Analysis
-
max time kernel
43s -
max time network
45s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25-03-2023 17:53
Static task
static1
General
-
Target
Remcos Professional Cracked By Alcatraz3222.exe
-
Size
17.7MB
-
MD5
efc159c7cf75545997f8c6af52d3e802
-
SHA1
b85bd368c91a13db1c5de2326deb25ad666c24c1
-
SHA256
898ac001d0f6c52c1001c640d9860287fdf30a648d580e9f5dd15e2ef84ab18e
-
SHA512
d06a432233dceb731defd53238971699fef201d0f9144ee50e5dd7d6620dfdd6c298d52618bf2c9feb0519574f4565fb0177b00fd8292768fbd8b85dd11e650d
-
SSDEEP
393216:GYuGvp8EHb+in8f4Zg41+Q4AXf5ZZcyfHDMxVpSc+q+eOFxdx:3mqSi8fN4sAXfrZcyfo7p0eYHx
Malware Config
Extracted
njrat
0.7d
HacKed
dllsys.duckdns.org:3202
3b570ffeeb3d34249b9a5ce0ee58a328
-
reg_key
3b570ffeeb3d34249b9a5ce0ee58a328
-
splitter
svchost
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Remcos Professional Cracked By Alcatraz3222.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation Remcos Professional Cracked By Alcatraz3222.exe -
Executes dropped EXE 1 IoCs
Processes:
taskhost.exepid process 3388 taskhost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Remcos Professional Cracked By Alcatraz3222.exedescription pid process target process PID 3004 set thread context of 3388 3004 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Remcos Professional Cracked By Alcatraz3222.exepid process 3004 Remcos Professional Cracked By Alcatraz3222.exe 3004 Remcos Professional Cracked By Alcatraz3222.exe 3004 Remcos Professional Cracked By Alcatraz3222.exe 3004 Remcos Professional Cracked By Alcatraz3222.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
Remcos Professional Cracked By Alcatraz3222.exetaskhost.exedescription pid process Token: SeDebugPrivilege 3004 Remcos Professional Cracked By Alcatraz3222.exe Token: SeDebugPrivilege 3388 taskhost.exe Token: 33 3388 taskhost.exe Token: SeIncBasePriorityPrivilege 3388 taskhost.exe Token: 33 3388 taskhost.exe Token: SeIncBasePriorityPrivilege 3388 taskhost.exe Token: 33 3388 taskhost.exe Token: SeIncBasePriorityPrivilege 3388 taskhost.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
Remcos Professional Cracked By Alcatraz3222.execmd.exetaskhost.exedescription pid process target process PID 3004 wrote to memory of 5116 3004 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 3004 wrote to memory of 5116 3004 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 3004 wrote to memory of 5116 3004 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 3004 wrote to memory of 336 3004 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 3004 wrote to memory of 336 3004 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 3004 wrote to memory of 336 3004 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 336 wrote to memory of 1436 336 cmd.exe reg.exe PID 336 wrote to memory of 1436 336 cmd.exe reg.exe PID 336 wrote to memory of 1436 336 cmd.exe reg.exe PID 3004 wrote to memory of 4188 3004 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 3004 wrote to memory of 4188 3004 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 3004 wrote to memory of 4188 3004 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 3004 wrote to memory of 3388 3004 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 3004 wrote to memory of 3388 3004 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 3004 wrote to memory of 3388 3004 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 3004 wrote to memory of 3388 3004 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 3004 wrote to memory of 3388 3004 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 3004 wrote to memory of 3388 3004 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 3004 wrote to memory of 3388 3004 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 3004 wrote to memory of 3388 3004 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 3388 wrote to memory of 4308 3388 taskhost.exe netsh.exe PID 3388 wrote to memory of 4308 3388 taskhost.exe netsh.exe PID 3388 wrote to memory of 4308 3388 taskhost.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222.exe"C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/Remcos Professional Cracked By Alcatraz3222.exe" "%temp%\Profile Remcos\Update_Lock_Remcos.exe" /Y2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\Profile Remcos\Update_Lock_Remcos.exe.lnk" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Profile Remcos\Update_Lock_Remcos.exe.lnk" /f3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\Profile Remcos\Update_Lock_Remcos.exe:Zone.Identifier2⤵
-
C:\Users\Admin\AppData\Local\Temp\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\taskhost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\taskhost.exe" "taskhost.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Profile Remcos\Update_Lock_Remcos.exeFilesize
17.7MB
MD5efc159c7cf75545997f8c6af52d3e802
SHA1b85bd368c91a13db1c5de2326deb25ad666c24c1
SHA256898ac001d0f6c52c1001c640d9860287fdf30a648d580e9f5dd15e2ef84ab18e
SHA512d06a432233dceb731defd53238971699fef201d0f9144ee50e5dd7d6620dfdd6c298d52618bf2c9feb0519574f4565fb0177b00fd8292768fbd8b85dd11e650d
-
C:\Users\Admin\AppData\Local\Temp\taskhost.exeFilesize
256KB
MD58fdf47e0ff70c40ed3a17014aeea4232
SHA1e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA256ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
SHA512bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be
-
C:\Users\Admin\AppData\Local\Temp\taskhost.exeFilesize
256KB
MD58fdf47e0ff70c40ed3a17014aeea4232
SHA1e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA256ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
SHA512bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be
-
memory/3004-135-0x00000000061C0000-0x00000000061D0000-memory.dmpFilesize
64KB
-
memory/3004-134-0x00000000062B0000-0x000000000634C000-memory.dmpFilesize
624KB
-
memory/3004-133-0x0000000000660000-0x000000000180E000-memory.dmpFilesize
17.7MB
-
memory/3004-149-0x00000000061C0000-0x00000000061D0000-memory.dmpFilesize
64KB
-
memory/3388-143-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/3388-148-0x00000000058D0000-0x0000000005E74000-memory.dmpFilesize
5.6MB
-
memory/3388-150-0x00000000054D0000-0x0000000005562000-memory.dmpFilesize
584KB
-
memory/3388-151-0x00000000054C0000-0x00000000054D0000-memory.dmpFilesize
64KB
-
memory/3388-152-0x0000000005450000-0x000000000545A000-memory.dmpFilesize
40KB
-
memory/3388-154-0x00000000054C0000-0x00000000054D0000-memory.dmpFilesize
64KB