Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25-03-2024 19:10
Static task
static1
Behavioral task
behavioral1
Sample
HUD34EDRFQ253.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
HUD34EDRFQ253.exe
Resource
win10v2004-20240226-en
General
-
Target
HUD34EDRFQ253.exe
-
Size
998KB
-
MD5
9a942028f55f59560c38677923c7ce6a
-
SHA1
069cf2b7306f61ac65a4598f519a83dd535325c9
-
SHA256
5755305654c07b239c370661598bc698f8113b41fe5785e0e13098a66cdbd4eb
-
SHA512
e3f0f2d9d97cfa7178d3fd1e12cd35c9b1a5b08e92767389bcf998e428e08e4527fa7b9204941e849a6f28c240c52c57b653777e7620210c5d024dbce0a22eda
-
SSDEEP
24576:yxWTl+NDnZjbBxcxyGFKjL8kFzzjBh3HrYMY:lpknZHEyGw3t3cz
Malware Config
Extracted
remcos
RemoteHost
194.147.140.180:1987
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-FRNTO2
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation HUD34EDRFQ253.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2884 set thread context of 4828 2884 HUD34EDRFQ253.exe 103 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3624 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2884 HUD34EDRFQ253.exe 3928 powershell.exe 3928 powershell.exe 228 powershell.exe 228 powershell.exe 2884 HUD34EDRFQ253.exe 2884 HUD34EDRFQ253.exe 3928 powershell.exe 228 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2884 HUD34EDRFQ253.exe Token: SeDebugPrivilege 228 powershell.exe Token: SeDebugPrivilege 3928 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4828 HUD34EDRFQ253.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2884 wrote to memory of 228 2884 HUD34EDRFQ253.exe 97 PID 2884 wrote to memory of 228 2884 HUD34EDRFQ253.exe 97 PID 2884 wrote to memory of 228 2884 HUD34EDRFQ253.exe 97 PID 2884 wrote to memory of 3928 2884 HUD34EDRFQ253.exe 99 PID 2884 wrote to memory of 3928 2884 HUD34EDRFQ253.exe 99 PID 2884 wrote to memory of 3928 2884 HUD34EDRFQ253.exe 99 PID 2884 wrote to memory of 3624 2884 HUD34EDRFQ253.exe 101 PID 2884 wrote to memory of 3624 2884 HUD34EDRFQ253.exe 101 PID 2884 wrote to memory of 3624 2884 HUD34EDRFQ253.exe 101 PID 2884 wrote to memory of 4828 2884 HUD34EDRFQ253.exe 103 PID 2884 wrote to memory of 4828 2884 HUD34EDRFQ253.exe 103 PID 2884 wrote to memory of 4828 2884 HUD34EDRFQ253.exe 103 PID 2884 wrote to memory of 4828 2884 HUD34EDRFQ253.exe 103 PID 2884 wrote to memory of 4828 2884 HUD34EDRFQ253.exe 103 PID 2884 wrote to memory of 4828 2884 HUD34EDRFQ253.exe 103 PID 2884 wrote to memory of 4828 2884 HUD34EDRFQ253.exe 103 PID 2884 wrote to memory of 4828 2884 HUD34EDRFQ253.exe 103 PID 2884 wrote to memory of 4828 2884 HUD34EDRFQ253.exe 103 PID 2884 wrote to memory of 4828 2884 HUD34EDRFQ253.exe 103 PID 2884 wrote to memory of 4828 2884 HUD34EDRFQ253.exe 103 PID 2884 wrote to memory of 4828 2884 HUD34EDRFQ253.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\HUD34EDRFQ253.exe"C:\Users\Admin\AppData\Local\Temp\HUD34EDRFQ253.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\HUD34EDRFQ253.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:228
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XPTpFDOlta.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3928
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XPTpFDOlta" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8CA0.tmp"2⤵
- Creates scheduled task(s)
PID:3624
-
-
C:\Users\Admin\AppData\Local\Temp\HUD34EDRFQ253.exe"C:\Users\Admin\AppData\Local\Temp\HUD34EDRFQ253.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:4828
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD555918fcb08480f5745dda9c88843327d
SHA18f30ca19e0e7d21026b8e309558b19934fe5249d
SHA2568a9a437f9c21bb1a44632abe99d8e0455f032ac5199dace1808cde8952ea03f4
SHA51215d0c8d44523c95a403c0bc95a9f14b473fcc6570d6cc40aa45843ed92e95924eddb3e47e147f9a77970a323e08007084405f8a4d18f8d730ac6388a856be046
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD598cbf34a8e0b3d1d63cde5792baa1e4f
SHA1229a615db77c6497560726fce34c6d132d1291a3
SHA2566e7f3aab52fba5288defb2e82d91caf8a6317aa9dabb7d82be1edd2cbb92bbf8
SHA5128e20b9cacc9599ccf21111c2b64c4842bb4c42445c93c023d88000a3d87afd08dcd36cad929e1be1271b483b8530a4b2e3211b24b8ac86440bf6dea898ca1ea2
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD520b7cea3861996e11496924c8e136475
SHA174498fc7e252587a4e2f58a091c91e67ab3b8a2d
SHA256ac47b4e2cd894b2f4f3c68442ddc9998ce533b176f0ae329a3688f7ae9f4549a
SHA512eca8db1fe24a5dc793907452006a8e4fcfa29d9d953adb49bb626d0b22bd7700fb8c2b9df42c3c78ad4b995d827c5e702f88030d1b9d316484ecf96a962bbca6