Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
03-04-2024 12:24
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Quotation.exe
Resource
win10v2004-20240319-en
General
-
Target
Quotation.exe
-
Size
1.4MB
-
MD5
b637de26aa293e2d88beb31e09febd46
-
SHA1
a800c3b4defa12246ad3d6b9e70f1aa02e2d7623
-
SHA256
ca52caeb15fde0f171362e3e7771edecc44f2e582cccaa0fedbd6012669076d7
-
SHA512
c2b8febd7e296aa35b003b5637f911dd17df2303677126d5da97de2341a4aec2ac1b3b2b5bd2bbdf8288d71d1027b4489fd75eb638153754bb50a4820bb8e437
-
SSDEEP
24576:tqDEvCTbMWu7rQYlBQcBiT6rprG8a61SU+YLo06JKBqM02XjJxn:tTvC/MTQYxsWR7a6gU+OV6JKcM0uj
Malware Config
Extracted
remcos
RemoteHost
shgoini.com:30902
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-7XHN5V
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Drops startup file 1 IoCs
Processes:
excel.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\excel.vbs excel.exe -
Executes dropped EXE 1 IoCs
Processes:
excel.exepid process 1872 excel.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\directory\excel.exe autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
excel.exedescription pid process target process PID 1872 set thread context of 1644 1872 excel.exe svchost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
excel.exepid process 1872 excel.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Quotation.exeexcel.exepid process 1280 Quotation.exe 1280 Quotation.exe 1872 excel.exe 1872 excel.exe 1872 excel.exe -
Suspicious use of SendNotifyMessage 5 IoCs
Processes:
Quotation.exeexcel.exepid process 1280 Quotation.exe 1280 Quotation.exe 1872 excel.exe 1872 excel.exe 1872 excel.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
Quotation.exeexcel.exedescription pid process target process PID 1280 wrote to memory of 1872 1280 Quotation.exe excel.exe PID 1280 wrote to memory of 1872 1280 Quotation.exe excel.exe PID 1280 wrote to memory of 1872 1280 Quotation.exe excel.exe PID 1872 wrote to memory of 1644 1872 excel.exe svchost.exe PID 1872 wrote to memory of 1644 1872 excel.exe svchost.exe PID 1872 wrote to memory of 1644 1872 excel.exe svchost.exe PID 1872 wrote to memory of 1644 1872 excel.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\directory\excel.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4056 --field-trial-handle=2264,i,7994609493164365963,13212734413040148104,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ambiparousFilesize
483KB
MD55836e6fb1198f5826ca8facdba529e79
SHA1cc17afcef2c435265036b8520728963b91ae652c
SHA256f59b9e90acdbe2a0cc3e5e66bb3214adb7506fc775b8264e36e408a21decfba0
SHA512f66d5d9e96911ffe7228d2db7b305ee404ba59d25fcde778d00a590417e3606b72dac0a91b7edb4e5d42f7a5a14990eaf4b5058e16ca5e12b49701c6168e3045
-
C:\Users\Admin\AppData\Local\Temp\intersentimentalFilesize
29KB
MD533b3a37e1729538227a84e8aec307e27
SHA1d888cf3906a4bc58ccc74cba9fe6f314d3be29dd
SHA25661616629bc83442de66185fb8a8b3ed37d4fc690d473e28cf570527a5db7d456
SHA5127d1f025b2c18f6b1e7d1793897a17bc36f95a417d1764efc109144b0ffbb8c0a43ea216cab1e3d16935565bcd309ac8845e9df1805f99a1ac8d1f687ad52ef80
-
C:\Users\Admin\AppData\Local\directory\excel.exeFilesize
105.4MB
MD53f2c941999fc36e3d21840c398d48c49
SHA1802ee47c335323445fccfadbad02038d96fe44e5
SHA256541a721744a9728d1907ce3c4b7fdfe34655f2bf640db4a51faaf9b03d055e5b
SHA512471e334e76bbe844b73b66c91ae8730027b71910cab91051919f00acffc03529b8eb5f71b16ba3bee033c4af2003897fdecb6a6180056faab6658071c4c89e01
-
memory/1280-10-0x0000000001640000-0x0000000001644000-memory.dmpFilesize
16KB
-
memory/1644-28-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-29-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-30-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-31-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-32-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-33-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-34-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-35-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-36-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-37-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-38-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-39-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-40-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-41-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-42-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-43-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-44-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-45-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-46-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-47-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-48-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-49-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-50-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-51-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-52-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-53-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-54-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-55-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-56-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-57-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-58-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-59-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-60-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-61-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-62-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-63-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-64-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-65-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-66-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-67-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-68-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-69-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-70-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-71-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-72-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-73-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-74-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-75-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-76-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-77-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-78-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-79-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-80-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-81-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-82-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-83-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-84-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-85-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-86-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-87-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-88-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-89-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1644-90-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB