Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
04-02-2023 22:18
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT CONFIRMATION COPY_ 529520419250297.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
PAYMENT CONFIRMATION COPY_ 529520419250297.exe
Resource
win10v2004-20220901-en
General
-
Target
PAYMENT CONFIRMATION COPY_ 529520419250297.exe
-
Size
7KB
-
MD5
2aa238c62bdf21d61a382de34650c887
-
SHA1
2e2bb363ca3d9af4b7ab6001e48ef1eca859b94d
-
SHA256
6a4ff99ad29aa40eddb5e509b7460556ab23f2dc1f08ce014dc32817128e6c05
-
SHA512
ca540814923464076c0c0e558e3bd246cf29ad8877cf9a57df4f990f121834c90a70f9917bd1625a175be61e7c068afa17bcd2f034fcc273477f0aedb40a39bd
-
SSDEEP
96:HkzEkmmFXmT7mjXpKQPOGvMtOcDTmbDtEkIFBjQlrQ5bFnU:HqfEwXXPADT6zKWl0A
Malware Config
Extracted
remcos
RemoteHost
194.180.49.17:28282
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
rdfghfgjkgoighjc.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-PC1DJ2
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PAYMENT CONFIRMATION COPY_ 529520419250297.exePAYMENT CONFIRMATION COPY_ 529520419250297.exerdfghfgjkgoighjc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation PAYMENT CONFIRMATION COPY_ 529520419250297.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation PAYMENT CONFIRMATION COPY_ 529520419250297.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation rdfghfgjkgoighjc.exe -
Executes dropped EXE 2 IoCs
Processes:
rdfghfgjkgoighjc.exerdfghfgjkgoighjc.exepid process 2212 rdfghfgjkgoighjc.exe 4128 rdfghfgjkgoighjc.exe -
Adds Run key to start application 2 TTPs 10 IoCs
Processes:
rdfghfgjkgoighjc.exePAYMENT CONFIRMATION COPY_ 529520419250297.exePAYMENT CONFIRMATION COPY_ 529520419250297.exerdfghfgjkgoighjc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\rdfghfgjkgoighjc.exe\"" rdfghfgjkgoighjc.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ PAYMENT CONFIRMATION COPY_ 529520419250297.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ PAYMENT CONFIRMATION COPY_ 529520419250297.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\rdfghfgjkgoighjc.exe\"" PAYMENT CONFIRMATION COPY_ 529520419250297.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ rdfghfgjkgoighjc.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\rdfghfgjkgoighjc.exe\"" rdfghfgjkgoighjc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ rdfghfgjkgoighjc.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bsrdolf = "\"C:\\Users\\Admin\\AppData\\Roaming\\Ykiwtitgqvp\\Bsrdolf.exe\"" PAYMENT CONFIRMATION COPY_ 529520419250297.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\rdfghfgjkgoighjc.exe\"" PAYMENT CONFIRMATION COPY_ 529520419250297.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bsrdolf = "\"C:\\Users\\Admin\\AppData\\Roaming\\Ykiwtitgqvp\\Bsrdolf.exe\"" rdfghfgjkgoighjc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
PAYMENT CONFIRMATION COPY_ 529520419250297.exerdfghfgjkgoighjc.exedescription pid process target process PID 1616 set thread context of 2028 1616 PAYMENT CONFIRMATION COPY_ 529520419250297.exe PAYMENT CONFIRMATION COPY_ 529520419250297.exe PID 2212 set thread context of 4128 2212 rdfghfgjkgoighjc.exe rdfghfgjkgoighjc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 2972 powershell.exe 2972 powershell.exe 5100 powershell.exe 5100 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
PAYMENT CONFIRMATION COPY_ 529520419250297.exepowershell.exerdfghfgjkgoighjc.exepowershell.exedescription pid process Token: SeDebugPrivilege 1616 PAYMENT CONFIRMATION COPY_ 529520419250297.exe Token: SeDebugPrivilege 2972 powershell.exe Token: SeDebugPrivilege 2212 rdfghfgjkgoighjc.exe Token: SeDebugPrivilege 5100 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
rdfghfgjkgoighjc.exepid process 4128 rdfghfgjkgoighjc.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
PAYMENT CONFIRMATION COPY_ 529520419250297.exePAYMENT CONFIRMATION COPY_ 529520419250297.exerdfghfgjkgoighjc.exedescription pid process target process PID 1616 wrote to memory of 2972 1616 PAYMENT CONFIRMATION COPY_ 529520419250297.exe powershell.exe PID 1616 wrote to memory of 2972 1616 PAYMENT CONFIRMATION COPY_ 529520419250297.exe powershell.exe PID 1616 wrote to memory of 2972 1616 PAYMENT CONFIRMATION COPY_ 529520419250297.exe powershell.exe PID 1616 wrote to memory of 2028 1616 PAYMENT CONFIRMATION COPY_ 529520419250297.exe PAYMENT CONFIRMATION COPY_ 529520419250297.exe PID 1616 wrote to memory of 2028 1616 PAYMENT CONFIRMATION COPY_ 529520419250297.exe PAYMENT CONFIRMATION COPY_ 529520419250297.exe PID 1616 wrote to memory of 2028 1616 PAYMENT CONFIRMATION COPY_ 529520419250297.exe PAYMENT CONFIRMATION COPY_ 529520419250297.exe PID 1616 wrote to memory of 2028 1616 PAYMENT CONFIRMATION COPY_ 529520419250297.exe PAYMENT CONFIRMATION COPY_ 529520419250297.exe PID 1616 wrote to memory of 2028 1616 PAYMENT CONFIRMATION COPY_ 529520419250297.exe PAYMENT CONFIRMATION COPY_ 529520419250297.exe PID 1616 wrote to memory of 2028 1616 PAYMENT CONFIRMATION COPY_ 529520419250297.exe PAYMENT CONFIRMATION COPY_ 529520419250297.exe PID 1616 wrote to memory of 2028 1616 PAYMENT CONFIRMATION COPY_ 529520419250297.exe PAYMENT CONFIRMATION COPY_ 529520419250297.exe PID 1616 wrote to memory of 2028 1616 PAYMENT CONFIRMATION COPY_ 529520419250297.exe PAYMENT CONFIRMATION COPY_ 529520419250297.exe PID 1616 wrote to memory of 2028 1616 PAYMENT CONFIRMATION COPY_ 529520419250297.exe PAYMENT CONFIRMATION COPY_ 529520419250297.exe PID 1616 wrote to memory of 2028 1616 PAYMENT CONFIRMATION COPY_ 529520419250297.exe PAYMENT CONFIRMATION COPY_ 529520419250297.exe PID 1616 wrote to memory of 2028 1616 PAYMENT CONFIRMATION COPY_ 529520419250297.exe PAYMENT CONFIRMATION COPY_ 529520419250297.exe PID 1616 wrote to memory of 2028 1616 PAYMENT CONFIRMATION COPY_ 529520419250297.exe PAYMENT CONFIRMATION COPY_ 529520419250297.exe PID 2028 wrote to memory of 2212 2028 PAYMENT CONFIRMATION COPY_ 529520419250297.exe rdfghfgjkgoighjc.exe PID 2028 wrote to memory of 2212 2028 PAYMENT CONFIRMATION COPY_ 529520419250297.exe rdfghfgjkgoighjc.exe PID 2028 wrote to memory of 2212 2028 PAYMENT CONFIRMATION COPY_ 529520419250297.exe rdfghfgjkgoighjc.exe PID 2212 wrote to memory of 5100 2212 rdfghfgjkgoighjc.exe powershell.exe PID 2212 wrote to memory of 5100 2212 rdfghfgjkgoighjc.exe powershell.exe PID 2212 wrote to memory of 5100 2212 rdfghfgjkgoighjc.exe powershell.exe PID 2212 wrote to memory of 4128 2212 rdfghfgjkgoighjc.exe rdfghfgjkgoighjc.exe PID 2212 wrote to memory of 4128 2212 rdfghfgjkgoighjc.exe rdfghfgjkgoighjc.exe PID 2212 wrote to memory of 4128 2212 rdfghfgjkgoighjc.exe rdfghfgjkgoighjc.exe PID 2212 wrote to memory of 4128 2212 rdfghfgjkgoighjc.exe rdfghfgjkgoighjc.exe PID 2212 wrote to memory of 4128 2212 rdfghfgjkgoighjc.exe rdfghfgjkgoighjc.exe PID 2212 wrote to memory of 4128 2212 rdfghfgjkgoighjc.exe rdfghfgjkgoighjc.exe PID 2212 wrote to memory of 4128 2212 rdfghfgjkgoighjc.exe rdfghfgjkgoighjc.exe PID 2212 wrote to memory of 4128 2212 rdfghfgjkgoighjc.exe rdfghfgjkgoighjc.exe PID 2212 wrote to memory of 4128 2212 rdfghfgjkgoighjc.exe rdfghfgjkgoighjc.exe PID 2212 wrote to memory of 4128 2212 rdfghfgjkgoighjc.exe rdfghfgjkgoighjc.exe PID 2212 wrote to memory of 4128 2212 rdfghfgjkgoighjc.exe rdfghfgjkgoighjc.exe PID 2212 wrote to memory of 4128 2212 rdfghfgjkgoighjc.exe rdfghfgjkgoighjc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT CONFIRMATION COPY_ 529520419250297.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT CONFIRMATION COPY_ 529520419250297.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT CONFIRMATION COPY_ 529520419250297.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT CONFIRMATION COPY_ 529520419250297.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Remcos\rdfghfgjkgoighjc.exe"C:\ProgramData\Remcos\rdfghfgjkgoighjc.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Remcos\rdfghfgjkgoighjc.exeC:\ProgramData\Remcos\rdfghfgjkgoighjc.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Remcos\rdfghfgjkgoighjc.exeFilesize
7KB
MD52aa238c62bdf21d61a382de34650c887
SHA12e2bb363ca3d9af4b7ab6001e48ef1eca859b94d
SHA2566a4ff99ad29aa40eddb5e509b7460556ab23f2dc1f08ce014dc32817128e6c05
SHA512ca540814923464076c0c0e558e3bd246cf29ad8877cf9a57df4f990f121834c90a70f9917bd1625a175be61e7c068afa17bcd2f034fcc273477f0aedb40a39bd
-
C:\ProgramData\Remcos\rdfghfgjkgoighjc.exeFilesize
7KB
MD52aa238c62bdf21d61a382de34650c887
SHA12e2bb363ca3d9af4b7ab6001e48ef1eca859b94d
SHA2566a4ff99ad29aa40eddb5e509b7460556ab23f2dc1f08ce014dc32817128e6c05
SHA512ca540814923464076c0c0e558e3bd246cf29ad8877cf9a57df4f990f121834c90a70f9917bd1625a175be61e7c068afa17bcd2f034fcc273477f0aedb40a39bd
-
C:\ProgramData\Remcos\rdfghfgjkgoighjc.exeFilesize
7KB
MD52aa238c62bdf21d61a382de34650c887
SHA12e2bb363ca3d9af4b7ab6001e48ef1eca859b94d
SHA2566a4ff99ad29aa40eddb5e509b7460556ab23f2dc1f08ce014dc32817128e6c05
SHA512ca540814923464076c0c0e558e3bd246cf29ad8877cf9a57df4f990f121834c90a70f9917bd1625a175be61e7c068afa17bcd2f034fcc273477f0aedb40a39bd
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD587c10d926c844be1937fbeff8c995ace
SHA1353121f15db2b09ed075c18d33140f97d76382d8
SHA256e51b734b37392d134a48d162a5f14c0fbfb36929adbece1d876dbf33fea359f5
SHA512cf00f2ed5ca9f14411aa7e7f54210315ef2226847b79d9265a858253fb07f76f49234ceb92e54641d42395f8fb551070137f6cb60b8196a6a5f53b905316d9db
-
C:\Users\Admin\AppData\Roaming\Ykiwtitgqvp\Bsrdolf.exeFilesize
7KB
MD52aa238c62bdf21d61a382de34650c887
SHA12e2bb363ca3d9af4b7ab6001e48ef1eca859b94d
SHA2566a4ff99ad29aa40eddb5e509b7460556ab23f2dc1f08ce014dc32817128e6c05
SHA512ca540814923464076c0c0e558e3bd246cf29ad8877cf9a57df4f990f121834c90a70f9917bd1625a175be61e7c068afa17bcd2f034fcc273477f0aedb40a39bd
-
memory/1616-132-0x0000000000240000-0x0000000000248000-memory.dmpFilesize
32KB
-
memory/1616-133-0x00000000061D0000-0x00000000061F2000-memory.dmpFilesize
136KB
-
memory/2028-148-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/2028-142-0x0000000000000000-mapping.dmp
-
memory/2028-143-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/2028-144-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/2028-145-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/2212-146-0x0000000000000000-mapping.dmp
-
memory/2972-141-0x0000000006300000-0x000000000631A000-memory.dmpFilesize
104KB
-
memory/2972-140-0x0000000007660000-0x0000000007CDA000-memory.dmpFilesize
6.5MB
-
memory/2972-139-0x0000000004BD0000-0x0000000004BEE000-memory.dmpFilesize
120KB
-
memory/2972-134-0x0000000000000000-mapping.dmp
-
memory/2972-138-0x00000000057D0000-0x0000000005836000-memory.dmpFilesize
408KB
-
memory/2972-137-0x0000000004FD0000-0x0000000005036000-memory.dmpFilesize
408KB
-
memory/2972-136-0x00000000051A0000-0x00000000057C8000-memory.dmpFilesize
6.2MB
-
memory/2972-135-0x0000000000EE0000-0x0000000000F16000-memory.dmpFilesize
216KB
-
memory/4128-158-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/4128-159-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/4128-155-0x0000000000000000-mapping.dmp
-
memory/4128-160-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/4128-161-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/5100-150-0x0000000000000000-mapping.dmp