Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
22-03-2023 13:40
Static task
static1
Behavioral task
behavioral1
Sample
RFQ-064845 2023.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
RFQ-064845 2023.exe
Resource
win10v2004-20230220-en
General
-
Target
RFQ-064845 2023.exe
-
Size
1.1MB
-
MD5
d759962c3a20c3552551519467370d78
-
SHA1
1d4707360041d977f52a3d5c20b9c5b6d9040e4f
-
SHA256
f3c280a30bfcb13a09179451fc8a2885ea9a95258ee5b52bfd24a1caf7896e54
-
SHA512
0ef38d8d1f712595e13ba273bb8b40791fc6ff767eab203878b447a49bb3b83b6781a1b02afc1c866fee3c2d0a070796caa5c4524ba0d17b57027fe9372a6986
-
SSDEEP
24576:PvKTjt/DH/P74HcMA1d521GsmB7mUY48kv06pO7/2F5:PvK9fP74JAzFmRc06A/2
Malware Config
Extracted
remcos
RemoteHost
45.139.105.174:2210
212.193.30.230:6320
212.193.30.230:2286
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-G9FA76
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
RFQ-064845 2023.exeremcos.exeRFQ-064845 2023.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation RFQ-064845 2023.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation remcos.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation RFQ-064845 2023.exe -
Executes dropped EXE 2 IoCs
Processes:
remcos.exeremcos.exepid process 3384 remcos.exe 3764 remcos.exe -
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
remcos.exeRFQ-064845 2023.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ remcos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" remcos.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows\CurrentVersion\Run\ RFQ-064845 2023.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" RFQ-064845 2023.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ RFQ-064845 2023.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" RFQ-064845 2023.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows\CurrentVersion\Run\ remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" remcos.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
RFQ-064845 2023.exeremcos.exedescription pid process target process PID 4108 set thread context of 2536 4108 RFQ-064845 2023.exe RFQ-064845 2023.exe PID 3384 set thread context of 3764 3384 remcos.exe remcos.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1536 schtasks.exe 3024 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
RFQ-064845 2023.exepowershell.exeremcos.exepowershell.exepid process 4108 RFQ-064845 2023.exe 4108 RFQ-064845 2023.exe 4296 powershell.exe 4296 powershell.exe 3384 remcos.exe 1568 powershell.exe 3384 remcos.exe 1568 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
RFQ-064845 2023.exepowershell.exeremcos.exepowershell.exedescription pid process Token: SeDebugPrivilege 4108 RFQ-064845 2023.exe Token: SeDebugPrivilege 4296 powershell.exe Token: SeDebugPrivilege 3384 remcos.exe Token: SeDebugPrivilege 1568 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
remcos.exepid process 3764 remcos.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
RFQ-064845 2023.exeRFQ-064845 2023.exeremcos.exedescription pid process target process PID 4108 wrote to memory of 4296 4108 RFQ-064845 2023.exe powershell.exe PID 4108 wrote to memory of 4296 4108 RFQ-064845 2023.exe powershell.exe PID 4108 wrote to memory of 4296 4108 RFQ-064845 2023.exe powershell.exe PID 4108 wrote to memory of 1536 4108 RFQ-064845 2023.exe schtasks.exe PID 4108 wrote to memory of 1536 4108 RFQ-064845 2023.exe schtasks.exe PID 4108 wrote to memory of 1536 4108 RFQ-064845 2023.exe schtasks.exe PID 4108 wrote to memory of 2536 4108 RFQ-064845 2023.exe RFQ-064845 2023.exe PID 4108 wrote to memory of 2536 4108 RFQ-064845 2023.exe RFQ-064845 2023.exe PID 4108 wrote to memory of 2536 4108 RFQ-064845 2023.exe RFQ-064845 2023.exe PID 4108 wrote to memory of 2536 4108 RFQ-064845 2023.exe RFQ-064845 2023.exe PID 4108 wrote to memory of 2536 4108 RFQ-064845 2023.exe RFQ-064845 2023.exe PID 4108 wrote to memory of 2536 4108 RFQ-064845 2023.exe RFQ-064845 2023.exe PID 4108 wrote to memory of 2536 4108 RFQ-064845 2023.exe RFQ-064845 2023.exe PID 4108 wrote to memory of 2536 4108 RFQ-064845 2023.exe RFQ-064845 2023.exe PID 4108 wrote to memory of 2536 4108 RFQ-064845 2023.exe RFQ-064845 2023.exe PID 4108 wrote to memory of 2536 4108 RFQ-064845 2023.exe RFQ-064845 2023.exe PID 4108 wrote to memory of 2536 4108 RFQ-064845 2023.exe RFQ-064845 2023.exe PID 4108 wrote to memory of 2536 4108 RFQ-064845 2023.exe RFQ-064845 2023.exe PID 2536 wrote to memory of 3384 2536 RFQ-064845 2023.exe remcos.exe PID 2536 wrote to memory of 3384 2536 RFQ-064845 2023.exe remcos.exe PID 2536 wrote to memory of 3384 2536 RFQ-064845 2023.exe remcos.exe PID 3384 wrote to memory of 1568 3384 remcos.exe powershell.exe PID 3384 wrote to memory of 1568 3384 remcos.exe powershell.exe PID 3384 wrote to memory of 1568 3384 remcos.exe powershell.exe PID 3384 wrote to memory of 3024 3384 remcos.exe schtasks.exe PID 3384 wrote to memory of 3024 3384 remcos.exe schtasks.exe PID 3384 wrote to memory of 3024 3384 remcos.exe schtasks.exe PID 3384 wrote to memory of 3764 3384 remcos.exe remcos.exe PID 3384 wrote to memory of 3764 3384 remcos.exe remcos.exe PID 3384 wrote to memory of 3764 3384 remcos.exe remcos.exe PID 3384 wrote to memory of 3764 3384 remcos.exe remcos.exe PID 3384 wrote to memory of 3764 3384 remcos.exe remcos.exe PID 3384 wrote to memory of 3764 3384 remcos.exe remcos.exe PID 3384 wrote to memory of 3764 3384 remcos.exe remcos.exe PID 3384 wrote to memory of 3764 3384 remcos.exe remcos.exe PID 3384 wrote to memory of 3764 3384 remcos.exe remcos.exe PID 3384 wrote to memory of 3764 3384 remcos.exe remcos.exe PID 3384 wrote to memory of 3764 3384 remcos.exe remcos.exe PID 3384 wrote to memory of 3764 3384 remcos.exe remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ-064845 2023.exe"C:\Users\Admin\AppData\Local\Temp\RFQ-064845 2023.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cVVsKeGRDmRZkj.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cVVsKeGRDmRZkj" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5786.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\RFQ-064845 2023.exe"C:\Users\Admin\AppData\Local\Temp\RFQ-064845 2023.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Remcos\remcos.exe"C:\ProgramData\Remcos\remcos.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cVVsKeGRDmRZkj.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cVVsKeGRDmRZkj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFD7A.tmp"4⤵
- Creates scheduled task(s)
-
C:\ProgramData\Remcos\remcos.exe"C:\ProgramData\Remcos\remcos.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Remcos\logs.datFilesize
144B
MD572c327f8edc0ca8e086879641fb35844
SHA1e388e2b70c756198a6a998c99c10041f147e81db
SHA25684c4c301c6a25fb53a41ea621692cda16e724d026a608c0cc1a45e4dad48e719
SHA5121722302ecf1fe99f53f41a88d651af2a84f2c245d8b10323689254c1baf724965a4989b4b90858ac96799ba0412d561b8479e49e3451ead7f45093f5a07004bc
-
C:\ProgramData\Remcos\remcos.exeFilesize
1.1MB
MD5d759962c3a20c3552551519467370d78
SHA11d4707360041d977f52a3d5c20b9c5b6d9040e4f
SHA256f3c280a30bfcb13a09179451fc8a2885ea9a95258ee5b52bfd24a1caf7896e54
SHA5120ef38d8d1f712595e13ba273bb8b40791fc6ff767eab203878b447a49bb3b83b6781a1b02afc1c866fee3c2d0a070796caa5c4524ba0d17b57027fe9372a6986
-
C:\ProgramData\Remcos\remcos.exeFilesize
1.1MB
MD5d759962c3a20c3552551519467370d78
SHA11d4707360041d977f52a3d5c20b9c5b6d9040e4f
SHA256f3c280a30bfcb13a09179451fc8a2885ea9a95258ee5b52bfd24a1caf7896e54
SHA5120ef38d8d1f712595e13ba273bb8b40791fc6ff767eab203878b447a49bb3b83b6781a1b02afc1c866fee3c2d0a070796caa5c4524ba0d17b57027fe9372a6986
-
C:\ProgramData\Remcos\remcos.exeFilesize
1.1MB
MD5d759962c3a20c3552551519467370d78
SHA11d4707360041d977f52a3d5c20b9c5b6d9040e4f
SHA256f3c280a30bfcb13a09179451fc8a2885ea9a95258ee5b52bfd24a1caf7896e54
SHA5120ef38d8d1f712595e13ba273bb8b40791fc6ff767eab203878b447a49bb3b83b6781a1b02afc1c866fee3c2d0a070796caa5c4524ba0d17b57027fe9372a6986
-
C:\ProgramData\Remcos\remcos.exeFilesize
1.1MB
MD5d759962c3a20c3552551519467370d78
SHA11d4707360041d977f52a3d5c20b9c5b6d9040e4f
SHA256f3c280a30bfcb13a09179451fc8a2885ea9a95258ee5b52bfd24a1caf7896e54
SHA5120ef38d8d1f712595e13ba273bb8b40791fc6ff767eab203878b447a49bb3b83b6781a1b02afc1c866fee3c2d0a070796caa5c4524ba0d17b57027fe9372a6986
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5fef851ce485f9a06996319de9da37224
SHA155e25e51a10d4dc2ab87fbdc55cb41d9ebac8a1e
SHA25601b1057d258b6e80ecb3aac661a81b7e0b229bbe44af8ac0321433dd110d1100
SHA51280450f0fc29735ab07eb906160ff36373e202d232e60ddcb15c81eaed81c89621b943546c2b618a91656c9e442eabc8bad475dce905fcd379578c34580e44f98
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kbleg1o1.jfh.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp5786.tmpFilesize
1KB
MD517bb1e8891445ae3cb6f4d6c0c435f57
SHA1d6eea3c0bb7b139f3d1af5aaa9228fe6798204ab
SHA2561ad41f0ac9205cf74aef04217608ce78ec024c3c5bba5fc85b550fbb13b57fe4
SHA51233429eb1ed4dcc420352e57f22f59502aebbb05c104db38674f36e32291a3719cb6c44ab5667eafec1757c6f839103a113f018c3af3bb27c474e3b32d3d4ad0e
-
C:\Users\Admin\AppData\Local\Temp\tmpFD7A.tmpFilesize
1KB
MD517bb1e8891445ae3cb6f4d6c0c435f57
SHA1d6eea3c0bb7b139f3d1af5aaa9228fe6798204ab
SHA2561ad41f0ac9205cf74aef04217608ce78ec024c3c5bba5fc85b550fbb13b57fe4
SHA51233429eb1ed4dcc420352e57f22f59502aebbb05c104db38674f36e32291a3719cb6c44ab5667eafec1757c6f839103a113f018c3af3bb27c474e3b32d3d4ad0e
-
memory/1568-231-0x00000000712F0000-0x000000007133C000-memory.dmpFilesize
304KB
-
memory/1568-210-0x00000000046D0000-0x00000000046E0000-memory.dmpFilesize
64KB
-
memory/1568-242-0x000000007F290000-0x000000007F2A0000-memory.dmpFilesize
64KB
-
memory/1568-241-0x00000000046D0000-0x00000000046E0000-memory.dmpFilesize
64KB
-
memory/1568-209-0x00000000046D0000-0x00000000046E0000-memory.dmpFilesize
64KB
-
memory/2536-148-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/2536-150-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/2536-147-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/2536-174-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/3384-178-0x00000000057F0000-0x0000000005800000-memory.dmpFilesize
64KB
-
memory/3384-202-0x00000000057F0000-0x0000000005800000-memory.dmpFilesize
64KB
-
memory/3764-226-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/3764-243-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/3764-270-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/3764-267-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/3764-266-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/3764-265-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/3764-259-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/3764-256-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/3764-255-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/3764-254-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/3764-225-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/3764-250-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/3764-246-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/3764-224-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/3764-213-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/3764-212-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/3764-208-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/3764-230-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/3764-227-0x0000000000400000-0x0000000000480000-memory.dmpFilesize
512KB
-
memory/4108-138-0x0000000005C10000-0x0000000005C20000-memory.dmpFilesize
64KB
-
memory/4108-137-0x00000000059D0000-0x00000000059DA000-memory.dmpFilesize
40KB
-
memory/4108-136-0x0000000005C10000-0x0000000005C20000-memory.dmpFilesize
64KB
-
memory/4108-135-0x0000000005A40000-0x0000000005AD2000-memory.dmpFilesize
584KB
-
memory/4108-133-0x0000000000F00000-0x0000000001016000-memory.dmpFilesize
1.1MB
-
memory/4108-139-0x00000000073C0000-0x000000000745C000-memory.dmpFilesize
624KB
-
memory/4108-134-0x0000000005FF0000-0x0000000006594000-memory.dmpFilesize
5.6MB
-
memory/4296-196-0x0000000007A70000-0x0000000007B06000-memory.dmpFilesize
600KB
-
memory/4296-144-0x0000000002BD0000-0x0000000002C06000-memory.dmpFilesize
216KB
-
memory/4296-146-0x00000000056F0000-0x0000000005D18000-memory.dmpFilesize
6.2MB
-
memory/4296-152-0x0000000005630000-0x0000000005652000-memory.dmpFilesize
136KB
-
memory/4296-154-0x0000000005DE0000-0x0000000005E46000-memory.dmpFilesize
408KB
-
memory/4296-166-0x0000000005EC0000-0x0000000005F26000-memory.dmpFilesize
408KB
-
memory/4296-199-0x0000000007B20000-0x0000000007B28000-memory.dmpFilesize
32KB
-
memory/4296-198-0x0000000007B30000-0x0000000007B4A000-memory.dmpFilesize
104KB
-
memory/4296-197-0x0000000007A30000-0x0000000007A3E000-memory.dmpFilesize
56KB
-
memory/4296-176-0x0000000002BC0000-0x0000000002BD0000-memory.dmpFilesize
64KB
-
memory/4296-195-0x0000000007860000-0x000000000786A000-memory.dmpFilesize
40KB
-
memory/4296-194-0x00000000077F0000-0x000000000780A000-memory.dmpFilesize
104KB
-
memory/4296-193-0x0000000007E30000-0x00000000084AA000-memory.dmpFilesize
6.5MB
-
memory/4296-192-0x000000007F340000-0x000000007F350000-memory.dmpFilesize
64KB
-
memory/4296-191-0x0000000006A80000-0x0000000006A9E000-memory.dmpFilesize
120KB
-
memory/4296-181-0x00000000712F0000-0x000000007133C000-memory.dmpFilesize
304KB
-
memory/4296-180-0x00000000074B0000-0x00000000074E2000-memory.dmpFilesize
200KB
-
memory/4296-179-0x0000000002BC0000-0x0000000002BD0000-memory.dmpFilesize
64KB
-
memory/4296-175-0x0000000002BC0000-0x0000000002BD0000-memory.dmpFilesize
64KB
-
memory/4296-177-0x00000000064E0000-0x00000000064FE000-memory.dmpFilesize
120KB