Analysis
-
max time kernel
1802s -
max time network
1783s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2024 17:47
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win10v2004-20240226-en
General
-
Target
Quotation.exe
-
Size
1.4MB
-
MD5
b637de26aa293e2d88beb31e09febd46
-
SHA1
a800c3b4defa12246ad3d6b9e70f1aa02e2d7623
-
SHA256
ca52caeb15fde0f171362e3e7771edecc44f2e582cccaa0fedbd6012669076d7
-
SHA512
c2b8febd7e296aa35b003b5637f911dd17df2303677126d5da97de2341a4aec2ac1b3b2b5bd2bbdf8288d71d1027b4489fd75eb638153754bb50a4820bb8e437
-
SSDEEP
24576:tqDEvCTbMWu7rQYlBQcBiT6rprG8a61SU+YLo06JKBqM02XjJxn:tTvC/MTQYxsWR7a6gU+OV6JKcM0uj
Malware Config
Extracted
remcos
RemoteHost
shgoini.com:30902
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-7XHN5V
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Drops startup file 1 IoCs
Processes:
excel.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\excel.vbs excel.exe -
Executes dropped EXE 1 IoCs
Processes:
excel.exepid process 2624 excel.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\directory\excel.exe autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
excel.exedescription pid process target process PID 2624 set thread context of 4612 2624 excel.exe svchost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
excel.exepid process 2624 excel.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
svchost.exedescription pid process Token: SeManageVolumePrivilege 4352 svchost.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Quotation.exeexcel.exepid process 4736 Quotation.exe 4736 Quotation.exe 2624 excel.exe 2624 excel.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Quotation.exeexcel.exepid process 4736 Quotation.exe 4736 Quotation.exe 2624 excel.exe 2624 excel.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
Quotation.exeexcel.exedescription pid process target process PID 4736 wrote to memory of 2624 4736 Quotation.exe excel.exe PID 4736 wrote to memory of 2624 4736 Quotation.exe excel.exe PID 4736 wrote to memory of 2624 4736 Quotation.exe excel.exe PID 2624 wrote to memory of 4612 2624 excel.exe svchost.exe PID 2624 wrote to memory of 4612 2624 excel.exe svchost.exe PID 2624 wrote to memory of 4612 2624 excel.exe svchost.exe PID 2624 wrote to memory of 4612 2624 excel.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\directory\excel.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"3⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ambiparousFilesize
483KB
MD55836e6fb1198f5826ca8facdba529e79
SHA1cc17afcef2c435265036b8520728963b91ae652c
SHA256f59b9e90acdbe2a0cc3e5e66bb3214adb7506fc775b8264e36e408a21decfba0
SHA512f66d5d9e96911ffe7228d2db7b305ee404ba59d25fcde778d00a590417e3606b72dac0a91b7edb4e5d42f7a5a14990eaf4b5058e16ca5e12b49701c6168e3045
-
C:\Users\Admin\AppData\Local\Temp\intersentimentalFilesize
29KB
MD533b3a37e1729538227a84e8aec307e27
SHA1d888cf3906a4bc58ccc74cba9fe6f314d3be29dd
SHA25661616629bc83442de66185fb8a8b3ed37d4fc690d473e28cf570527a5db7d456
SHA5127d1f025b2c18f6b1e7d1793897a17bc36f95a417d1764efc109144b0ffbb8c0a43ea216cab1e3d16935565bcd309ac8845e9df1805f99a1ac8d1f687ad52ef80
-
C:\Users\Admin\AppData\Local\directory\excel.exeFilesize
108.4MB
MD51878ed8f86e464d1b474571a34a75a98
SHA1e06eabaf88909ae0bb0cc9cc29b50069741b84fe
SHA2567311f971ed4303955b9576add44ba70569c0995ffc935e02bf7e9d7187388241
SHA5127539fc21cfb7250d90ae9ebc34aa33956e8e51622ea7ac977397de86715b9d79745250b092bf13c8da2041f6ab4114bd03877c4b8c7bf5ac02e6059a52d2cd82
-
memory/4612-47-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-76-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-29-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-30-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-31-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-32-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-48-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-34-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-35-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-36-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-38-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-39-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-40-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-41-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-42-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-43-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-46-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-50-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-33-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-28-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-93-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-51-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-54-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-55-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-56-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-57-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-58-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-60-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-61-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-62-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-70-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-71-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-74-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-75-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-49-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-82-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-83-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-88-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4612-92-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4736-10-0x0000000000CE0000-0x0000000000CE4000-memory.dmpFilesize
16KB