Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2023, 12:17
Static task
static1
Behavioral task
behavioral1
Sample
3.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3.exe
Resource
win10v2004-20231127-en
General
-
Target
3.exe
-
Size
973KB
-
MD5
e2473c2832fb852d2aa8785e90b285a0
-
SHA1
663f5fd69dfd51e8608ea5e2231319923db26b1d
-
SHA256
b67319d5978b2236bb8a735b1838b18b6432cb835fce1b9b08ff2d68e012bc50
-
SHA512
4368f1289746e425eec96762e05894f524ef43424db92d66730c2eb8bfadffecb9126588da97a21f28273babba53bb94396a72e0a0abcf391c512adf8ae1efba
-
SSDEEP
24576:i9PtD/fmh3G6dGSCjFqHvwy8zfGIvtooo:UBt2GtFqPwGjr
Malware Config
Extracted
remcos
RemoteHost
107.175.229.139:8087
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-IZFV1M
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/4828-111-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView behavioral2/memory/4828-113-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView behavioral2/memory/4828-151-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/1708-99-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/1708-122-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 7 IoCs
resource yara_rule behavioral2/memory/1708-99-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/4828-111-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral2/memory/4828-113-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral2/memory/2512-118-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/1708-122-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/2512-116-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/4828-151-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\Control Panel\International\Geo\Nation 3.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2037190880-819243489-950462038-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts 3.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 3664 set thread context of 3056 3664 3.exe 103 PID 3056 set thread context of 1708 3056 3.exe 105 PID 3056 set thread context of 4828 3056 3.exe 109 PID 3056 set thread context of 2512 3056 3.exe 111 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4744 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4388 powershell.exe 4388 powershell.exe 1212 powershell.exe 1212 powershell.exe 1212 powershell.exe 4388 powershell.exe 1708 3.exe 1708 3.exe 2512 3.exe 2512 3.exe 1708 3.exe 1708 3.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 3056 3.exe 3056 3.exe 3056 3.exe 3056 3.exe 3056 3.exe 3056 3.exe 3056 3.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4388 powershell.exe Token: SeDebugPrivilege 1212 powershell.exe Token: SeDebugPrivilege 2512 3.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3056 3.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 3664 wrote to memory of 4388 3664 3.exe 97 PID 3664 wrote to memory of 4388 3664 3.exe 97 PID 3664 wrote to memory of 4388 3664 3.exe 97 PID 3664 wrote to memory of 1212 3664 3.exe 99 PID 3664 wrote to memory of 1212 3664 3.exe 99 PID 3664 wrote to memory of 1212 3664 3.exe 99 PID 3664 wrote to memory of 4744 3664 3.exe 101 PID 3664 wrote to memory of 4744 3664 3.exe 101 PID 3664 wrote to memory of 4744 3664 3.exe 101 PID 3664 wrote to memory of 3056 3664 3.exe 103 PID 3664 wrote to memory of 3056 3664 3.exe 103 PID 3664 wrote to memory of 3056 3664 3.exe 103 PID 3664 wrote to memory of 3056 3664 3.exe 103 PID 3664 wrote to memory of 3056 3664 3.exe 103 PID 3664 wrote to memory of 3056 3664 3.exe 103 PID 3664 wrote to memory of 3056 3664 3.exe 103 PID 3664 wrote to memory of 3056 3664 3.exe 103 PID 3664 wrote to memory of 3056 3664 3.exe 103 PID 3664 wrote to memory of 3056 3664 3.exe 103 PID 3664 wrote to memory of 3056 3664 3.exe 103 PID 3664 wrote to memory of 3056 3664 3.exe 103 PID 3056 wrote to memory of 3888 3056 3.exe 106 PID 3056 wrote to memory of 3888 3056 3.exe 106 PID 3056 wrote to memory of 3888 3056 3.exe 106 PID 3056 wrote to memory of 1708 3056 3.exe 105 PID 3056 wrote to memory of 1708 3056 3.exe 105 PID 3056 wrote to memory of 1708 3056 3.exe 105 PID 3056 wrote to memory of 5040 3056 3.exe 107 PID 3056 wrote to memory of 5040 3056 3.exe 107 PID 3056 wrote to memory of 5040 3056 3.exe 107 PID 3056 wrote to memory of 2432 3056 3.exe 110 PID 3056 wrote to memory of 2432 3056 3.exe 110 PID 3056 wrote to memory of 2432 3056 3.exe 110 PID 3056 wrote to memory of 1328 3056 3.exe 108 PID 3056 wrote to memory of 1328 3056 3.exe 108 PID 3056 wrote to memory of 1328 3056 3.exe 108 PID 3056 wrote to memory of 4828 3056 3.exe 109 PID 3056 wrote to memory of 4828 3056 3.exe 109 PID 3056 wrote to memory of 4828 3056 3.exe 109 PID 3056 wrote to memory of 4828 3056 3.exe 109 PID 3056 wrote to memory of 2512 3056 3.exe 111 PID 3056 wrote to memory of 2512 3056 3.exe 111 PID 3056 wrote to memory of 2512 3056 3.exe 111 PID 3056 wrote to memory of 2512 3056 3.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\3.exe"C:\Users\Admin\AppData\Local\Temp\3.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4388
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LCofJSC.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1212
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LCofJSC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEB0C.tmp"2⤵
- Creates scheduled task(s)
PID:4744
-
-
C:\Users\Admin\AppData\Local\Temp\3.exe"C:\Users\Admin\AppData\Local\Temp\3.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\3.exeC:\Users\Admin\AppData\Local\Temp\3.exe /stext "C:\Users\Admin\AppData\Local\Temp\vtsuixo"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1708
-
-
C:\Users\Admin\AppData\Local\Temp\3.exeC:\Users\Admin\AppData\Local\Temp\3.exe /stext "C:\Users\Admin\AppData\Local\Temp\vtsuixo"3⤵PID:3888
-
-
C:\Users\Admin\AppData\Local\Temp\3.exeC:\Users\Admin\AppData\Local\Temp\3.exe /stext "C:\Users\Admin\AppData\Local\Temp\fwxfjqzyha"3⤵PID:5040
-
-
C:\Users\Admin\AppData\Local\Temp\3.exeC:\Users\Admin\AppData\Local\Temp\3.exe /stext "C:\Users\Admin\AppData\Local\Temp\fwxfjqzyha"3⤵PID:1328
-
-
C:\Users\Admin\AppData\Local\Temp\3.exeC:\Users\Admin\AppData\Local\Temp\3.exe /stext "C:\Users\Admin\AppData\Local\Temp\fwxfjqzyha"3⤵
- Accesses Microsoft Outlook accounts
PID:4828
-
-
C:\Users\Admin\AppData\Local\Temp\3.exeC:\Users\Admin\AppData\Local\Temp\3.exe /stext "C:\Users\Admin\AppData\Local\Temp\fwxfjqzyha"3⤵PID:2432
-
-
C:\Users\Admin\AppData\Local\Temp\3.exeC:\Users\Admin\AppData\Local\Temp\3.exe /stext "C:\Users\Admin\AppData\Local\Temp\qqkxjijzdijvs"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2512
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5bb0fc9f9038df30da5a1defa8e96ecaf
SHA1a5be8b5048de34df35ef3e4374a28dd6d9d402a1
SHA256c0b9c1534a3f2c60740e5ad5b015e2ab71f46172596c66c8a53c3e51932178ed
SHA5122e200afdac865e092dccd5a3b029bfff98b52befe4f9000ebbed598f51e6dc1d4587e496267d1ee82d6bb29fd8b7360ba6afb574a596b95b729c78acedab795f
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD5de30da6724b2860048c3ba44cfe280ff
SHA1d0b940c9fc1d68b9af3d9b12a43634ae584f5839
SHA256b575aab3c4188aa2d8d77901ed0cac75e2e7294babd4d8eab8e513824af6c5f3
SHA512c956c36642396f97b30da350f2290de90471ca21bb260139433c046e1f48e2e60d15fe2dfaff1ef33598e6cb0644e0527ba7eb5392ee1dbe3394222a0e188256
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5b064593f380d81a67670ffd93af5fd48
SHA1179cf058d6dc3e2803e4f7e3e25e5d7b308674ae
SHA2563bb1fe5b90bd4d5c6c6f22f153b879defe260bb2264a78c7cbf9e34b3c985d6e
SHA51207c7fbe3a8d4d199d241154dc24bb9bcc964b2114075e9cf67ad5ee10e851a6fa1968eb91c11d1a29bc3774d515fa3449e50fef5264b09e5a59abf1623a1c127
-
Filesize
4KB
MD5d093259faaf962da227a2205c7fb4def
SHA12a1322acb010cca3a46025b1258ae735b05cff31
SHA256b66b13e023031b845dddc9ddba7de6aa74c3161f3d5fafc8e38f80480e4107d2
SHA5127e7a445fdb5d6aa4550bd65b75a409deba8748eed90812f6344c961cc397749e8a8f60002409e6de41ffce4a0fd490decedb85f730917a29fd5b4c6eb7ca7fd7