Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
18-01-2024 07:42
Static task
static1
Behavioral task
behavioral1
Sample
PO202401801051.exe
Resource
win7-20231215-en
General
-
Target
PO202401801051.exe
-
Size
1.0MB
-
MD5
50e9548618ccce67deaf3f951ecef7da
-
SHA1
fa20bc02a463af399f303c6428613831d61c523f
-
SHA256
e2f632e9340f947772953c62fd2208e047574414f7a0eacccd4e309f7dbf0b8f
-
SHA512
441f61207114a9aaa2b0fede9b29904b49fe07b01b49a10e65a5c5dfdac74e4bb0d27372d21554d5910a21ed5e426a5ab427c43de863ace58a7762560509b420
-
SSDEEP
24576:KtJB0/+aczENCjmCooe9KhhdvYo771uMn4NwRH1k254cUP9n8Vc:K1gqEALje9KhPntHDRVpGcUFn+
Malware Config
Extracted
remcos
24
162.218.122.24:5707
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-A49MY7
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral2/memory/2916-3-0x0000000005620000-0x00000000056F8000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-15-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-27-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-37-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-39-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-41-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-47-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-57-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-67-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-65-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-63-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-61-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-59-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-55-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-53-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-51-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-49-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-45-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-43-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-35-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-33-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-31-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-29-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-25-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-23-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-21-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-19-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-17-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-13-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-11-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-9-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-7-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-5-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 behavioral2/memory/2916-4-0x0000000005620000-0x00000000056F2000-memory.dmp family_zgrat_v1 -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/4560-964-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/4560-973-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4560-964-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/2368-970-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/2368-971-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/4560-973-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
PO202401801051.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Korxcbivy = "C:\\Users\\Admin\\AppData\\Roaming\\Korxcbivy.exe" PO202401801051.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
PO202401801051.exePO202401801051.exedescription pid process target process PID 2916 set thread context of 2856 2916 PO202401801051.exe PO202401801051.exe PID 2856 set thread context of 4560 2856 PO202401801051.exe PO202401801051.exe PID 2856 set thread context of 3864 2856 PO202401801051.exe PO202401801051.exe PID 2856 set thread context of 2368 2856 PO202401801051.exe PO202401801051.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4028 3864 WerFault.exe PO202401801051.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
PO202401801051.exePO202401801051.exepid process 4560 PO202401801051.exe 4560 PO202401801051.exe 2368 PO202401801051.exe 2368 PO202401801051.exe 4560 PO202401801051.exe 4560 PO202401801051.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
PO202401801051.exepid process 2856 PO202401801051.exe 2856 PO202401801051.exe 2856 PO202401801051.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO202401801051.exePO202401801051.exedescription pid process Token: SeDebugPrivilege 2916 PO202401801051.exe Token: SeDebugPrivilege 2368 PO202401801051.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
PO202401801051.exepid process 3864 PO202401801051.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
PO202401801051.exePO202401801051.exedescription pid process target process PID 2916 wrote to memory of 2856 2916 PO202401801051.exe PO202401801051.exe PID 2916 wrote to memory of 2856 2916 PO202401801051.exe PO202401801051.exe PID 2916 wrote to memory of 2856 2916 PO202401801051.exe PO202401801051.exe PID 2916 wrote to memory of 2856 2916 PO202401801051.exe PO202401801051.exe PID 2916 wrote to memory of 2856 2916 PO202401801051.exe PO202401801051.exe PID 2916 wrote to memory of 2856 2916 PO202401801051.exe PO202401801051.exe PID 2916 wrote to memory of 2856 2916 PO202401801051.exe PO202401801051.exe PID 2916 wrote to memory of 2856 2916 PO202401801051.exe PO202401801051.exe PID 2916 wrote to memory of 2856 2916 PO202401801051.exe PO202401801051.exe PID 2916 wrote to memory of 2856 2916 PO202401801051.exe PO202401801051.exe PID 2916 wrote to memory of 2856 2916 PO202401801051.exe PO202401801051.exe PID 2916 wrote to memory of 2856 2916 PO202401801051.exe PO202401801051.exe PID 2856 wrote to memory of 4560 2856 PO202401801051.exe PO202401801051.exe PID 2856 wrote to memory of 4560 2856 PO202401801051.exe PO202401801051.exe PID 2856 wrote to memory of 4560 2856 PO202401801051.exe PO202401801051.exe PID 2856 wrote to memory of 4560 2856 PO202401801051.exe PO202401801051.exe PID 2856 wrote to memory of 3864 2856 PO202401801051.exe PO202401801051.exe PID 2856 wrote to memory of 3864 2856 PO202401801051.exe PO202401801051.exe PID 2856 wrote to memory of 3864 2856 PO202401801051.exe PO202401801051.exe PID 2856 wrote to memory of 3864 2856 PO202401801051.exe PO202401801051.exe PID 2856 wrote to memory of 2368 2856 PO202401801051.exe PO202401801051.exe PID 2856 wrote to memory of 2368 2856 PO202401801051.exe PO202401801051.exe PID 2856 wrote to memory of 2368 2856 PO202401801051.exe PO202401801051.exe PID 2856 wrote to memory of 2368 2856 PO202401801051.exe PO202401801051.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO202401801051.exe"C:\Users\Admin\AppData\Local\Temp\PO202401801051.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO202401801051.exeC:\Users\Admin\AppData\Local\Temp\PO202401801051.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO202401801051.exeC:\Users\Admin\AppData\Local\Temp\PO202401801051.exe /stext "C:\Users\Admin\AppData\Local\Temp\lvuvreggketflsh"3⤵
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 124⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\PO202401801051.exeC:\Users\Admin\AppData\Local\Temp\PO202401801051.exe /stext "C:\Users\Admin\AppData\Local\Temp\vpzosxraymlkvyvzej"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\PO202401801051.exeC:\Users\Admin\AppData\Local\Temp\PO202401801051.exe /stext "C:\Users\Admin\AppData\Local\Temp\atgdqmweowbs"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3864 -ip 38641⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\atgdqmweowbsFilesize
4KB
MD59d1c4331e92ea47959e79f26ca09d973
SHA1f8baa65953243feba3299fbaa7af110fbc7011b2
SHA256ffddf68859952ecc2a486189ef0b15519f898d4d1ba04f6555264714b2d9108f
SHA51276cc4cfa6a89d69035c0539294a5903f5b9b01314aaa2ffef7ccc6a5cdc163bf2336fa98e6f5406510b74c8da8bf5cbac5c55718df58f3b082b7fe8f8dda3daf
-
memory/2368-970-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2368-971-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/2856-948-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2856-982-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/2856-985-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2916-43-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-31-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-3-0x0000000005620000-0x00000000056F8000-memory.dmpFilesize
864KB
-
memory/2916-15-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-27-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-37-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-39-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-41-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-47-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-57-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-67-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-65-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-63-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-61-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-59-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-55-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-53-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-51-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-49-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-45-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-1-0x0000000075330000-0x0000000075AE0000-memory.dmpFilesize
7.7MB
-
memory/2916-35-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-33-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-2-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/2916-29-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-25-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-23-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-21-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-19-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-17-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-13-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-11-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-9-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-7-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-5-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-4-0x0000000005620000-0x00000000056F2000-memory.dmpFilesize
840KB
-
memory/2916-936-0x0000000005720000-0x0000000005721000-memory.dmpFilesize
4KB
-
memory/2916-938-0x00000000059B0000-0x00000000059FC000-memory.dmpFilesize
304KB
-
memory/2916-937-0x0000000005940000-0x00000000059B0000-memory.dmpFilesize
448KB
-
memory/2916-939-0x0000000075330000-0x0000000075AE0000-memory.dmpFilesize
7.7MB
-
memory/2916-940-0x0000000004C10000-0x0000000004C20000-memory.dmpFilesize
64KB
-
memory/2916-941-0x00000000061A0000-0x0000000006744000-memory.dmpFilesize
5.6MB
-
memory/2916-947-0x0000000075330000-0x0000000075AE0000-memory.dmpFilesize
7.7MB
-
memory/2916-0-0x00000000001E0000-0x00000000002EE000-memory.dmpFilesize
1.1MB
-
memory/4560-964-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB
-
memory/4560-973-0x0000000000400000-0x0000000000478000-memory.dmpFilesize
480KB