Analysis
-
max time kernel
67s -
max time network
71s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
29-03-2023 01:08
Static task
static1
Behavioral task
behavioral1
Sample
Remcos Professional Cracked By Alcatraz3222-cleaned.exe
Resource
win10v2004-20230220-en
General
-
Target
Remcos Professional Cracked By Alcatraz3222.exe
-
Size
17.7MB
-
MD5
efc159c7cf75545997f8c6af52d3e802
-
SHA1
b85bd368c91a13db1c5de2326deb25ad666c24c1
-
SHA256
898ac001d0f6c52c1001c640d9860287fdf30a648d580e9f5dd15e2ef84ab18e
-
SHA512
d06a432233dceb731defd53238971699fef201d0f9144ee50e5dd7d6620dfdd6c298d52618bf2c9feb0519574f4565fb0177b00fd8292768fbd8b85dd11e650d
-
SSDEEP
393216:GYuGvp8EHb+in8f4Zg41+Q4AXf5ZZcyfHDMxVpSc+q+eOFxdx:3mqSi8fN4sAXfrZcyfo7p0eYHx
Malware Config
Extracted
njrat
0.7d
HacKed
dllsys.duckdns.org:3202
3b570ffeeb3d34249b9a5ce0ee58a328
-
reg_key
3b570ffeeb3d34249b9a5ce0ee58a328
-
splitter
svchost
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Remcos Professional Cracked By Alcatraz3222.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation Remcos Professional Cracked By Alcatraz3222.exe -
Executes dropped EXE 1 IoCs
Processes:
taskhost.exepid process 4528 taskhost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Remcos Professional Cracked By Alcatraz3222.exedescription pid process target process PID 4828 set thread context of 4528 4828 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Remcos Professional Cracked By Alcatraz3222.exepid process 4828 Remcos Professional Cracked By Alcatraz3222.exe 4828 Remcos Professional Cracked By Alcatraz3222.exe 4828 Remcos Professional Cracked By Alcatraz3222.exe 4828 Remcos Professional Cracked By Alcatraz3222.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
Remcos Professional Cracked By Alcatraz3222.exetaskhost.exedescription pid process Token: SeDebugPrivilege 4828 Remcos Professional Cracked By Alcatraz3222.exe Token: SeDebugPrivilege 4528 taskhost.exe Token: 33 4528 taskhost.exe Token: SeIncBasePriorityPrivilege 4528 taskhost.exe Token: 33 4528 taskhost.exe Token: SeIncBasePriorityPrivilege 4528 taskhost.exe Token: 33 4528 taskhost.exe Token: SeIncBasePriorityPrivilege 4528 taskhost.exe Token: 33 4528 taskhost.exe Token: SeIncBasePriorityPrivilege 4528 taskhost.exe Token: 33 4528 taskhost.exe Token: SeIncBasePriorityPrivilege 4528 taskhost.exe Token: 33 4528 taskhost.exe Token: SeIncBasePriorityPrivilege 4528 taskhost.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
Remcos Professional Cracked By Alcatraz3222.execmd.exetaskhost.exedescription pid process target process PID 4828 wrote to memory of 400 4828 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 4828 wrote to memory of 400 4828 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 4828 wrote to memory of 400 4828 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 4828 wrote to memory of 1468 4828 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 4828 wrote to memory of 1468 4828 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 4828 wrote to memory of 1468 4828 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 1468 wrote to memory of 4788 1468 cmd.exe reg.exe PID 1468 wrote to memory of 4788 1468 cmd.exe reg.exe PID 1468 wrote to memory of 4788 1468 cmd.exe reg.exe PID 4828 wrote to memory of 3268 4828 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 4828 wrote to memory of 3268 4828 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 4828 wrote to memory of 3268 4828 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 4828 wrote to memory of 4528 4828 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 4828 wrote to memory of 4528 4828 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 4828 wrote to memory of 4528 4828 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 4828 wrote to memory of 4528 4828 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 4828 wrote to memory of 4528 4828 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 4828 wrote to memory of 4528 4828 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 4828 wrote to memory of 4528 4828 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 4828 wrote to memory of 4528 4828 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 4528 wrote to memory of 1296 4528 taskhost.exe netsh.exe PID 4528 wrote to memory of 1296 4528 taskhost.exe netsh.exe PID 4528 wrote to memory of 1296 4528 taskhost.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222.exe"C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/Remcos Professional Cracked By Alcatraz3222.exe" "%temp%\Profile Remcos\Update_Lock_Remcos.exe" /Y2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\Profile Remcos\Update_Lock_Remcos.exe.lnk" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Profile Remcos\Update_Lock_Remcos.exe.lnk" /f3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\Profile Remcos\Update_Lock_Remcos.exe:Zone.Identifier2⤵
-
C:\Users\Admin\AppData\Local\Temp\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\taskhost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\taskhost.exe" "taskhost.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Profile Remcos\Update_Lock_Remcos.exeFilesize
17.7MB
MD5efc159c7cf75545997f8c6af52d3e802
SHA1b85bd368c91a13db1c5de2326deb25ad666c24c1
SHA256898ac001d0f6c52c1001c640d9860287fdf30a648d580e9f5dd15e2ef84ab18e
SHA512d06a432233dceb731defd53238971699fef201d0f9144ee50e5dd7d6620dfdd6c298d52618bf2c9feb0519574f4565fb0177b00fd8292768fbd8b85dd11e650d
-
C:\Users\Admin\AppData\Local\Temp\taskhost.exeFilesize
256KB
MD58fdf47e0ff70c40ed3a17014aeea4232
SHA1e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA256ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
SHA512bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be
-
C:\Users\Admin\AppData\Local\Temp\taskhost.exeFilesize
256KB
MD58fdf47e0ff70c40ed3a17014aeea4232
SHA1e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA256ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
SHA512bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be
-
memory/4528-143-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/4528-148-0x0000000005A70000-0x0000000006014000-memory.dmpFilesize
5.6MB
-
memory/4528-150-0x00000000055E0000-0x0000000005672000-memory.dmpFilesize
584KB
-
memory/4528-151-0x00000000053E0000-0x00000000053F0000-memory.dmpFilesize
64KB
-
memory/4528-152-0x0000000005560000-0x000000000556A000-memory.dmpFilesize
40KB
-
memory/4528-154-0x00000000053E0000-0x00000000053F0000-memory.dmpFilesize
64KB
-
memory/4828-135-0x0000000006880000-0x0000000006890000-memory.dmpFilesize
64KB
-
memory/4828-134-0x00000000069A0000-0x0000000006A3C000-memory.dmpFilesize
624KB
-
memory/4828-133-0x0000000000DA0000-0x0000000001F4E000-memory.dmpFilesize
17.7MB
-
memory/4828-149-0x0000000006880000-0x0000000006890000-memory.dmpFilesize
64KB