Analysis
-
max time kernel
30s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
21-03-2023 11:52
Static task
static1
Behavioral task
behavioral1
Sample
Remcos Professional Cracked By Alcatraz3222.exe
Resource
win7-20230220-en
General
-
Target
Remcos Professional Cracked By Alcatraz3222.exe
-
Size
17.7MB
-
MD5
efc159c7cf75545997f8c6af52d3e802
-
SHA1
b85bd368c91a13db1c5de2326deb25ad666c24c1
-
SHA256
898ac001d0f6c52c1001c640d9860287fdf30a648d580e9f5dd15e2ef84ab18e
-
SHA512
d06a432233dceb731defd53238971699fef201d0f9144ee50e5dd7d6620dfdd6c298d52618bf2c9feb0519574f4565fb0177b00fd8292768fbd8b85dd11e650d
-
SSDEEP
393216:GYuGvp8EHb+in8f4Zg41+Q4AXf5ZZcyfHDMxVpSc+q+eOFxdx:3mqSi8fN4sAXfrZcyfo7p0eYHx
Malware Config
Signatures
-
Loads dropped DLL 7 IoCs
Processes:
Remcos Professional Cracked By Alcatraz3222.exepid process 316 Remcos Professional Cracked By Alcatraz3222.exe 316 Remcos Professional Cracked By Alcatraz3222.exe 316 Remcos Professional Cracked By Alcatraz3222.exe 316 Remcos Professional Cracked By Alcatraz3222.exe 316 Remcos Professional Cracked By Alcatraz3222.exe 316 Remcos Professional Cracked By Alcatraz3222.exe 316 Remcos Professional Cracked By Alcatraz3222.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Remcos Professional Cracked By Alcatraz3222.exepid process 316 Remcos Professional Cracked By Alcatraz3222.exe 316 Remcos Professional Cracked By Alcatraz3222.exe 316 Remcos Professional Cracked By Alcatraz3222.exe 316 Remcos Professional Cracked By Alcatraz3222.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Remcos Professional Cracked By Alcatraz3222.exedescription pid process Token: SeDebugPrivilege 316 Remcos Professional Cracked By Alcatraz3222.exe -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
Remcos Professional Cracked By Alcatraz3222.execmd.exedescription pid process target process PID 316 wrote to memory of 1524 316 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 316 wrote to memory of 1524 316 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 316 wrote to memory of 1524 316 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 316 wrote to memory of 1524 316 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 316 wrote to memory of 1132 316 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 316 wrote to memory of 1132 316 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 316 wrote to memory of 1132 316 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 316 wrote to memory of 1132 316 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 1132 wrote to memory of 472 1132 cmd.exe reg.exe PID 1132 wrote to memory of 472 1132 cmd.exe reg.exe PID 1132 wrote to memory of 472 1132 cmd.exe reg.exe PID 1132 wrote to memory of 472 1132 cmd.exe reg.exe PID 316 wrote to memory of 332 316 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 316 wrote to memory of 332 316 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 316 wrote to memory of 332 316 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 316 wrote to memory of 332 316 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 316 wrote to memory of 676 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 676 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 676 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 676 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 1832 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 1832 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 1832 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 1832 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 1484 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 1484 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 1484 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 1484 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 324 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 324 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 324 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 324 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 1164 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 1164 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 1164 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 1164 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 1576 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 1576 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 1576 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 1576 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 1656 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 1656 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 1656 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 316 wrote to memory of 1656 316 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222.exe"C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/Remcos Professional Cracked By Alcatraz3222.exe" "%temp%\Profile Remcos\Update_Lock_Remcos.exe" /Y2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\Profile Remcos\Update_Lock_Remcos.exe.lnk" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Profile Remcos\Update_Lock_Remcos.exe.lnk" /f3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\Profile Remcos\Update_Lock_Remcos.exe:Zone.Identifier2⤵
-
C:\Users\Admin\AppData\Local\Temp\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\taskhost.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\taskhost.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\taskhost.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\taskhost.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\taskhost.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\taskhost.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\taskhost.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Profile Remcos\Update_Lock_Remcos.exeFilesize
17.7MB
MD5efc159c7cf75545997f8c6af52d3e802
SHA1b85bd368c91a13db1c5de2326deb25ad666c24c1
SHA256898ac001d0f6c52c1001c640d9860287fdf30a648d580e9f5dd15e2ef84ab18e
SHA512d06a432233dceb731defd53238971699fef201d0f9144ee50e5dd7d6620dfdd6c298d52618bf2c9feb0519574f4565fb0177b00fd8292768fbd8b85dd11e650d
-
C:\Users\Admin\AppData\Local\Temp\taskhost.exeFilesize
255KB
MD59af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
\Users\Admin\AppData\Local\Temp\taskhost.exeFilesize
255KB
MD59af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
\Users\Admin\AppData\Local\Temp\taskhost.exeFilesize
255KB
MD59af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
\Users\Admin\AppData\Local\Temp\taskhost.exeFilesize
255KB
MD59af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
\Users\Admin\AppData\Local\Temp\taskhost.exeFilesize
255KB
MD59af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
\Users\Admin\AppData\Local\Temp\taskhost.exeFilesize
255KB
MD59af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
\Users\Admin\AppData\Local\Temp\taskhost.exeFilesize
255KB
MD59af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
\Users\Admin\AppData\Local\Temp\taskhost.exeFilesize
255KB
MD59af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
memory/316-54-0x0000000000A60000-0x0000000001C0E000-memory.dmpFilesize
17.7MB
-
memory/316-56-0x0000000005C00000-0x0000000005C40000-memory.dmpFilesize
256KB
-
memory/316-55-0x000000000D570000-0x000000000E6F2000-memory.dmpFilesize
17.5MB
-
memory/316-86-0x0000000005C00000-0x0000000005C40000-memory.dmpFilesize
256KB