size
1.1MB
-
MD5
4bc918bf6311c5b753c353efd306547e
-
SHA1
9b7301fc448a6d9564e6b984363190ffa88ab891
-
SHA256
89f4203e055ad6d3b40b74d683ed1ca0436ad4df41c3456f23134c4a15eb6c13
-
SHA512
0d9b575c93cb73de5cfc175335f72cefb8b9d3f5d5e90ab1353b0362fbde0bbcfc288fa5039759fb92ad0154e836c3cefb9636e7a108d5706023611e1ac93cfe
-
SSDEEP
24576:peOaJr8zw6RgDlCwwWbYqhseWy97+3A3Me83RAiTH/qc4N34:pAJr8zgDlCww6YqhsOY3OKhAiT
Malware Config
Extracted
remcos
NEW REM STUB
onyem.duckdns.org:5050
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-HFP2Q6
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
ORDER INQUIRY 20230201.exedescription pid process target process PID 1484 set thread context of 560 1484 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
ORDER INQUIRY 20230201.exepowershell.exepid process 1484 ORDER INQUIRY 20230201.exe 1484 ORDER INQUIRY 20230201.exe 1484 ORDER INQUIRY 20230201.exe 1484 ORDER INQUIRY 20230201.exe 1484 ORDER INQUIRY 20230201.exe 1484 ORDER INQUIRY 20230201.exe 672 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ORDER INQUIRY 20230201.exepowershell.exedescription pid process Token: SeDebugPrivilege 1484 ORDER INQUIRY 20230201.exe Token: SeDebugPrivilege 672 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ORDER INQUIRY 20230201.exepid process 560 ORDER INQUIRY 20230201.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
ORDER INQUIRY 20230201.exedescription pid process target process PID 1484 wrote to memory of 672 1484 ORDER INQUIRY 20230201.exe powershell.exe PID 1484 wrote to memory of 672 1484 ORDER INQUIRY 20230201.exe powershell.exe PID 1484 wrote to memory of 672 1484 ORDER INQUIRY 20230201.exe powershell.exe PID 1484 wrote to memory of 672 1484 ORDER INQUIRY 20230201.exe powershell.exe PID 1484 wrote to memory of 1488 1484 ORDER INQUIRY 20230201.exe schtasks.exe PID 1484 wrote to memory of 1488 1484 ORDER INQUIRY 20230201.exe schtasks.exe PID 1484 wrote to memory of 1488 1484 ORDER INQUIRY 20230201.exe schtasks.exe PID 1484 wrote to memory of 1488 1484 ORDER INQUIRY 20230201.exe schtasks.exe PID 1484 wrote to memory of 560 1484 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1484 wrote to memory of 560 1484 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1484 wrote to memory of 560 1484 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1484 wrote to memory of 560 1484 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1484 wrote to memory of 560 1484 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1484 wrote to memory of 560 1484 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1484 wrote to memory of 560 1484 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1484 wrote to memory of 560 1484 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1484 wrote to memory of 560 1484 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1484 wrote to memory of 560 1484 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1484 wrote to memory of 560 1484 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1484 wrote to memory of 560 1484 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 1484 wrote to memory of 560 1484 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe"C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VlANzLOhprFUhQ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VlANzLOhprFUhQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD7BA.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe"C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD7BA.tmpFilesize
1KB
MD547e5cb5a242071b5709ff504199b2098
SHA12cfe79faa51c365a54238cd8d5a5753651ac0b02
SHA256077e44e3b7a866f3bfeb572c62502def0b075867df81eec8524c279361cce275
SHA512070a7b63dbce48b9c32d68230bc96adf23df1721a9159e61a4f73baa03f6e580a484f66183cdfb09cd145719a843ca8e94b415f78114b1d6e276d93e4cf8b19c
-
memory/560-77-0x00000000004327A4-mapping.dmp
-
memory/560-76-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/560-67-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/560-69-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/560-82-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/560-80-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/560-74-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/560-72-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/560-64-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/560-70-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/560-71-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/560-84-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/560-65-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/672-81-0x000000006F240000-0x000000006F7EB000-memory.dmpFilesize
5.7MB
-
memory/672-59-0x0000000000000000-mapping.dmp
-
memory/672-83-0x000000006F240000-0x000000006F7EB000-memory.dmpFilesize
5.7MB
-
memory/1484-57-0x0000000000380000-0x000000000038A000-memory.dmpFilesize
40KB
-
memory/1484-63-0x0000000008340000-0x00000000083BC000-memory.dmpFilesize
496KB
-
memory/1484-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmpFilesize
8KB
-
memory/1484-56-0x0000000000360000-0x0000000000374000-memory.dmpFilesize
80KB
-
memory/1484-54-0x0000000001290000-0x00000000013A6000-memory.dmpFilesize
1.1MB
-
memory/1484-58-0x0000000005E20000-0x0000000005ED2000-memory.dmpFilesize
712KB
-
memory/1488-60-0x0000000000000000-mapping.dmp