Analysis
-
max time kernel
142s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
02-03-2023 23:02
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230220-en
General
-
Target
tmp.exe
-
Size
36KB
-
MD5
148264565031a8ebb6887a1395a2247a
-
SHA1
3e4238c2f8e69b5c692ef034b6ed6d4ec7673919
-
SHA256
683fa1e449da9b71d0cafefb107efd97f0f8163f844dd837d12c354c2b901b93
-
SHA512
41c84fbbfecabcae861eb10216b3910d0f5ddf7e62258e164558485bc6fae2df664cf489f8fab672eb752217c9b052e12fb2e9a1bea68530f25512e8f5f690f9
-
SSDEEP
768:U5PHyCjmhFdWfLubuZ1kvIaEekM2Q0KbzssZr1:U5PHfjGPAKbLV2o3r
Malware Config
Extracted
remcos
1.7 Pro
1877
hawler.duckdns.org:2404
5.206.227.115:2404
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
svshost.exe
-
copy_folder
1877
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%WinDir%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
1877
-
keylog_path
%AppData%
-
mouse_option
true
-
mutex
1877_spelzoyulk
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
Google Update
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
Processes:
svshost.exetmp.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Windows\\1877\\svshost.exe\"" svshost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\1877\\svshost.exe\"" tmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Windows\\1877\\svshost.exe\"" tmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\1877\\svshost.exe\"" svshost.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
tmp.exesvshost.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ tmp.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ svshost.exe -
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
tmp.exesvshost.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run tmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Google Update = "\"C:\\Windows\\1877\\svshost.exe\"" tmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svshost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Google Update = "\"C:\\Windows\\1877\\svshost.exe\"" svshost.exe -
Executes dropped EXE 1 IoCs
Processes:
svshost.exepid process 756 svshost.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 956 cmd.exe 956 cmd.exe -
Processes:
resource yara_rule behavioral1/memory/1236-64-0x0000000000400000-0x000000000041D000-memory.dmp upx \Windows\1877\svshost.exe upx C:\Windows\1877\svshost.exe upx C:\Windows\1877\svshost.exe upx \Windows\1877\svshost.exe upx behavioral1/memory/756-70-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/756-71-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/756-73-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/756-75-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/756-77-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/756-80-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/756-82-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/756-83-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral1/memory/756-85-0x0000000000400000-0x000000000041D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
svshost.exetmp.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Google Update = "\"C:\\Windows\\1877\\svshost.exe\"" svshost.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows\CurrentVersion\Run\ tmp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Update = "\"C:\\Windows\\1877\\svshost.exe\"" tmp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ tmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Google Update = "\"C:\\Windows\\1877\\svshost.exe\"" tmp.exe Key created \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows\CurrentVersion\Run\ svshost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Update = "\"C:\\Windows\\1877\\svshost.exe\"" svshost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ svshost.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
tmp.exesvshost.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ tmp.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ svshost.exe -
Drops file in Windows directory 3 IoCs
Processes:
tmp.exedescription ioc process File opened for modification C:\Windows\1877 tmp.exe File created C:\Windows\1877\svshost.exe tmp.exe File opened for modification C:\Windows\1877\svshost.exe tmp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
svshost.exepid process 756 svshost.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
tmp.execmd.exedescription pid process target process PID 1236 wrote to memory of 956 1236 tmp.exe cmd.exe PID 1236 wrote to memory of 956 1236 tmp.exe cmd.exe PID 1236 wrote to memory of 956 1236 tmp.exe cmd.exe PID 1236 wrote to memory of 956 1236 tmp.exe cmd.exe PID 1236 wrote to memory of 956 1236 tmp.exe cmd.exe PID 1236 wrote to memory of 956 1236 tmp.exe cmd.exe PID 1236 wrote to memory of 956 1236 tmp.exe cmd.exe PID 956 wrote to memory of 628 956 cmd.exe PING.EXE PID 956 wrote to memory of 628 956 cmd.exe PING.EXE PID 956 wrote to memory of 628 956 cmd.exe PING.EXE PID 956 wrote to memory of 628 956 cmd.exe PING.EXE PID 956 wrote to memory of 756 956 cmd.exe svshost.exe PID 956 wrote to memory of 756 956 cmd.exe svshost.exe PID 956 wrote to memory of 756 956 cmd.exe svshost.exe PID 956 wrote to memory of 756 956 cmd.exe svshost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Modifies WinLogon for persistence
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Adds policy Run key to start application
- Adds Run key to start application
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEPING 127.0.0.1 -n 23⤵
- Runs ping.exe
-
C:\Windows\1877\svshost.exe"C:\Windows\1877\svshost.exe"3⤵
- Modifies WinLogon for persistence
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.batFilesize
78B
MD5f35509e5938343750502f45e998f8d0c
SHA174efa4a149f83d677bdf347149d33e0c25cb5af0
SHA256969621479c4bc68f58f32db1d20a5f389200fee6cdf30e73fe70072184f58afb
SHA512abb32f92b0dc6d76a5dd83a4d9268e321092626a5b810cbb9c96347e1b40d98ccada231b8d6ad5d5252a2e24082c88f184b201c399106248ea3de564b3483091
-
C:\Users\Admin\AppData\Local\Temp\install.batFilesize
78B
MD5f35509e5938343750502f45e998f8d0c
SHA174efa4a149f83d677bdf347149d33e0c25cb5af0
SHA256969621479c4bc68f58f32db1d20a5f389200fee6cdf30e73fe70072184f58afb
SHA512abb32f92b0dc6d76a5dd83a4d9268e321092626a5b810cbb9c96347e1b40d98ccada231b8d6ad5d5252a2e24082c88f184b201c399106248ea3de564b3483091
-
C:\Windows\1877\svshost.exeFilesize
36KB
MD5148264565031a8ebb6887a1395a2247a
SHA13e4238c2f8e69b5c692ef034b6ed6d4ec7673919
SHA256683fa1e449da9b71d0cafefb107efd97f0f8163f844dd837d12c354c2b901b93
SHA51241c84fbbfecabcae861eb10216b3910d0f5ddf7e62258e164558485bc6fae2df664cf489f8fab672eb752217c9b052e12fb2e9a1bea68530f25512e8f5f690f9
-
C:\Windows\1877\svshost.exeFilesize
36KB
MD5148264565031a8ebb6887a1395a2247a
SHA13e4238c2f8e69b5c692ef034b6ed6d4ec7673919
SHA256683fa1e449da9b71d0cafefb107efd97f0f8163f844dd837d12c354c2b901b93
SHA51241c84fbbfecabcae861eb10216b3910d0f5ddf7e62258e164558485bc6fae2df664cf489f8fab672eb752217c9b052e12fb2e9a1bea68530f25512e8f5f690f9
-
\Windows\1877\svshost.exeFilesize
36KB
MD5148264565031a8ebb6887a1395a2247a
SHA13e4238c2f8e69b5c692ef034b6ed6d4ec7673919
SHA256683fa1e449da9b71d0cafefb107efd97f0f8163f844dd837d12c354c2b901b93
SHA51241c84fbbfecabcae861eb10216b3910d0f5ddf7e62258e164558485bc6fae2df664cf489f8fab672eb752217c9b052e12fb2e9a1bea68530f25512e8f5f690f9
-
\Windows\1877\svshost.exeFilesize
36KB
MD5148264565031a8ebb6887a1395a2247a
SHA13e4238c2f8e69b5c692ef034b6ed6d4ec7673919
SHA256683fa1e449da9b71d0cafefb107efd97f0f8163f844dd837d12c354c2b901b93
SHA51241c84fbbfecabcae861eb10216b3910d0f5ddf7e62258e164558485bc6fae2df664cf489f8fab672eb752217c9b052e12fb2e9a1bea68530f25512e8f5f690f9
-
memory/756-71-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/756-70-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/756-73-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/756-75-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/756-77-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/756-80-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/756-82-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/756-83-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/756-85-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1236-64-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB