Analysis
-
max time kernel
118s -
max time network
174s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
29-03-2023 21:08
Static task
static1
Behavioral task
behavioral1
Sample
AppData.exe
Resource
win7-20230220-en
General
-
Target
AppData.exe
-
Size
1024.0MB
-
MD5
932f4060cc31b4dbaffa1bb6d3991c20
-
SHA1
989f4fb91c3a30a0789c0d61c1b8c5dad659747e
-
SHA256
a40084ddc1d6655c2f78365a9ef6a9b81997cfa98a6f81c8d7dfe9619ef6b853
-
SHA512
7bb952847d5bacff9275415ba02a6fbeb180d16b2ef23591a60f9fe302f51301d7c967af5eaa5dc9135ceb108cdf25afdf745a3875b5b0655924452d1f753ba5
-
SSDEEP
6144:AxjCbYJafbpsBSM/HVFku/7AGLr5lw2H3SgoXraFjvVpQ+QW8uR3OoJWwvTTZlIY:+PozpsBzkuHPgDsvELuv7ZlIgCjIDF
Malware Config
Extracted
remcos
BILLETE
cactus.con-ip.com:7770
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-9927QM
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
AppData.exepid process 804 AppData.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
AppData.exeAppData.exedescription pid process target process PID 1612 set thread context of 768 1612 AppData.exe csc.exe PID 804 set thread context of 1620 804 AppData.exe csc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 472 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
csc.exepid process 768 csc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 472 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
csc.exepid process 768 csc.exe -
Suspicious use of WriteProcessMemory 62 IoCs
Processes:
AppData.execmd.exetaskeng.exeAppData.execmd.exedescription pid process target process PID 1612 wrote to memory of 1500 1612 AppData.exe cmd.exe PID 1612 wrote to memory of 1500 1612 AppData.exe cmd.exe PID 1612 wrote to memory of 1500 1612 AppData.exe cmd.exe PID 1612 wrote to memory of 1500 1612 AppData.exe cmd.exe PID 1612 wrote to memory of 1344 1612 AppData.exe cmd.exe PID 1612 wrote to memory of 1344 1612 AppData.exe cmd.exe PID 1612 wrote to memory of 1344 1612 AppData.exe cmd.exe PID 1612 wrote to memory of 1344 1612 AppData.exe cmd.exe PID 1500 wrote to memory of 848 1500 cmd.exe schtasks.exe PID 1500 wrote to memory of 848 1500 cmd.exe schtasks.exe PID 1500 wrote to memory of 848 1500 cmd.exe schtasks.exe PID 1500 wrote to memory of 848 1500 cmd.exe schtasks.exe PID 1612 wrote to memory of 472 1612 AppData.exe powershell.exe PID 1612 wrote to memory of 472 1612 AppData.exe powershell.exe PID 1612 wrote to memory of 472 1612 AppData.exe powershell.exe PID 1612 wrote to memory of 472 1612 AppData.exe powershell.exe PID 1612 wrote to memory of 768 1612 AppData.exe csc.exe PID 1612 wrote to memory of 768 1612 AppData.exe csc.exe PID 1612 wrote to memory of 768 1612 AppData.exe csc.exe PID 1612 wrote to memory of 768 1612 AppData.exe csc.exe PID 1612 wrote to memory of 768 1612 AppData.exe csc.exe PID 1612 wrote to memory of 768 1612 AppData.exe csc.exe PID 1612 wrote to memory of 768 1612 AppData.exe csc.exe PID 1612 wrote to memory of 768 1612 AppData.exe csc.exe PID 1612 wrote to memory of 768 1612 AppData.exe csc.exe PID 1612 wrote to memory of 768 1612 AppData.exe csc.exe PID 1612 wrote to memory of 768 1612 AppData.exe csc.exe PID 1612 wrote to memory of 768 1612 AppData.exe csc.exe PID 1612 wrote to memory of 768 1612 AppData.exe csc.exe PID 1884 wrote to memory of 804 1884 taskeng.exe AppData.exe PID 1884 wrote to memory of 804 1884 taskeng.exe AppData.exe PID 1884 wrote to memory of 804 1884 taskeng.exe AppData.exe PID 1884 wrote to memory of 804 1884 taskeng.exe AppData.exe PID 804 wrote to memory of 1764 804 AppData.exe cmd.exe PID 804 wrote to memory of 1764 804 AppData.exe cmd.exe PID 804 wrote to memory of 1764 804 AppData.exe cmd.exe PID 804 wrote to memory of 1764 804 AppData.exe cmd.exe PID 804 wrote to memory of 1460 804 AppData.exe cmd.exe PID 804 wrote to memory of 1460 804 AppData.exe cmd.exe PID 804 wrote to memory of 1460 804 AppData.exe cmd.exe PID 804 wrote to memory of 1460 804 AppData.exe cmd.exe PID 804 wrote to memory of 1172 804 AppData.exe powershell.exe PID 804 wrote to memory of 1172 804 AppData.exe powershell.exe PID 804 wrote to memory of 1172 804 AppData.exe powershell.exe PID 804 wrote to memory of 1172 804 AppData.exe powershell.exe PID 804 wrote to memory of 1620 804 AppData.exe csc.exe PID 804 wrote to memory of 1620 804 AppData.exe csc.exe PID 804 wrote to memory of 1620 804 AppData.exe csc.exe PID 804 wrote to memory of 1620 804 AppData.exe csc.exe PID 804 wrote to memory of 1620 804 AppData.exe csc.exe PID 804 wrote to memory of 1620 804 AppData.exe csc.exe PID 804 wrote to memory of 1620 804 AppData.exe csc.exe PID 804 wrote to memory of 1620 804 AppData.exe csc.exe PID 804 wrote to memory of 1620 804 AppData.exe csc.exe PID 804 wrote to memory of 1620 804 AppData.exe csc.exe PID 804 wrote to memory of 1620 804 AppData.exe csc.exe PID 804 wrote to memory of 1620 804 AppData.exe csc.exe PID 804 wrote to memory of 1620 804 AppData.exe csc.exe PID 1764 wrote to memory of 888 1764 cmd.exe schtasks.exe PID 1764 wrote to memory of 888 1764 cmd.exe schtasks.exe PID 1764 wrote to memory of 888 1764 cmd.exe schtasks.exe PID 1764 wrote to memory of 888 1764 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AppData.exe"C:\Users\Admin\AppData\Local\Temp\AppData.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\AppData.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\AppData.exe'" /f3⤵
- Creates scheduled task(s)
PID:848 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\AppData.exe" "C:\Users\Admin\AppData\Roaming\AppData.exe"2⤵PID:1344
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "'C:\Users\Admin\AppData\Local\Temp\AppData.exe'"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:472 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:768
-
C:\Windows\system32\taskeng.exetaskeng.exe {C730E148-A362-4A0B-B64C-BF592DD7A755} S-1-5-21-1563773381-2037468142-1146002597-1000:YBHADZIG\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Roaming\AppData.exeC:\Users\Admin\AppData\Roaming\AppData.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\AppData.exe'" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\AppData.exe'" /f4⤵
- Creates scheduled task(s)
PID:888 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\AppData.exe" "C:\Users\Admin\AppData\Roaming\AppData.exe"3⤵PID:1460
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "'C:\Users\Admin\AppData\Roaming\AppData.exe'"3⤵PID:1172
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"3⤵PID:1620
-
C:\Users\Admin\AppData\Roaming\AppData.exeC:\Users\Admin\AppData\Roaming\AppData.exe2⤵PID:1204
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\remcos\logs.datFilesize
144B
MD5aa155f382296008e305090fe933b7609
SHA1548b72539635f91441c9f57edbfb863692a69fa5
SHA2562fefaf8797d3f0d35b7a7f5424afd119ea2784205a465d389a79c7083eb1188b
SHA512d19dc836b462385ff9a7f34e4090a71480df0b0e704a8ec5cfe46fc38eb4d67368a458a57fe1e11c209803c106a556037a54e8d3c55b99e2bc3e0c6744de8787
-
C:\Users\Admin\AppData\Roaming\AppData.exeFilesize
42.7MB
MD5b34320432ffe80c2867afd5b33e7309a
SHA171b9e0362afd62c9f848f16fea174ebace0f3668
SHA25643d8f3f5e2de1ff6893ffd472ff96233fda3f4cfbea80b2819783f03a014109e
SHA5128adad4fec929b21ec28e927880cf465304664e9182aa1cf44d72c63c8ecc052bac3f65339c745b59a5f5f3f6d071886c7b5406215e518bdc54d18866929c4207
-
C:\Users\Admin\AppData\Roaming\AppData.exeFilesize
731.4MB
MD5b3553f62f2d22637669cb726a6d0bdbb
SHA12d80960bc5eefebde34ecc27308b1246d0cbe681
SHA256f94e50d68acd64e7e823cd5a88d405cfb48ec3d0220dbb03eba71733020f247d
SHA5121aaa8efd5602b0475513601a16138700b9aaa0b76a83a9a9464e67517b3c6428360706fe5fe3a7c8d6109547c7706acb8ef2a07e0108b07efa61b889c1fb0a8b
-
C:\Users\Admin\AppData\Roaming\AppData.exeFilesize
712.9MB
MD593bf384c864bf235ba0711d228f8c6d2
SHA172b1d21fa1f7e1994f77cd226d49d99c1ca6abf5
SHA25694ff2f9009e78de6f52244be9d29b929ebe59619f54d897a0ad6372dab0edd67
SHA512b6c1116464209178464627a79b6779195e824b7c30ce4e898f4853f8bfa2171d61d45780ef096c563536185e2cd58d197c35b17b7f6466b3ec8689c0af971c03
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5d56e6d69df4d0b3f3b8e28aedf83e96d
SHA149166b57326a697e7a69bdda6b8f8b97a2cb9cea
SHA256c5bc3fbcde5dd2fe60a896efa7fa06678951a8caa1a6415a77865042ccc21d02
SHA512b323a467f2c5d231e47590cf080d64f963325984a533c7f47079c51ab66c7d70d2d0383902fd7f9e427b364525a783c4c6544d3f712326dbafea1388df90d850
-
memory/472-86-0x0000000002540000-0x0000000002580000-memory.dmpFilesize
256KB
-
memory/472-87-0x0000000002540000-0x0000000002580000-memory.dmpFilesize
256KB
-
memory/768-100-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-61-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-59-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-66-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/768-68-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-73-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-78-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-79-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-81-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-83-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-85-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-65-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-64-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-88-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-89-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-91-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-92-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-94-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-63-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-62-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-97-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-57-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-58-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-101-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-103-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-136-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-105-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-106-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-108-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-109-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-111-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-113-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-114-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-116-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-117-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-121-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-122-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-126-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-127-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-129-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-130-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-132-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-133-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/768-134-0x0000000000080000-0x0000000000100000-memory.dmpFilesize
512KB
-
memory/804-98-0x0000000000FD0000-0x0000000001102000-memory.dmpFilesize
1.2MB
-
memory/1204-178-0x0000000000FD0000-0x0000000001102000-memory.dmpFilesize
1.2MB
-
memory/1612-60-0x0000000004E90000-0x0000000004ED0000-memory.dmpFilesize
256KB
-
memory/1612-54-0x0000000000800000-0x0000000000932000-memory.dmpFilesize
1.2MB
-
memory/1620-146-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB