Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
12-12-2023 13:58
Static task
static1
Behavioral task
behavioral1
Sample
INVB0987678000090000.BAT.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
INVB0987678000090000.BAT.exe
Resource
win10v2004-20231130-en
General
-
Target
INVB0987678000090000.BAT.exe
-
Size
904KB
-
MD5
4b08b3e2d346591d2f805256c63a8875
-
SHA1
8fb4067bf05ffeb0c16b9ac9ea38507889ca07b0
-
SHA256
f05ac4628bc3cc7da752894e47479c2f8532ed5c485943b7abb680a79d4dba9c
-
SHA512
ece878beb8a207d08a8978f1978548e7f32c1ec6ca36647aa5549b99fcc587bc2e79f999e5dd6f3d32f1f8370ccff98f588e03baa1a8bcba3201ae997f71ace3
-
SSDEEP
24576:7pItSAdsBeO/ECXs95roy+qdi3E4RPrgjizt:9tpekEGs9DdEkjiz
Malware Config
Extracted
remcos
RemoteHost
107.175.229.139:8087
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-IZFV1M
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1960-3-0x0000000000A50000-0x0000000000A68000-memory.dmp family_zgrat_v1 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
INVB0987678000090000.BAT.exedescription pid process target process PID 1960 set thread context of 1920 1960 INVB0987678000090000.BAT.exe INVB0987678000090000.BAT.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
INVB0987678000090000.BAT.exepowershell.exepowershell.exepid process 1960 INVB0987678000090000.BAT.exe 1960 INVB0987678000090000.BAT.exe 2596 powershell.exe 1344 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
INVB0987678000090000.BAT.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1960 INVB0987678000090000.BAT.exe Token: SeDebugPrivilege 2596 powershell.exe Token: SeDebugPrivilege 1344 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
INVB0987678000090000.BAT.exepid process 1920 INVB0987678000090000.BAT.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
INVB0987678000090000.BAT.exedescription pid process target process PID 1960 wrote to memory of 1344 1960 INVB0987678000090000.BAT.exe powershell.exe PID 1960 wrote to memory of 1344 1960 INVB0987678000090000.BAT.exe powershell.exe PID 1960 wrote to memory of 1344 1960 INVB0987678000090000.BAT.exe powershell.exe PID 1960 wrote to memory of 1344 1960 INVB0987678000090000.BAT.exe powershell.exe PID 1960 wrote to memory of 2596 1960 INVB0987678000090000.BAT.exe powershell.exe PID 1960 wrote to memory of 2596 1960 INVB0987678000090000.BAT.exe powershell.exe PID 1960 wrote to memory of 2596 1960 INVB0987678000090000.BAT.exe powershell.exe PID 1960 wrote to memory of 2596 1960 INVB0987678000090000.BAT.exe powershell.exe PID 1960 wrote to memory of 2672 1960 INVB0987678000090000.BAT.exe schtasks.exe PID 1960 wrote to memory of 2672 1960 INVB0987678000090000.BAT.exe schtasks.exe PID 1960 wrote to memory of 2672 1960 INVB0987678000090000.BAT.exe schtasks.exe PID 1960 wrote to memory of 2672 1960 INVB0987678000090000.BAT.exe schtasks.exe PID 1960 wrote to memory of 2752 1960 INVB0987678000090000.BAT.exe INVB0987678000090000.BAT.exe PID 1960 wrote to memory of 2752 1960 INVB0987678000090000.BAT.exe INVB0987678000090000.BAT.exe PID 1960 wrote to memory of 2752 1960 INVB0987678000090000.BAT.exe INVB0987678000090000.BAT.exe PID 1960 wrote to memory of 2752 1960 INVB0987678000090000.BAT.exe INVB0987678000090000.BAT.exe PID 1960 wrote to memory of 1920 1960 INVB0987678000090000.BAT.exe INVB0987678000090000.BAT.exe PID 1960 wrote to memory of 1920 1960 INVB0987678000090000.BAT.exe INVB0987678000090000.BAT.exe PID 1960 wrote to memory of 1920 1960 INVB0987678000090000.BAT.exe INVB0987678000090000.BAT.exe PID 1960 wrote to memory of 1920 1960 INVB0987678000090000.BAT.exe INVB0987678000090000.BAT.exe PID 1960 wrote to memory of 1920 1960 INVB0987678000090000.BAT.exe INVB0987678000090000.BAT.exe PID 1960 wrote to memory of 1920 1960 INVB0987678000090000.BAT.exe INVB0987678000090000.BAT.exe PID 1960 wrote to memory of 1920 1960 INVB0987678000090000.BAT.exe INVB0987678000090000.BAT.exe PID 1960 wrote to memory of 1920 1960 INVB0987678000090000.BAT.exe INVB0987678000090000.BAT.exe PID 1960 wrote to memory of 1920 1960 INVB0987678000090000.BAT.exe INVB0987678000090000.BAT.exe PID 1960 wrote to memory of 1920 1960 INVB0987678000090000.BAT.exe INVB0987678000090000.BAT.exe PID 1960 wrote to memory of 1920 1960 INVB0987678000090000.BAT.exe INVB0987678000090000.BAT.exe PID 1960 wrote to memory of 1920 1960 INVB0987678000090000.BAT.exe INVB0987678000090000.BAT.exe PID 1960 wrote to memory of 1920 1960 INVB0987678000090000.BAT.exe INVB0987678000090000.BAT.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\INVB0987678000090000.BAT.exe"C:\Users\Admin\AppData\Local\Temp\INVB0987678000090000.BAT.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\INVB0987678000090000.BAT.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1344 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\okDinu.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2596 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\okDinu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp41A2.tmp"2⤵
- Creates scheduled task(s)
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\INVB0987678000090000.BAT.exe"C:\Users\Admin\AppData\Local\Temp\INVB0987678000090000.BAT.exe"2⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\INVB0987678000090000.BAT.exe"C:\Users\Admin\AppData\Local\Temp\INVB0987678000090000.BAT.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:1920
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD543d697747400cc6374b12573cd50a0bb
SHA12a7ba817cc52d279732c91cffb3fb3842fe2ff77
SHA2565658aa4576570bc66277ecedacd7c1cb766d21a48dfe4ff40119264d5d2adef6
SHA5129063fabcf70bdd6b12acd8a7d138f10566f386c99f1601bbb736ec32cbf44047936fce306489f73ee0213be7799db9408ddf9f093e758e4448d938a1192f94cd
-
Filesize
1KB
MD5adf89e7c89292c3e670754824691fded
SHA169b7dddeaae0c179a9ac741c9b8fa07bf317bf9d
SHA256d80dd99e3089724632a3d18e360a309676b20698c61d738d30eb89cb9be45172
SHA51267809d24f8a636c12790407c1f2a5c2855b888e256edcf642b6567e17110c5a9987d37550e303d2726d2e06bd0e0943336212af0d07e5f2b7848d558064be49a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DGU36CUU83B8MVTI1QMD.temp
Filesize7KB
MD59221182824cd1e7ee6407571d6e34c21
SHA1f03d885f8e813138933de1b8644ee95f05f2b23e
SHA2569cd17ab8d278973af682eeb185be6e267a04bb006bb419bb2380e8d6a8ffd53b
SHA5120e680100dc9beaee4554c6e10c52bd072193333d9723ac8d408e39db340c54f8219ba5f8656f9ba6a01fb39d9f3327af476574361ec8aa8d3e4f740241f59465