Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
15/02/2024, 12:57
Static task
static1
Behavioral task
behavioral1
Sample
x.exe
Resource
win7-20231215-en
General
-
Target
x.exe
-
Size
1.1MB
-
MD5
82c03d76128f5d265a08c4ef25253a77
-
SHA1
a5574eab34c1d0a7369ccaf170049abf5b182757
-
SHA256
6199a5b279106eeee9057da8cf8f8e082431020ed4ae896afda6b1e161ee05c1
-
SHA512
e58cf49c764e4d0a7a471eb1f14258ba9145edd6a7ff03094f41a0ad4ee2669367506f284d8682bb13abe5ab35488843c875506b0bc643831bf3bd733efb4661
-
SSDEEP
24576:AqgA++KlhfcLHUip/TvCkV0uf5ZmH1OvrpPwCwb:AdxpsvCkCua1Opo
Malware Config
Extracted
remcos
QHost
172.245.208.5:2060
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-2OLA39
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1648 set thread context of 2628 1648 x.exe 30 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1648 x.exe 1648 x.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1648 x.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2628 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1648 wrote to memory of 2628 1648 x.exe 30 PID 1648 wrote to memory of 2628 1648 x.exe 30 PID 1648 wrote to memory of 2628 1648 x.exe 30 PID 1648 wrote to memory of 2628 1648 x.exe 30 PID 1648 wrote to memory of 2628 1648 x.exe 30 PID 1648 wrote to memory of 2628 1648 x.exe 30 PID 1648 wrote to memory of 2628 1648 x.exe 30 PID 1648 wrote to memory of 2628 1648 x.exe 30 PID 1648 wrote to memory of 2628 1648 x.exe 30 PID 1648 wrote to memory of 2628 1648 x.exe 30 PID 1648 wrote to memory of 2628 1648 x.exe 30 PID 1648 wrote to memory of 2628 1648 x.exe 30 PID 1648 wrote to memory of 2628 1648 x.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\x.exe"C:\Users\Admin\AppData\Local\Temp\x.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:2628
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5fa7f103b92c87ba168bb914339278612
SHA1fc8d07711a248b05e886c92ce09832bf164b2573
SHA256bae853b306917b4c497a94ab0a8818e125063b7cfed70820a34a1686001524e7
SHA5126c29fb52a07bae802a8e5ece944d63e9d809d9a63df52c91f47d74000a4f16200402181738c5ca44110189ecb5cf470d04ea84a62684bb2e70fe26f1996a348f