Analysis
-
max time kernel
31s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
02-06-2023 13:14
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230220-en
General
-
Target
file.exe
-
Size
744KB
-
MD5
447766638aad4f1a4e04568524e27e90
-
SHA1
8bfdd143a996a7db7abd6a00e634d6d04d115a1e
-
SHA256
bc3e38148839e72cc594c795183adb3ba9664be94be03fb254e7c9232553077f
-
SHA512
38e5abc10e894242ae98ee20dc6e3bf4cfd65bb8a4a9f6e78e2289db1c1614b180cf7471dee6fe09e8c3d725eb4aca09543ca1c41ac94070e38749b38330008a
-
SSDEEP
12288:hrRQSMl6m5YfhamfW47jScSJmvlPuFsuMGNO8BHZnRM+ErWbVdVKEdFa:h9zMl6mmfUmLqcSJmTKOuHHM+Erkpa
Malware Config
Extracted
remcos
RemoteHost
127.0.0.1:2080
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-6IHMTY
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 468 svchost.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1776 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
file.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\"" file.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
svchost.exedescription pid process target process PID 468 set thread context of 316 468 svchost.exe SetupUtility.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1264 316 WerFault.exe SetupUtility.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1788 timeout.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
file.exesvchost.exepid process 1148 file.exe 468 svchost.exe 468 svchost.exe 468 svchost.exe 468 svchost.exe 468 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
file.exesvchost.exedescription pid process Token: SeDebugPrivilege 1148 file.exe Token: SeDebugPrivilege 468 svchost.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
file.execmd.execmd.exesvchost.exeSetupUtility.exedescription pid process target process PID 1148 wrote to memory of 884 1148 file.exe cmd.exe PID 1148 wrote to memory of 884 1148 file.exe cmd.exe PID 1148 wrote to memory of 884 1148 file.exe cmd.exe PID 884 wrote to memory of 560 884 cmd.exe schtasks.exe PID 884 wrote to memory of 560 884 cmd.exe schtasks.exe PID 884 wrote to memory of 560 884 cmd.exe schtasks.exe PID 1148 wrote to memory of 1776 1148 file.exe cmd.exe PID 1148 wrote to memory of 1776 1148 file.exe cmd.exe PID 1148 wrote to memory of 1776 1148 file.exe cmd.exe PID 1776 wrote to memory of 1788 1776 cmd.exe timeout.exe PID 1776 wrote to memory of 1788 1776 cmd.exe timeout.exe PID 1776 wrote to memory of 1788 1776 cmd.exe timeout.exe PID 1776 wrote to memory of 468 1776 cmd.exe svchost.exe PID 1776 wrote to memory of 468 1776 cmd.exe svchost.exe PID 1776 wrote to memory of 468 1776 cmd.exe svchost.exe PID 468 wrote to memory of 768 468 svchost.exe WsatConfig.exe PID 468 wrote to memory of 768 468 svchost.exe WsatConfig.exe PID 468 wrote to memory of 768 468 svchost.exe WsatConfig.exe PID 468 wrote to memory of 2012 468 svchost.exe RegSvcs.exe PID 468 wrote to memory of 2012 468 svchost.exe RegSvcs.exe PID 468 wrote to memory of 2012 468 svchost.exe RegSvcs.exe PID 468 wrote to memory of 1432 468 svchost.exe Microsoft.Workflow.Compiler.exe PID 468 wrote to memory of 1432 468 svchost.exe Microsoft.Workflow.Compiler.exe PID 468 wrote to memory of 1432 468 svchost.exe Microsoft.Workflow.Compiler.exe PID 468 wrote to memory of 864 468 svchost.exe AddInUtil.exe PID 468 wrote to memory of 864 468 svchost.exe AddInUtil.exe PID 468 wrote to memory of 864 468 svchost.exe AddInUtil.exe PID 468 wrote to memory of 1928 468 svchost.exe mscorsvw.exe PID 468 wrote to memory of 1928 468 svchost.exe mscorsvw.exe PID 468 wrote to memory of 1928 468 svchost.exe mscorsvw.exe PID 468 wrote to memory of 316 468 svchost.exe SetupUtility.exe PID 468 wrote to memory of 316 468 svchost.exe SetupUtility.exe PID 468 wrote to memory of 316 468 svchost.exe SetupUtility.exe PID 468 wrote to memory of 316 468 svchost.exe SetupUtility.exe PID 468 wrote to memory of 316 468 svchost.exe SetupUtility.exe PID 468 wrote to memory of 316 468 svchost.exe SetupUtility.exe PID 468 wrote to memory of 316 468 svchost.exe SetupUtility.exe PID 468 wrote to memory of 316 468 svchost.exe SetupUtility.exe PID 468 wrote to memory of 316 468 svchost.exe SetupUtility.exe PID 468 wrote to memory of 316 468 svchost.exe SetupUtility.exe PID 468 wrote to memory of 316 468 svchost.exe SetupUtility.exe PID 468 wrote to memory of 316 468 svchost.exe SetupUtility.exe PID 468 wrote to memory of 316 468 svchost.exe SetupUtility.exe PID 468 wrote to memory of 316 468 svchost.exe SetupUtility.exe PID 468 wrote to memory of 316 468 svchost.exe SetupUtility.exe PID 468 wrote to memory of 316 468 svchost.exe SetupUtility.exe PID 316 wrote to memory of 1264 316 SetupUtility.exe WerFault.exe PID 316 wrote to memory of 1264 316 SetupUtility.exe WerFault.exe PID 316 wrote to memory of 1264 316 SetupUtility.exe WerFault.exe PID 316 wrote to memory of 1264 316 SetupUtility.exe WerFault.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp8C8.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 1685⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp8C8.tmp.batFilesize
150B
MD55d632f10322657898551092fc8e10f0e
SHA15d84da35660aca8aab064d27be1bf05ea0198cf2
SHA25607f15187df43e930155ad56dd073dee3f39f0111b6429e9778a2fc919567f3c8
SHA512eb0869ee7115543b93c1c6b8c623552f9aba82de2d73e04585b51ef4d69f3f6b301cefdeabd091d91e5bfde054a145de7b5c6a7454a1f9cfc46dacdef802a44e
-
C:\Users\Admin\AppData\Local\Temp\tmp8C8.tmp.batFilesize
150B
MD55d632f10322657898551092fc8e10f0e
SHA15d84da35660aca8aab064d27be1bf05ea0198cf2
SHA25607f15187df43e930155ad56dd073dee3f39f0111b6429e9778a2fc919567f3c8
SHA512eb0869ee7115543b93c1c6b8c623552f9aba82de2d73e04585b51ef4d69f3f6b301cefdeabd091d91e5bfde054a145de7b5c6a7454a1f9cfc46dacdef802a44e
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
744KB
MD5447766638aad4f1a4e04568524e27e90
SHA18bfdd143a996a7db7abd6a00e634d6d04d115a1e
SHA256bc3e38148839e72cc594c795183adb3ba9664be94be03fb254e7c9232553077f
SHA51238e5abc10e894242ae98ee20dc6e3bf4cfd65bb8a4a9f6e78e2289db1c1614b180cf7471dee6fe09e8c3d725eb4aca09543ca1c41ac94070e38749b38330008a
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
744KB
MD5447766638aad4f1a4e04568524e27e90
SHA18bfdd143a996a7db7abd6a00e634d6d04d115a1e
SHA256bc3e38148839e72cc594c795183adb3ba9664be94be03fb254e7c9232553077f
SHA51238e5abc10e894242ae98ee20dc6e3bf4cfd65bb8a4a9f6e78e2289db1c1614b180cf7471dee6fe09e8c3d725eb4aca09543ca1c41ac94070e38749b38330008a
-
\Users\Admin\AppData\Roaming\svchost.exeFilesize
744KB
MD5447766638aad4f1a4e04568524e27e90
SHA18bfdd143a996a7db7abd6a00e634d6d04d115a1e
SHA256bc3e38148839e72cc594c795183adb3ba9664be94be03fb254e7c9232553077f
SHA51238e5abc10e894242ae98ee20dc6e3bf4cfd65bb8a4a9f6e78e2289db1c1614b180cf7471dee6fe09e8c3d725eb4aca09543ca1c41ac94070e38749b38330008a
-
memory/316-70-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/468-69-0x0000000000020000-0x00000000000DE000-memory.dmpFilesize
760KB
-
memory/1148-54-0x0000000001390000-0x000000000144E000-memory.dmpFilesize
760KB
-
memory/1148-55-0x000000001BF30000-0x000000001BFB0000-memory.dmpFilesize
512KB