Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2023 10:24
Static task
static1
Behavioral task
behavioral1
Sample
FAT986545600986.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
FAT986545600986.exe
Resource
win10v2004-20231130-en
General
-
Target
FAT986545600986.exe
-
Size
1.0MB
-
MD5
470249dbfe3ac7f1d16ea4a52ef76fb3
-
SHA1
984ef38fbfa4efd6b9310a07c4a6b2be63e328bf
-
SHA256
f77532a0a209676025270db283534fc63ba0780415e8273d670fc6d1bc4bf1f5
-
SHA512
ec2edf6140afcf84719a8a2d53303ee86fa6b32406b0fc99db6d87dcc162577b9766f88e5fb7643e4cb4fb09c5431c5ab3d8029800eab02aa1b81914e3faba39
-
SSDEEP
24576:h34/up+pJ1sRbSz55MlrTQF4ZriIqBT3peD:h38PJ1QSz55CsIiIqBs
Malware Config
Extracted
remcos
RemoteHost
107.175.229.139:8087
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-IZFV1M
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
FAT986545600986.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3936660601-1848837011-2142350499-1000\Control Panel\International\Geo\Nation FAT986545600986.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
FAT986545600986.exedescription pid process target process PID 4768 set thread context of 2268 4768 FAT986545600986.exe FAT986545600986.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
FAT986545600986.exepowershell.exepowershell.exepid process 4768 FAT986545600986.exe 4796 powershell.exe 4768 FAT986545600986.exe 4768 FAT986545600986.exe 2996 powershell.exe 4768 FAT986545600986.exe 4768 FAT986545600986.exe 4768 FAT986545600986.exe 4796 powershell.exe 2996 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
FAT986545600986.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4768 FAT986545600986.exe Token: SeDebugPrivilege 4796 powershell.exe Token: SeDebugPrivilege 2996 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
FAT986545600986.exepid process 2268 FAT986545600986.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
FAT986545600986.exedescription pid process target process PID 4768 wrote to memory of 2996 4768 FAT986545600986.exe powershell.exe PID 4768 wrote to memory of 2996 4768 FAT986545600986.exe powershell.exe PID 4768 wrote to memory of 2996 4768 FAT986545600986.exe powershell.exe PID 4768 wrote to memory of 4796 4768 FAT986545600986.exe powershell.exe PID 4768 wrote to memory of 4796 4768 FAT986545600986.exe powershell.exe PID 4768 wrote to memory of 4796 4768 FAT986545600986.exe powershell.exe PID 4768 wrote to memory of 4192 4768 FAT986545600986.exe schtasks.exe PID 4768 wrote to memory of 4192 4768 FAT986545600986.exe schtasks.exe PID 4768 wrote to memory of 4192 4768 FAT986545600986.exe schtasks.exe PID 4768 wrote to memory of 3804 4768 FAT986545600986.exe FAT986545600986.exe PID 4768 wrote to memory of 3804 4768 FAT986545600986.exe FAT986545600986.exe PID 4768 wrote to memory of 3804 4768 FAT986545600986.exe FAT986545600986.exe PID 4768 wrote to memory of 2508 4768 FAT986545600986.exe FAT986545600986.exe PID 4768 wrote to memory of 2508 4768 FAT986545600986.exe FAT986545600986.exe PID 4768 wrote to memory of 2508 4768 FAT986545600986.exe FAT986545600986.exe PID 4768 wrote to memory of 2268 4768 FAT986545600986.exe FAT986545600986.exe PID 4768 wrote to memory of 2268 4768 FAT986545600986.exe FAT986545600986.exe PID 4768 wrote to memory of 2268 4768 FAT986545600986.exe FAT986545600986.exe PID 4768 wrote to memory of 2268 4768 FAT986545600986.exe FAT986545600986.exe PID 4768 wrote to memory of 2268 4768 FAT986545600986.exe FAT986545600986.exe PID 4768 wrote to memory of 2268 4768 FAT986545600986.exe FAT986545600986.exe PID 4768 wrote to memory of 2268 4768 FAT986545600986.exe FAT986545600986.exe PID 4768 wrote to memory of 2268 4768 FAT986545600986.exe FAT986545600986.exe PID 4768 wrote to memory of 2268 4768 FAT986545600986.exe FAT986545600986.exe PID 4768 wrote to memory of 2268 4768 FAT986545600986.exe FAT986545600986.exe PID 4768 wrote to memory of 2268 4768 FAT986545600986.exe FAT986545600986.exe PID 4768 wrote to memory of 2268 4768 FAT986545600986.exe FAT986545600986.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FAT986545600986.exe"C:\Users\Admin\AppData\Local\Temp\FAT986545600986.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\FAT986545600986.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2996 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zulqgtKXtL.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4796 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zulqgtKXtL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8211.tmp"2⤵
- Creates scheduled task(s)
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\FAT986545600986.exe"C:\Users\Admin\AppData\Local\Temp\FAT986545600986.exe"2⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\FAT986545600986.exe"C:\Users\Admin\AppData\Local\Temp\FAT986545600986.exe"2⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\FAT986545600986.exe"C:\Users\Admin\AppData\Local\Temp\FAT986545600986.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:2268
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5a44fedc838dfd0d0e35cebbdd8d5d95e
SHA1146532afa855a116365285e0a9d5668ad2a24d18
SHA256323e401038bed096855dd9c8869e6b781ec7cacdf8ccc0bd9b99b3a12bbeb34a
SHA512a4b816a18bc33bc05a79fb07c02376f4e594258f69719190636a2b7f1ed34bae11a2c11cd8647a3fc5ed516088367383549033676e8458ca1203c5beb4425cb0
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD514eb93b06629c60458c439c3fd73d1d7
SHA1830c234a3edecbad3bf906984dd199dbcbf80219
SHA2562bdc12818a449b9f9b94d7f72bef4f26db75524a38827bbf1bcefbcf46b8c52c
SHA5121dfa81534ed7978c49e7ca9a54e43de558b61c6fe6df936b3e3c543b5a45d840e9d09d6160f78f6e2d24bb774f14d218779ddf876dd9602edc37443733cc1c26
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD57168dd30a31959b250089c6bf8deca86
SHA14e31750c6b2bd2431c51069872ae0affa2fd749a
SHA25683ac08ce85aac89aea1b55467620d947e6c569248597a242435c5c7aa50fee7c
SHA512314f4c5885d68cf5c17ec6e5cb58f65fd00fdc5310da8f1cbf525cbfae12724582c7d9e1e8aefbdfff322a2b6f9218dbff72fada8e371e03a89a52fbe982e65d