Analysis
-
max time kernel
147s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
15/02/2024, 12:57
Static task
static1
Behavioral task
behavioral1
Sample
x.exe
Resource
win7-20231215-en
General
-
Target
x.exe
-
Size
1.1MB
-
MD5
82c03d76128f5d265a08c4ef25253a77
-
SHA1
a5574eab34c1d0a7369ccaf170049abf5b182757
-
SHA256
6199a5b279106eeee9057da8cf8f8e082431020ed4ae896afda6b1e161ee05c1
-
SHA512
e58cf49c764e4d0a7a471eb1f14258ba9145edd6a7ff03094f41a0ad4ee2669367506f284d8682bb13abe5ab35488843c875506b0bc643831bf3bd733efb4661
-
SSDEEP
24576:AqgA++KlhfcLHUip/TvCkV0uf5ZmH1OvrpPwCwb:AdxpsvCkCua1Opo
Malware Config
Extracted
remcos
QHost
172.245.208.5:2060
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-2OLA39
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4032 set thread context of 4160 4032 x.exe 93 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4032 x.exe 4032 x.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4032 x.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4160 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4032 wrote to memory of 4160 4032 x.exe 93 PID 4032 wrote to memory of 4160 4032 x.exe 93 PID 4032 wrote to memory of 4160 4032 x.exe 93 PID 4032 wrote to memory of 4160 4032 x.exe 93 PID 4032 wrote to memory of 4160 4032 x.exe 93 PID 4032 wrote to memory of 4160 4032 x.exe 93 PID 4032 wrote to memory of 4160 4032 x.exe 93 PID 4032 wrote to memory of 4160 4032 x.exe 93 PID 4032 wrote to memory of 4160 4032 x.exe 93 PID 4032 wrote to memory of 4160 4032 x.exe 93 PID 4032 wrote to memory of 4160 4032 x.exe 93 PID 4032 wrote to memory of 4160 4032 x.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\x.exe"C:\Users\Admin\AppData\Local\Temp\x.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:4160
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5d6b1e7c977e14ec8808dae3453bf4c90
SHA1cf92a1ff2a16b0440d7d53ccedb4d3da3b6d2643
SHA256522b092a03b6faba861e030d27f3b66b2ad81b119cf97b7551b4acebe312cffd
SHA5128a98e3196b75a52b42014d132eda989a8f60a854946147f925e6d41c2dc24a308316e77ccedcad7cf627934b848bd84f21ce730f4358073320b39995b0f6faf5