Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
15/02/2024, 11:03
Static task
static1
Behavioral task
behavioral1
Sample
PO-2143224.exe
Resource
win7-20231215-en
General
-
Target
PO-2143224.exe
-
Size
865KB
-
MD5
d90d929eed0b2f19a2dfc97207e4f1ed
-
SHA1
abb561c141dab098b5d28f8d98fb290820b0f1a6
-
SHA256
688e1a87b049676464e3aa5303d9a48f184da32c3fdfa0c092e1744153e761b0
-
SHA512
6f463e82d2b3cba431bf6a7d7ef52075b52e694ba96599d66fd98564e9de0395f7237504acba82c7f2ff2c95dda366de3b53d02191dc12bde3134b9dd369d784
-
SSDEEP
24576:BNP+nbEexncWPdhCCKlhOr8c/eQMNYCi0M:mbEqncAC1ieQMNYC
Malware Config
Extracted
remcos
DESK
198.27.121.194:2024
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-EQJXDT
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/1004-125-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView behavioral2/memory/1004-128-0x0000000000400000-0x0000000000457000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/3964-120-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView behavioral2/memory/3964-133-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Nirsoft 6 IoCs
resource yara_rule behavioral2/memory/3964-120-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral2/memory/1004-125-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral2/memory/1392-130-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/1392-131-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral2/memory/1004-128-0x0000000000400000-0x0000000000457000-memory.dmp Nirsoft behavioral2/memory/3964-133-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation PO-2143224.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts PO-2143224.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 116 set thread context of 3160 116 PO-2143224.exe 100 PID 3160 set thread context of 3964 3160 PO-2143224.exe 105 PID 3160 set thread context of 1004 3160 PO-2143224.exe 104 PID 3160 set thread context of 1392 3160 PO-2143224.exe 102 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2176 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 116 PO-2143224.exe 116 PO-2143224.exe 116 PO-2143224.exe 116 PO-2143224.exe 116 PO-2143224.exe 116 PO-2143224.exe 116 PO-2143224.exe 116 PO-2143224.exe 116 PO-2143224.exe 116 PO-2143224.exe 116 PO-2143224.exe 116 PO-2143224.exe 116 PO-2143224.exe 116 PO-2143224.exe 116 PO-2143224.exe 3176 powershell.exe 2912 powershell.exe 116 PO-2143224.exe 3176 powershell.exe 2912 powershell.exe 3964 PO-2143224.exe 3964 PO-2143224.exe 1392 PO-2143224.exe 1392 PO-2143224.exe 3964 PO-2143224.exe 3964 PO-2143224.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
pid Process 3160 PO-2143224.exe 3160 PO-2143224.exe 3160 PO-2143224.exe 3160 PO-2143224.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 116 PO-2143224.exe Token: SeDebugPrivilege 2912 powershell.exe Token: SeDebugPrivilege 3176 powershell.exe Token: SeDebugPrivilege 1392 PO-2143224.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3160 PO-2143224.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3160 PO-2143224.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 116 wrote to memory of 2912 116 PO-2143224.exe 98 PID 116 wrote to memory of 2912 116 PO-2143224.exe 98 PID 116 wrote to memory of 2912 116 PO-2143224.exe 98 PID 116 wrote to memory of 3176 116 PO-2143224.exe 97 PID 116 wrote to memory of 3176 116 PO-2143224.exe 97 PID 116 wrote to memory of 3176 116 PO-2143224.exe 97 PID 116 wrote to memory of 2176 116 PO-2143224.exe 96 PID 116 wrote to memory of 2176 116 PO-2143224.exe 96 PID 116 wrote to memory of 2176 116 PO-2143224.exe 96 PID 116 wrote to memory of 3160 116 PO-2143224.exe 100 PID 116 wrote to memory of 3160 116 PO-2143224.exe 100 PID 116 wrote to memory of 3160 116 PO-2143224.exe 100 PID 116 wrote to memory of 3160 116 PO-2143224.exe 100 PID 116 wrote to memory of 3160 116 PO-2143224.exe 100 PID 116 wrote to memory of 3160 116 PO-2143224.exe 100 PID 116 wrote to memory of 3160 116 PO-2143224.exe 100 PID 116 wrote to memory of 3160 116 PO-2143224.exe 100 PID 116 wrote to memory of 3160 116 PO-2143224.exe 100 PID 116 wrote to memory of 3160 116 PO-2143224.exe 100 PID 116 wrote to memory of 3160 116 PO-2143224.exe 100 PID 116 wrote to memory of 3160 116 PO-2143224.exe 100 PID 3160 wrote to memory of 3964 3160 PO-2143224.exe 105 PID 3160 wrote to memory of 3964 3160 PO-2143224.exe 105 PID 3160 wrote to memory of 3964 3160 PO-2143224.exe 105 PID 3160 wrote to memory of 3964 3160 PO-2143224.exe 105 PID 3160 wrote to memory of 1004 3160 PO-2143224.exe 104 PID 3160 wrote to memory of 1004 3160 PO-2143224.exe 104 PID 3160 wrote to memory of 1004 3160 PO-2143224.exe 104 PID 3160 wrote to memory of 1004 3160 PO-2143224.exe 104 PID 3160 wrote to memory of 4940 3160 PO-2143224.exe 103 PID 3160 wrote to memory of 4940 3160 PO-2143224.exe 103 PID 3160 wrote to memory of 4940 3160 PO-2143224.exe 103 PID 3160 wrote to memory of 1392 3160 PO-2143224.exe 102 PID 3160 wrote to memory of 1392 3160 PO-2143224.exe 102 PID 3160 wrote to memory of 1392 3160 PO-2143224.exe 102 PID 3160 wrote to memory of 1392 3160 PO-2143224.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO-2143224.exe"C:\Users\Admin\AppData\Local\Temp\PO-2143224.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TQbZIZmgTPXQc" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD755.tmp"2⤵
- Creates scheduled task(s)
PID:2176
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TQbZIZmgTPXQc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3176
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO-2143224.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2912
-
-
C:\Users\Admin\AppData\Local\Temp\PO-2143224.exe"C:\Users\Admin\AppData\Local\Temp\PO-2143224.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\PO-2143224.exeC:\Users\Admin\AppData\Local\Temp\PO-2143224.exe /stext "C:\Users\Admin\AppData\Local\Temp\onpzlviky"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1392
-
-
C:\Users\Admin\AppData\Local\Temp\PO-2143224.exeC:\Users\Admin\AppData\Local\Temp\PO-2143224.exe /stext "C:\Users\Admin\AppData\Local\Temp\onpzlviky"3⤵PID:4940
-
-
C:\Users\Admin\AppData\Local\Temp\PO-2143224.exeC:\Users\Admin\AppData\Local\Temp\PO-2143224.exe /stext "C:\Users\Admin\AppData\Local\Temp\etchk"3⤵
- Accesses Microsoft Outlook accounts
PID:1004
-
-
C:\Users\Admin\AppData\Local\Temp\PO-2143224.exeC:\Users\Admin\AppData\Local\Temp\PO-2143224.exe /stext "C:\Users\Admin\AppData\Local\Temp\urxokknposotwvfagmgjvysyxhegppaqu"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3964
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD580d28c22297c5bc2b1f6986fc15ba7a6
SHA132ec74aa9d6cd55f1db1394d70a2cf9ebf0e66be
SHA2560e29b9822e07272b13f9fc7ef165e9530f3ee243f0234996600909a659d219bd
SHA512bee2a1ae8b8a4c4a97001fc143750b652a727a987695fb1e766c3ad993dbb974509d8ece722156c7b9341cc942cb1a920580a78f2637707e0f605a98bb7f0581
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD594e27db60ec9db4a0aa5fb5dce813752
SHA1a9d549f00a3fd73acd300abe1889849528a4605c
SHA256c4ebf6fcc047faef8a7d023cefcc4696936649fbfd9037854abb2a635646c362
SHA512f1a1c0a328773065664c39f9609cb938c8351bb978560b5e53769fae833ec9e9c9951e65acd6ddc4ab8f5ec2228026dc1be8725a02c84373a8e761572ae9db6d
-
Filesize
4KB
MD59d1c4331e92ea47959e79f26ca09d973
SHA1f8baa65953243feba3299fbaa7af110fbc7011b2
SHA256ffddf68859952ecc2a486189ef0b15519f898d4d1ba04f6555264714b2d9108f
SHA51276cc4cfa6a89d69035c0539294a5903f5b9b01314aaa2ffef7ccc6a5cdc163bf2336fa98e6f5406510b74c8da8bf5cbac5c55718df58f3b082b7fe8f8dda3daf