Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
05-04-2024 09:58
Static task
static1
Behavioral task
behavioral1
Sample
TSTS 0005A.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
TSTS 0005A.exe
Resource
win10v2004-20240226-en
General
-
Target
TSTS 0005A.exe
-
Size
922KB
-
MD5
b195643d6d8c3f81c7409533ad14726c
-
SHA1
c09b56928fb1f448ed9b3610a0b930f77e2ebcfe
-
SHA256
f4eaa74eb268a58cff6f5d37607758bd49cc00af060da799857ae10cfd59efb2
-
SHA512
b843153f581be5a77b8575cf09e25333d5eaf5af3b689441ad0af336c4494a6181d5882dfa8b2ba2d90acb64cd3db9ab26f1cf87e1991f996d26cbb6990c5fb8
-
SSDEEP
24576:JgjHr6DLW5Gaxs00MUVXdtS6seDmw+Op8lCua51:WrpDxclG65mg8lCuo
Malware Config
Extracted
remcos
RemoteHost
sembe.duckdns.org:14645
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
notess
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Rmc-P0AEMX
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
TSTS 0005A.exedescription pid Process procid_target PID 2396 set thread context of 2472 2396 TSTS 0005A.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
TSTS 0005A.exepowershell.exepid Process 2396 TSTS 0005A.exe 2396 TSTS 0005A.exe 2648 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
TSTS 0005A.exepowershell.exedescription pid Process Token: SeDebugPrivilege 2396 TSTS 0005A.exe Token: SeDebugPrivilege 2648 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
TSTS 0005A.exepid Process 2472 TSTS 0005A.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
TSTS 0005A.exedescription pid Process procid_target PID 2396 wrote to memory of 2648 2396 TSTS 0005A.exe 28 PID 2396 wrote to memory of 2648 2396 TSTS 0005A.exe 28 PID 2396 wrote to memory of 2648 2396 TSTS 0005A.exe 28 PID 2396 wrote to memory of 2648 2396 TSTS 0005A.exe 28 PID 2396 wrote to memory of 2736 2396 TSTS 0005A.exe 30 PID 2396 wrote to memory of 2736 2396 TSTS 0005A.exe 30 PID 2396 wrote to memory of 2736 2396 TSTS 0005A.exe 30 PID 2396 wrote to memory of 2736 2396 TSTS 0005A.exe 30 PID 2396 wrote to memory of 2556 2396 TSTS 0005A.exe 32 PID 2396 wrote to memory of 2556 2396 TSTS 0005A.exe 32 PID 2396 wrote to memory of 2556 2396 TSTS 0005A.exe 32 PID 2396 wrote to memory of 2556 2396 TSTS 0005A.exe 32 PID 2396 wrote to memory of 2724 2396 TSTS 0005A.exe 33 PID 2396 wrote to memory of 2724 2396 TSTS 0005A.exe 33 PID 2396 wrote to memory of 2724 2396 TSTS 0005A.exe 33 PID 2396 wrote to memory of 2724 2396 TSTS 0005A.exe 33 PID 2396 wrote to memory of 2472 2396 TSTS 0005A.exe 34 PID 2396 wrote to memory of 2472 2396 TSTS 0005A.exe 34 PID 2396 wrote to memory of 2472 2396 TSTS 0005A.exe 34 PID 2396 wrote to memory of 2472 2396 TSTS 0005A.exe 34 PID 2396 wrote to memory of 2472 2396 TSTS 0005A.exe 34 PID 2396 wrote to memory of 2472 2396 TSTS 0005A.exe 34 PID 2396 wrote to memory of 2472 2396 TSTS 0005A.exe 34 PID 2396 wrote to memory of 2472 2396 TSTS 0005A.exe 34 PID 2396 wrote to memory of 2472 2396 TSTS 0005A.exe 34 PID 2396 wrote to memory of 2472 2396 TSTS 0005A.exe 34 PID 2396 wrote to memory of 2472 2396 TSTS 0005A.exe 34 PID 2396 wrote to memory of 2472 2396 TSTS 0005A.exe 34 PID 2396 wrote to memory of 2472 2396 TSTS 0005A.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vcEDbAjawlTHE.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2648
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vcEDbAjawlTHE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5F6E.tmp"2⤵
- Creates scheduled task(s)
PID:2736
-
-
C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"2⤵PID:2556
-
-
C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"2⤵PID:2724
-
-
C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:2472
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d2f2e1acea8a64fd3811f2a279e26dd5
SHA1a37db029a9bd58051ccb13862d74d97d62c42128
SHA25619c1ca1829277c41a9bc2ec1514e7660a860177552ab6becbf14ceb64550cef8
SHA512ca58e782584a06b85d446c4d2c13fc7f1a7311f2074e0b3e722ebe98936d564f7b5eaad13cae7e5c39de3e81a4a752c7a3c3e4989889dcd3169555271f1d933d
-
Filesize
144B
MD5b5162480a9ee1a48fab211a4c2209c56
SHA1cd3274495aeaf6f6672dc304288d867f0313dc78
SHA25644fa6b3161ed34fcbc66a80c9a460fe207d4bb4459488428b7643ae332270fa0
SHA5128342969bced846750813a7e46b53dfa88e707742fc109b12e22e3c91b76946e85337a17d472078988439584be098f42f43039af5d9893d6cb5a0f13652bad040