Analysis
-
max time kernel
118s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
22-09-2023 11:56
Static task
static1
Behavioral task
behavioral1
Sample
Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exe
Resource
win10v2004-20230915-en
General
-
Target
Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exe
-
Size
890KB
-
MD5
5741f12af0f989bd145f21dd9a62d652
-
SHA1
10d30c251b92ecc3bc7a0e3a8e0c86b2bf484ad4
-
SHA256
f7c4c713d4596ea0b8d544916de1bb1ba87d97b4c36343056f5172b6594713a8
-
SHA512
a1e911375cbe72a8d53fff029980f3f808f6485a48869439aa9f34409124503c4d7fb568a375cdc320e4eda618503b792090334a9b6b9ccfb686bd13e4c1f7f0
-
SSDEEP
24576:eq7JcjVujvxYTHk8g55pdmlKCl99NDpKGN/VcUNK:V7uS5Gx85vClWGNNNK
Malware Config
Extracted
remcos
Crypted
ourt2949aslumes9.duckdns.org:2401
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
paqlgkfs.dat
-
keylog_flag
false
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
ourvbpld-RBN2WW
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Detect Xworm Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/556-69-0x0000000073120000-0x0000000074374000-memory.dmp family_xworm behavioral2/memory/556-88-0x0000000073120000-0x0000000074374000-memory.dmp family_xworm -
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exewab.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe wab.exe -
Loads dropped DLL 6 IoCs
Processes:
Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exepid process 2008 Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exe 2008 Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exe 2008 Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exe 2008 Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exe 2008 Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exe 2008 Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
wab.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\dameskrdderinder = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Valiship\\Trommesygens.exe" wab.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
Processes:
wab.exepid process 556 wab.exe 556 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exewab.exepid process 2008 Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exe 556 wab.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exedescription pid process target process PID 2008 set thread context of 556 2008 Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exe wab.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exepid process 2008 Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
wab.exepid process 556 wab.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exedescription pid process target process PID 2008 wrote to memory of 556 2008 Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exe wab.exe PID 2008 wrote to memory of 556 2008 Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exe wab.exe PID 2008 wrote to memory of 556 2008 Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exe wab.exe PID 2008 wrote to memory of 556 2008 Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exe wab.exe PID 2008 wrote to memory of 556 2008 Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exe wab.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exe"C:\Users\Admin\AppData\Local\Temp\Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exe"1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Users\Admin\AppData\Local\Temp\Приложение №1 на АИ-FOB Кавказ_сентябрь-октябрь 2023.exe"2⤵
- Checks QEMU agent file
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsx735C.tmp\BgImage.dllFilesize
7KB
MD5487368e6fce9ab9c5ea053af0990c5ef
SHA1b538e37c87d4b9a7645dcbbd9e93025a31849702
SHA256e27efa5dfde875bd6b826fafb4c7698db6b6e30e68715a1c03eb018e3170fc04
SHA512bb3ed4c0d17a11365b72653112b48c8c63ab10590dda3dfd90aa453f0d64203000e4571c73998063352240e1671d14da5ee394439899aaa31054fa2e9b722ea7
-
C:\Users\Admin\AppData\Local\Temp\nsx735C.tmp\BgImage.dllFilesize
7KB
MD5487368e6fce9ab9c5ea053af0990c5ef
SHA1b538e37c87d4b9a7645dcbbd9e93025a31849702
SHA256e27efa5dfde875bd6b826fafb4c7698db6b6e30e68715a1c03eb018e3170fc04
SHA512bb3ed4c0d17a11365b72653112b48c8c63ab10590dda3dfd90aa453f0d64203000e4571c73998063352240e1671d14da5ee394439899aaa31054fa2e9b722ea7
-
C:\Users\Admin\AppData\Local\Temp\nsx735C.tmp\BgImage.dllFilesize
7KB
MD5487368e6fce9ab9c5ea053af0990c5ef
SHA1b538e37c87d4b9a7645dcbbd9e93025a31849702
SHA256e27efa5dfde875bd6b826fafb4c7698db6b6e30e68715a1c03eb018e3170fc04
SHA512bb3ed4c0d17a11365b72653112b48c8c63ab10590dda3dfd90aa453f0d64203000e4571c73998063352240e1671d14da5ee394439899aaa31054fa2e9b722ea7
-
C:\Users\Admin\AppData\Local\Temp\nsx735C.tmp\System.dllFilesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
C:\Users\Admin\AppData\Local\Temp\nsx735C.tmp\System.dllFilesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
C:\Users\Admin\AppData\Local\Temp\nsx735C.tmp\System.dllFilesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
C:\Users\Admin\AppData\Local\Temp\nsx735C.tmp\nsDialogs.dllFilesize
9KB
MD5466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1eb607467009074278e4bd50c7eab400e95ae48f7
SHA2561e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
SHA5127508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
-
C:\Users\Admin\AppData\Local\Temp\nsx735C.tmp\nsDialogs.dllFilesize
9KB
MD5466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1eb607467009074278e4bd50c7eab400e95ae48f7
SHA2561e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
SHA5127508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
-
C:\Users\Admin\AppData\Local\Temp\nsx735C.tmp\nsDialogs.dllFilesize
9KB
MD5466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1eb607467009074278e4bd50c7eab400e95ae48f7
SHA2561e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
SHA5127508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
-
memory/556-59-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-63-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-100-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-99-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-98-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-32-0x0000000000CF0000-0x00000000035A1000-memory.dmpFilesize
40.7MB
-
memory/556-33-0x0000000077848000-0x0000000077849000-memory.dmpFilesize
4KB
-
memory/556-34-0x00000000777C1000-0x00000000778E1000-memory.dmpFilesize
1.1MB
-
memory/556-36-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-37-0x0000000000CF0000-0x00000000035A1000-memory.dmpFilesize
40.7MB
-
memory/556-39-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-38-0x0000000000CF0000-0x00000000035A1000-memory.dmpFilesize
40.7MB
-
memory/556-40-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-41-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-42-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-43-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-44-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-45-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-46-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-47-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-48-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-49-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-50-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-51-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-52-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-53-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-54-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-57-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-58-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-31-0x0000000000CF0000-0x00000000035A1000-memory.dmpFilesize
40.7MB
-
memory/556-60-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-61-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-62-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-97-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-64-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-65-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-66-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-67-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-68-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-69-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-70-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-71-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-72-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-73-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-74-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-75-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-76-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-77-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-79-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-80-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-81-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-82-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-83-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-87-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-88-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-89-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-90-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-91-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-92-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-93-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-94-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/556-96-0x0000000073120000-0x0000000074374000-memory.dmpFilesize
18.3MB
-
memory/2008-26-0x0000000004A20000-0x00000000072D1000-memory.dmpFilesize
40.7MB
-
memory/2008-29-0x00000000777C1000-0x00000000778E1000-memory.dmpFilesize
1.1MB
-
memory/2008-28-0x00000000777C1000-0x00000000778E1000-memory.dmpFilesize
1.1MB
-
memory/2008-27-0x0000000004A20000-0x00000000072D1000-memory.dmpFilesize
40.7MB
-
memory/2008-30-0x0000000074620000-0x0000000074627000-memory.dmpFilesize
28KB