Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-02-2023 04:52
Static task
static1
Behavioral task
behavioral1
Sample
ORDER INQUIRY 20230201.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ORDER INQUIRY 20230201.exe
Resource
win10v2004-20220812-en
General
-
Target
ORDER INQUIRY 20230201.exe
-
Size
1.1MB
-
MD5
4bc918bf6311c5b753c353efd306547e
-
SHA1
9b7301fc448a6d9564e6b984363190ffa88ab891
-
SHA256
89f4203e055ad6d3b40b74d683ed1ca0436ad4df41c3456f23134c4a15eb6c13
-
SHA512
0d9b575c93cb73de5cfc175335f72cefb8b9d3f5d5e90ab1353b0362fbde0bbcfc288fa5039759fb92ad0154e836c3cefb9636e7a108d5706023611e1ac93cfe
-
SSDEEP
24576:peOaJr8zw6RgDlCwwWbYqhseWy97+3A3Me83RAiTH/qc4N34:pAJr8zgDlCww6YqhsOY3OKhAiT
Malware Config
Extracted
remcos
NEW REM STUB
onyem.duckdns.org:5050
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-HFP2Q6
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ORDER INQUIRY 20230201.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation ORDER INQUIRY 20230201.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ORDER INQUIRY 20230201.exedescription pid process target process PID 5036 set thread context of 4196 5036 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
ORDER INQUIRY 20230201.exepowershell.exepid process 5036 ORDER INQUIRY 20230201.exe 5036 ORDER INQUIRY 20230201.exe 5036 ORDER INQUIRY 20230201.exe 5036 ORDER INQUIRY 20230201.exe 5036 ORDER INQUIRY 20230201.exe 5036 ORDER INQUIRY 20230201.exe 4052 powershell.exe 5036 ORDER INQUIRY 20230201.exe 4052 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ORDER INQUIRY 20230201.exepowershell.exedescription pid process Token: SeDebugPrivilege 5036 ORDER INQUIRY 20230201.exe Token: SeDebugPrivilege 4052 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ORDER INQUIRY 20230201.exepid process 4196 ORDER INQUIRY 20230201.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
ORDER INQUIRY 20230201.exedescription pid process target process PID 5036 wrote to memory of 4052 5036 ORDER INQUIRY 20230201.exe powershell.exe PID 5036 wrote to memory of 4052 5036 ORDER INQUIRY 20230201.exe powershell.exe PID 5036 wrote to memory of 4052 5036 ORDER INQUIRY 20230201.exe powershell.exe PID 5036 wrote to memory of 2416 5036 ORDER INQUIRY 20230201.exe schtasks.exe PID 5036 wrote to memory of 2416 5036 ORDER INQUIRY 20230201.exe schtasks.exe PID 5036 wrote to memory of 2416 5036 ORDER INQUIRY 20230201.exe schtasks.exe PID 5036 wrote to memory of 4196 5036 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 5036 wrote to memory of 4196 5036 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 5036 wrote to memory of 4196 5036 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 5036 wrote to memory of 4196 5036 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 5036 wrote to memory of 4196 5036 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 5036 wrote to memory of 4196 5036 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 5036 wrote to memory of 4196 5036 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 5036 wrote to memory of 4196 5036 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 5036 wrote to memory of 4196 5036 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 5036 wrote to memory of 4196 5036 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 5036 wrote to memory of 4196 5036 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe PID 5036 wrote to memory of 4196 5036 ORDER INQUIRY 20230201.exe ORDER INQUIRY 20230201.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe"C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VlANzLOhprFUhQ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VlANzLOhprFUhQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9C11.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe"C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp9C11.tmpFilesize
1KB
MD5db7f4a80deebb196c5f5e672b68d6175
SHA198024d25730aff4f334274b4c51873214bada65e
SHA256a4021bec5de5a521b7f1e4b751207cde77da7adeb86b7882e1b9c996eeea67d8
SHA512d2c6031f645b34da99b9df2e29815689f7206622b3f6a4f0ea7a09fe9ae43d01b63aa8cf0af2f456fc8831bc7527a0c891510d156bf5e7859d2ea1b0d4c79d2e
-
memory/2416-138-0x0000000000000000-mapping.dmp
-
memory/4052-146-0x0000000005800000-0x0000000005866000-memory.dmpFilesize
408KB
-
memory/4052-153-0x0000000006580000-0x000000000659E000-memory.dmpFilesize
120KB
-
memory/4052-160-0x0000000007600000-0x0000000007608000-memory.dmpFilesize
32KB
-
memory/4052-137-0x0000000000000000-mapping.dmp
-
memory/4052-147-0x0000000005970000-0x00000000059D6000-memory.dmpFilesize
408KB
-
memory/4052-139-0x00000000026C0000-0x00000000026F6000-memory.dmpFilesize
216KB
-
memory/4052-140-0x0000000005160000-0x0000000005788000-memory.dmpFilesize
6.2MB
-
memory/4052-158-0x0000000007510000-0x000000000751E000-memory.dmpFilesize
56KB
-
memory/4052-142-0x0000000004F00000-0x0000000004F22000-memory.dmpFilesize
136KB
-
memory/4052-157-0x0000000007560000-0x00000000075F6000-memory.dmpFilesize
600KB
-
memory/4052-156-0x0000000007360000-0x000000000736A000-memory.dmpFilesize
40KB
-
memory/4052-155-0x00000000072E0000-0x00000000072FA000-memory.dmpFilesize
104KB
-
memory/4052-154-0x0000000007930000-0x0000000007FAA000-memory.dmpFilesize
6.5MB
-
memory/4052-159-0x0000000007620000-0x000000000763A000-memory.dmpFilesize
104KB
-
memory/4052-152-0x00000000710E0000-0x000000007112C000-memory.dmpFilesize
304KB
-
memory/4052-149-0x0000000005FE0000-0x0000000005FFE000-memory.dmpFilesize
120KB
-
memory/4052-151-0x00000000065C0000-0x00000000065F2000-memory.dmpFilesize
200KB
-
memory/4196-150-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4196-148-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4196-161-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4196-145-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4196-144-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/4196-143-0x0000000000000000-mapping.dmp
-
memory/5036-135-0x0000000004C70000-0x0000000004C7A000-memory.dmpFilesize
40KB
-
memory/5036-133-0x0000000005120000-0x00000000056C4000-memory.dmpFilesize
5.6MB
-
memory/5036-134-0x0000000004AC0000-0x0000000004B52000-memory.dmpFilesize
584KB
-
memory/5036-136-0x00000000085F0000-0x000000000868C000-memory.dmpFilesize
624KB
-
memory/5036-132-0x0000000000010000-0x0000000000126000-memory.dmpFilesize
1.1MB