Analysis
-
max time kernel
173s -
max time network
168s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03-04-2024 01:17
Static task
static1
Behavioral task
behavioral1
Sample
470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52.exe
Resource
win10v2004-20240319-en
General
-
Target
470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52.exe
-
Size
1.3MB
-
MD5
d9b34a5d20cce6b325ee7faa90256a06
-
SHA1
d71e29f815151a74205b14c371333d691ba9830e
-
SHA256
470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52
-
SHA512
34b081577999c0cf1265489f659e246bcd228673ff55a623f72992d5e5c85f2fcb781a57f82ccad47d3c509516dd8fd745c69e2ba5f92603e766e5ab8961a612
-
SSDEEP
24576:iqDEvCTbMWu7rQYlBQcBiT6rprG8aMSAweUh8tsg+4yNBb:iTvC/MTQYxsWR7aMSAEG68y/
Malware Config
Extracted
remcos
RemoteHost
shgoini.com:30902
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-7XHN5V
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 17 IoCs
Processes:
resource yara_rule behavioral1/memory/2224-30-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2224-32-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2224-33-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2224-34-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2224-35-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2224-36-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2224-37-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2224-38-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2224-41-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2224-42-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2224-43-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2224-44-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2224-45-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2224-46-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2224-47-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2224-48-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral1/memory/2224-49-0x0000000000400000-0x0000000000482000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM -
Drops startup file 1 IoCs
Processes:
chrome.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.vbs chrome.exe -
Executes dropped EXE 1 IoCs
Processes:
chrome.exepid process 2408 chrome.exe -
Loads dropped DLL 1 IoCs
Processes:
470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52.exepid process 2896 470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule \Users\Admin\AppData\Local\directory\chrome.exe autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
chrome.exedescription pid process target process PID 2408 set thread context of 2224 2408 chrome.exe svchost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
chrome.exepid process 2408 chrome.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52.exechrome.exepid process 2896 470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52.exe 2896 470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52.exe 2408 chrome.exe 2408 chrome.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52.exechrome.exepid process 2896 470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52.exe 2896 470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52.exe 2408 chrome.exe 2408 chrome.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52.exechrome.exedescription pid process target process PID 2896 wrote to memory of 2408 2896 470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52.exe chrome.exe PID 2896 wrote to memory of 2408 2896 470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52.exe chrome.exe PID 2896 wrote to memory of 2408 2896 470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52.exe chrome.exe PID 2896 wrote to memory of 2408 2896 470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52.exe chrome.exe PID 2408 wrote to memory of 2224 2408 chrome.exe svchost.exe PID 2408 wrote to memory of 2224 2408 chrome.exe svchost.exe PID 2408 wrote to memory of 2224 2408 chrome.exe svchost.exe PID 2408 wrote to memory of 2224 2408 chrome.exe svchost.exe PID 2408 wrote to memory of 2224 2408 chrome.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52.exe"C:\Users\Admin\AppData\Local\Temp\470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\directory\chrome.exe"C:\Users\Admin\AppData\Local\Temp\470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\470b539a4e4519ea56b67b517ad48a5ff794a740b39ffff1eb834b568fb77e52.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ophiolatrousFilesize
483KB
MD5d1f9c2f8115082d19910822ccc9e5c10
SHA12cb10976a5deb529dcc372015dbdb6d492bd86f6
SHA25626fdc3781343a64e156175aafa9038d5a3751bf175401c371adaf3f7c3d1e88f
SHA5125f56c64805e3ea031de93c7b8ecf3b286a646b2de8f0a827a1e7296526d8b357ce62817ec8b1d63bd893fdc33be1c2f456fbbc0521fea136d220439a6053f01d
-
C:\Users\Admin\AppData\Local\Temp\pyogenesisFilesize
29KB
MD55ed5fbdee0b73fbae50e27ac69ad7ae7
SHA1283d4749e5729d7c5c3a51a6c15b1f7a47cf910f
SHA256b049894d767c9e974b8e92f448acba5a2f86ed79dba36dbfffd2b9f2517e3881
SHA5124034eda19cb86a9bb653210c9a746f4305f1c2b9656fa42dadadfb0fff119a09b73e9fa3d6656c7a73ba6e6cf267c0c56f55869c3c503ecccfd305d23ea0be8e
-
\Users\Admin\AppData\Local\directory\chrome.exeFilesize
103.3MB
MD5c7feccd7a803a89a36a52cffe463d42f
SHA1f8a2911a7d6a031ed6e0b1412f81780cc226720e
SHA2563b01461290951e77529ba70d12e97a37b55fdba4dda6c7c19e142753cbbe8a50
SHA5125a3d774a8b7cb9f90de838583f86c1ac1cc3c6e34d1b8b97638428eb072b42f7ba84bad8206b0d1cda82c013621e4da675bc613201baad8de8c934e39e44cb74
-
memory/2224-37-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2224-41-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2224-32-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2224-33-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2224-34-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2224-35-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2224-36-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2224-49-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2224-38-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2224-30-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2224-42-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2224-43-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2224-44-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2224-45-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2224-46-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2224-47-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2224-48-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2896-10-0x0000000000130000-0x0000000000134000-memory.dmpFilesize
16KB