Analysis
-
max time kernel
124s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2023 19:13
Behavioral task
behavioral1
Sample
016153c37340d7dd4d45563208a25928.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
016153c37340d7dd4d45563208a25928.exe
Resource
win10v2004-20231215-en
General
-
Target
016153c37340d7dd4d45563208a25928.exe
-
Size
420KB
-
MD5
016153c37340d7dd4d45563208a25928
-
SHA1
591f8da7ede0f741c04ec18348999e7a39e96183
-
SHA256
f41fc6480ca831a072c88d512b3ca96264c7d8652d30224b2f88465139dc8319
-
SHA512
bdd7af6d07f38eae6e7500ac6d6d5175889e82a4d515025d6899049b1d56f46196d8a418e2b82a94865c7236a44e78f29af551548810f07fba1b6afce30e830f
-
SSDEEP
6144:49g5p/aJJL7XJAnY7jioSgBK0Ru115xTcYeEknZJJAVAel:4gUJHX+nOjhBq1j2AWK
Malware Config
Extracted
remcos
2.5.0 Pro
Buddy
eastsidepapi.myq-see.com:6996
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
Buddy.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Buddy-PVO134
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Buddy
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
ftermgr.exeftermgr.exepid process 1980 ftermgr.exe 3876 ftermgr.exe -
Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/1756-2-0x0000000004C30000-0x0000000004C46000-memory.dmp agile_net behavioral2/memory/1980-44-0x00000000015B0000-0x00000000015C6000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\progmfil = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Local\\ftermgr.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ftermgr.exedescription pid process target process PID 1980 set thread context of 3876 1980 ftermgr.exe ftermgr.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1504 1980 WerFault.exe ftermgr.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
016153c37340d7dd4d45563208a25928.exepowershell.exeftermgr.exepid process 1756 016153c37340d7dd4d45563208a25928.exe 1756 016153c37340d7dd4d45563208a25928.exe 1756 016153c37340d7dd4d45563208a25928.exe 1756 016153c37340d7dd4d45563208a25928.exe 1756 016153c37340d7dd4d45563208a25928.exe 1756 016153c37340d7dd4d45563208a25928.exe 1756 016153c37340d7dd4d45563208a25928.exe 1756 016153c37340d7dd4d45563208a25928.exe 1756 016153c37340d7dd4d45563208a25928.exe 1756 016153c37340d7dd4d45563208a25928.exe 1756 016153c37340d7dd4d45563208a25928.exe 1756 016153c37340d7dd4d45563208a25928.exe 1756 016153c37340d7dd4d45563208a25928.exe 1756 016153c37340d7dd4d45563208a25928.exe 1756 016153c37340d7dd4d45563208a25928.exe 1756 016153c37340d7dd4d45563208a25928.exe 1756 016153c37340d7dd4d45563208a25928.exe 1756 016153c37340d7dd4d45563208a25928.exe 1756 016153c37340d7dd4d45563208a25928.exe 1756 016153c37340d7dd4d45563208a25928.exe 1756 016153c37340d7dd4d45563208a25928.exe 1756 016153c37340d7dd4d45563208a25928.exe 1756 016153c37340d7dd4d45563208a25928.exe 1756 016153c37340d7dd4d45563208a25928.exe 1756 016153c37340d7dd4d45563208a25928.exe 316 powershell.exe 316 powershell.exe 316 powershell.exe 1980 ftermgr.exe 1980 ftermgr.exe 1980 ftermgr.exe 1980 ftermgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
016153c37340d7dd4d45563208a25928.exepowershell.exeftermgr.exedescription pid process Token: SeDebugPrivilege 1756 016153c37340d7dd4d45563208a25928.exe Token: SeDebugPrivilege 316 powershell.exe Token: SeDebugPrivilege 1980 ftermgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ftermgr.exepid process 3876 ftermgr.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
016153c37340d7dd4d45563208a25928.execmd.exepowershell.exeftermgr.exedescription pid process target process PID 1756 wrote to memory of 2064 1756 016153c37340d7dd4d45563208a25928.exe cmd.exe PID 1756 wrote to memory of 2064 1756 016153c37340d7dd4d45563208a25928.exe cmd.exe PID 1756 wrote to memory of 2064 1756 016153c37340d7dd4d45563208a25928.exe cmd.exe PID 2064 wrote to memory of 4632 2064 cmd.exe reg.exe PID 2064 wrote to memory of 4632 2064 cmd.exe reg.exe PID 2064 wrote to memory of 4632 2064 cmd.exe reg.exe PID 1756 wrote to memory of 316 1756 016153c37340d7dd4d45563208a25928.exe powershell.exe PID 1756 wrote to memory of 316 1756 016153c37340d7dd4d45563208a25928.exe powershell.exe PID 1756 wrote to memory of 316 1756 016153c37340d7dd4d45563208a25928.exe powershell.exe PID 316 wrote to memory of 1980 316 powershell.exe ftermgr.exe PID 316 wrote to memory of 1980 316 powershell.exe ftermgr.exe PID 316 wrote to memory of 1980 316 powershell.exe ftermgr.exe PID 1980 wrote to memory of 3876 1980 ftermgr.exe ftermgr.exe PID 1980 wrote to memory of 3876 1980 ftermgr.exe ftermgr.exe PID 1980 wrote to memory of 3876 1980 ftermgr.exe ftermgr.exe PID 1980 wrote to memory of 3876 1980 ftermgr.exe ftermgr.exe PID 1980 wrote to memory of 3876 1980 ftermgr.exe ftermgr.exe PID 1980 wrote to memory of 3876 1980 ftermgr.exe ftermgr.exe PID 1980 wrote to memory of 3876 1980 ftermgr.exe ftermgr.exe PID 1980 wrote to memory of 3876 1980 ftermgr.exe ftermgr.exe PID 1980 wrote to memory of 3876 1980 ftermgr.exe ftermgr.exe PID 1980 wrote to memory of 3876 1980 ftermgr.exe ftermgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\016153c37340d7dd4d45563208a25928.exe"C:\Users\Admin\AppData\Local\Temp\016153c37340d7dd4d45563208a25928.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v progmfil /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Local\ftermgr.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v progmfil /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Local\ftermgr.exe"3⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process C:\Users\Admin\AppData\Local\ftermgr.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ftermgr.exe"C:\Users\Admin\AppData\Local\ftermgr.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ftermgr.exe"C:\Users\Admin\AppData\Local\ftermgr.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 14764⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1980 -ip 19801⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\ftermgr.exeFilesize
93KB
MD57e398f9078b2f33bda48e36634d49d5b
SHA1ca07f5c07b1472cf017fdc582b9286d2f5c3cc73
SHA25656b7e72a895392d55e3647aec2c7549ac59a42a4580b5c3781158fc7544cc337
SHA5128333259e4b92544d2e7f7a66dc00bf6965060f49bb09979a946591c9e9342ec91ef107b9e020427b248541dbf0d1d1a57594dc2dd443a60109c05a8d0483deaa
-
C:\Users\Admin\AppData\Local\ftermgr.exeFilesize
97KB
MD573b727dcb2e1d1b9763874a219821a17
SHA16245e0ccaff92e8a15064599bc5cefd91d037e39
SHA2563df3e4fa874c92e57a8113e3ff05b8c48ed641a99486864c7e0c5dd2429bc266
SHA512883bffdc611f07c8c9ae4feb7409ecb3d5fa764c9632ca53918b7180bf0d114cc3d199b4fce375fd995f164ae5e42167fc59ce85c61a4ee6566bdf3feab9fe64
-
C:\Users\Admin\AppData\Local\ftermgr.exeFilesize
420KB
MD5016153c37340d7dd4d45563208a25928
SHA1591f8da7ede0f741c04ec18348999e7a39e96183
SHA256f41fc6480ca831a072c88d512b3ca96264c7d8652d30224b2f88465139dc8319
SHA512bdd7af6d07f38eae6e7500ac6d6d5175889e82a4d515025d6899049b1d56f46196d8a418e2b82a94865c7236a44e78f29af551548810f07fba1b6afce30e830f
-
memory/316-36-0x00000000066F0000-0x000000000673C000-memory.dmpFilesize
304KB
-
memory/316-34-0x0000000006190000-0x00000000064E4000-memory.dmpFilesize
3.3MB
-
memory/316-38-0x0000000006B40000-0x0000000006B5A000-memory.dmpFilesize
104KB
-
memory/316-39-0x0000000007620000-0x0000000007642000-memory.dmpFilesize
136KB
-
memory/316-37-0x0000000006BB0000-0x0000000006C46000-memory.dmpFilesize
600KB
-
memory/316-20-0x0000000005820000-0x0000000005E48000-memory.dmpFilesize
6.2MB
-
memory/316-35-0x0000000006650000-0x000000000666E000-memory.dmpFilesize
120KB
-
memory/316-47-0x0000000075330000-0x0000000075AE0000-memory.dmpFilesize
7.7MB
-
memory/316-23-0x0000000005EC0000-0x0000000005F26000-memory.dmpFilesize
408KB
-
memory/316-24-0x0000000006020000-0x0000000006086000-memory.dmpFilesize
408KB
-
memory/316-22-0x0000000005690000-0x00000000056B2000-memory.dmpFilesize
136KB
-
memory/316-19-0x0000000002E10000-0x0000000002E20000-memory.dmpFilesize
64KB
-
memory/316-16-0x0000000002D30000-0x0000000002D66000-memory.dmpFilesize
216KB
-
memory/316-18-0x0000000075330000-0x0000000075AE0000-memory.dmpFilesize
7.7MB
-
memory/316-21-0x0000000002E10000-0x0000000002E20000-memory.dmpFilesize
64KB
-
memory/1756-12-0x0000000005640000-0x0000000005648000-memory.dmpFilesize
32KB
-
memory/1756-2-0x0000000004C30000-0x0000000004C46000-memory.dmpFilesize
88KB
-
memory/1756-13-0x0000000004D10000-0x0000000004D20000-memory.dmpFilesize
64KB
-
memory/1756-1-0x0000000075330000-0x0000000075AE0000-memory.dmpFilesize
7.7MB
-
memory/1756-11-0x0000000004D10000-0x0000000004D20000-memory.dmpFilesize
64KB
-
memory/1756-10-0x0000000005960000-0x00000000059A4000-memory.dmpFilesize
272KB
-
memory/1756-9-0x0000000004D10000-0x0000000004D20000-memory.dmpFilesize
64KB
-
memory/1756-7-0x00000000055D0000-0x00000000055D8000-memory.dmpFilesize
32KB
-
memory/1756-8-0x0000000075330000-0x0000000075AE0000-memory.dmpFilesize
7.7MB
-
memory/1756-6-0x00000000054B0000-0x0000000005542000-memory.dmpFilesize
584KB
-
memory/1756-5-0x0000000005280000-0x0000000005288000-memory.dmpFilesize
32KB
-
memory/1756-4-0x00000000059C0000-0x0000000005F64000-memory.dmpFilesize
5.6MB
-
memory/1756-3-0x0000000004D10000-0x0000000004D20000-memory.dmpFilesize
64KB
-
memory/1756-0-0x00000000002F0000-0x0000000000360000-memory.dmpFilesize
448KB
-
memory/1756-17-0x0000000075330000-0x0000000075AE0000-memory.dmpFilesize
7.7MB
-
memory/1980-52-0x0000000001610000-0x0000000001620000-memory.dmpFilesize
64KB
-
memory/1980-44-0x00000000015B0000-0x00000000015C6000-memory.dmpFilesize
88KB
-
memory/1980-48-0x0000000001610000-0x0000000001620000-memory.dmpFilesize
64KB
-
memory/1980-49-0x0000000075330000-0x0000000075AE0000-memory.dmpFilesize
7.7MB
-
memory/1980-50-0x0000000001610000-0x0000000001620000-memory.dmpFilesize
64KB
-
memory/1980-51-0x0000000005E70000-0x0000000005E7A000-memory.dmpFilesize
40KB
-
memory/1980-46-0x0000000001610000-0x0000000001620000-memory.dmpFilesize
64KB
-
memory/1980-61-0x0000000075330000-0x0000000075AE0000-memory.dmpFilesize
7.7MB
-
memory/1980-45-0x0000000075330000-0x0000000075AE0000-memory.dmpFilesize
7.7MB
-
memory/3876-57-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3876-59-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3876-60-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3876-56-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3876-53-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3876-64-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB