Analysis
-
max time kernel
38s -
max time network
42s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2023 11:52
Static task
static1
Behavioral task
behavioral1
Sample
Remcos Professional Cracked By Alcatraz3222.exe
Resource
win7-20230220-en
General
-
Target
Remcos Professional Cracked By Alcatraz3222.exe
-
Size
17.7MB
-
MD5
efc159c7cf75545997f8c6af52d3e802
-
SHA1
b85bd368c91a13db1c5de2326deb25ad666c24c1
-
SHA256
898ac001d0f6c52c1001c640d9860287fdf30a648d580e9f5dd15e2ef84ab18e
-
SHA512
d06a432233dceb731defd53238971699fef201d0f9144ee50e5dd7d6620dfdd6c298d52618bf2c9feb0519574f4565fb0177b00fd8292768fbd8b85dd11e650d
-
SSDEEP
393216:GYuGvp8EHb+in8f4Zg41+Q4AXf5ZZcyfHDMxVpSc+q+eOFxdx:3mqSi8fN4sAXfrZcyfo7p0eYHx
Malware Config
Extracted
njrat
0.7d
HacKed
dllsys.duckdns.org:3202
3b570ffeeb3d34249b9a5ce0ee58a328
-
reg_key
3b570ffeeb3d34249b9a5ce0ee58a328
-
splitter
svchost
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Remcos Professional Cracked By Alcatraz3222.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation Remcos Professional Cracked By Alcatraz3222.exe -
Executes dropped EXE 1 IoCs
Processes:
taskhost.exepid process 4376 taskhost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Remcos Professional Cracked By Alcatraz3222.exedescription pid process target process PID 1672 set thread context of 4376 1672 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
Processes:
Remcos Professional Cracked By Alcatraz3222.exetaskmgr.exepid process 1672 Remcos Professional Cracked By Alcatraz3222.exe 4220 taskmgr.exe 4220 taskmgr.exe 1672 Remcos Professional Cracked By Alcatraz3222.exe 4220 taskmgr.exe 1672 Remcos Professional Cracked By Alcatraz3222.exe 1672 Remcos Professional Cracked By Alcatraz3222.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 1672 Remcos Professional Cracked By Alcatraz3222.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
Processes:
Remcos Professional Cracked By Alcatraz3222.exetaskmgr.exetaskhost.exedescription pid process Token: SeDebugPrivilege 1672 Remcos Professional Cracked By Alcatraz3222.exe Token: SeDebugPrivilege 4220 taskmgr.exe Token: SeSystemProfilePrivilege 4220 taskmgr.exe Token: SeCreateGlobalPrivilege 4220 taskmgr.exe Token: SeDebugPrivilege 4376 taskhost.exe Token: 33 4376 taskhost.exe Token: SeIncBasePriorityPrivilege 4376 taskhost.exe Token: 33 4376 taskhost.exe Token: SeIncBasePriorityPrivilege 4376 taskhost.exe Token: 33 4220 taskmgr.exe Token: SeIncBasePriorityPrivilege 4220 taskmgr.exe -
Suspicious use of FindShellTrayWindow 55 IoCs
Processes:
taskmgr.exepid process 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe -
Suspicious use of SendNotifyMessage 54 IoCs
Processes:
taskmgr.exepid process 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe 4220 taskmgr.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
Remcos Professional Cracked By Alcatraz3222.execmd.exetaskhost.exedescription pid process target process PID 1672 wrote to memory of 2624 1672 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 1672 wrote to memory of 2624 1672 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 1672 wrote to memory of 2624 1672 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 1672 wrote to memory of 1724 1672 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 1672 wrote to memory of 1724 1672 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 1672 wrote to memory of 1724 1672 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 1724 wrote to memory of 3832 1724 cmd.exe reg.exe PID 1724 wrote to memory of 3832 1724 cmd.exe reg.exe PID 1724 wrote to memory of 3832 1724 cmd.exe reg.exe PID 1672 wrote to memory of 3756 1672 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 1672 wrote to memory of 3756 1672 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 1672 wrote to memory of 3756 1672 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 1672 wrote to memory of 4376 1672 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 1672 wrote to memory of 4376 1672 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 1672 wrote to memory of 4376 1672 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 1672 wrote to memory of 4376 1672 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 1672 wrote to memory of 4376 1672 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 1672 wrote to memory of 4376 1672 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 1672 wrote to memory of 4376 1672 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 1672 wrote to memory of 4376 1672 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 4376 wrote to memory of 1952 4376 taskhost.exe netsh.exe PID 4376 wrote to memory of 1952 4376 taskhost.exe netsh.exe PID 4376 wrote to memory of 1952 4376 taskhost.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222.exe"C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/Remcos Professional Cracked By Alcatraz3222.exe" "%temp%\Profile Remcos\Update_Lock_Remcos.exe" /Y2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\Profile Remcos\Update_Lock_Remcos.exe.lnk" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Profile Remcos\Update_Lock_Remcos.exe.lnk" /f3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\Profile Remcos\Update_Lock_Remcos.exe:Zone.Identifier2⤵
-
C:\Users\Admin\AppData\Local\Temp\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\taskhost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\taskhost.exe" "taskhost.exe" ENABLE3⤵
- Modifies Windows Firewall
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Profile Remcos\Update_Lock_Remcos.exeFilesize
17.7MB
MD5efc159c7cf75545997f8c6af52d3e802
SHA1b85bd368c91a13db1c5de2326deb25ad666c24c1
SHA256898ac001d0f6c52c1001c640d9860287fdf30a648d580e9f5dd15e2ef84ab18e
SHA512d06a432233dceb731defd53238971699fef201d0f9144ee50e5dd7d6620dfdd6c298d52618bf2c9feb0519574f4565fb0177b00fd8292768fbd8b85dd11e650d
-
C:\Users\Admin\AppData\Local\Temp\taskhost.exeFilesize
256KB
MD58fdf47e0ff70c40ed3a17014aeea4232
SHA1e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA256ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
SHA512bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be
-
C:\Users\Admin\AppData\Local\Temp\taskhost.exeFilesize
256KB
MD58fdf47e0ff70c40ed3a17014aeea4232
SHA1e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA256ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
SHA512bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be
-
memory/1672-134-0x0000000006480000-0x000000000651C000-memory.dmpFilesize
624KB
-
memory/1672-135-0x0000000006760000-0x0000000006770000-memory.dmpFilesize
64KB
-
memory/1672-162-0x0000000006760000-0x0000000006770000-memory.dmpFilesize
64KB
-
memory/1672-133-0x0000000000AD0000-0x0000000001C7E000-memory.dmpFilesize
17.7MB
-
memory/4220-140-0x000001AAD9EA0000-0x000001AAD9EA1000-memory.dmpFilesize
4KB
-
memory/4220-138-0x000001AAD9EA0000-0x000001AAD9EA1000-memory.dmpFilesize
4KB
-
memory/4220-147-0x000001AAD9EA0000-0x000001AAD9EA1000-memory.dmpFilesize
4KB
-
memory/4220-149-0x000001AAD9EA0000-0x000001AAD9EA1000-memory.dmpFilesize
4KB
-
memory/4220-148-0x000001AAD9EA0000-0x000001AAD9EA1000-memory.dmpFilesize
4KB
-
memory/4220-150-0x000001AAD9EA0000-0x000001AAD9EA1000-memory.dmpFilesize
4KB
-
memory/4220-145-0x000001AAD9EA0000-0x000001AAD9EA1000-memory.dmpFilesize
4KB
-
memory/4220-146-0x000001AAD9EA0000-0x000001AAD9EA1000-memory.dmpFilesize
4KB
-
memory/4220-144-0x000001AAD9EA0000-0x000001AAD9EA1000-memory.dmpFilesize
4KB
-
memory/4220-139-0x000001AAD9EA0000-0x000001AAD9EA1000-memory.dmpFilesize
4KB
-
memory/4376-156-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/4376-161-0x0000000005CC0000-0x0000000006264000-memory.dmpFilesize
5.6MB
-
memory/4376-163-0x00000000058F0000-0x0000000005982000-memory.dmpFilesize
584KB
-
memory/4376-164-0x00000000057C0000-0x00000000057D0000-memory.dmpFilesize
64KB
-
memory/4376-165-0x00000000058A0000-0x00000000058AA000-memory.dmpFilesize
40KB
-
memory/4376-167-0x00000000057C0000-0x00000000057D0000-memory.dmpFilesize
64KB