Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05-04-2024 11:29
Static task
static1
Behavioral task
behavioral1
Sample
TSTS 0005A.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
TSTS 0005A.exe
Resource
win10v2004-20240319-en
General
-
Target
TSTS 0005A.exe
-
Size
922KB
-
MD5
b195643d6d8c3f81c7409533ad14726c
-
SHA1
c09b56928fb1f448ed9b3610a0b930f77e2ebcfe
-
SHA256
f4eaa74eb268a58cff6f5d37607758bd49cc00af060da799857ae10cfd59efb2
-
SHA512
b843153f581be5a77b8575cf09e25333d5eaf5af3b689441ad0af336c4494a6181d5882dfa8b2ba2d90acb64cd3db9ab26f1cf87e1991f996d26cbb6990c5fb8
-
SSDEEP
24576:JgjHr6DLW5Gaxs00MUVXdtS6seDmw+Op8lCua51:WrpDxclG65mg8lCuo
Malware Config
Extracted
remcos
RemoteHost
sembe.duckdns.org:14645
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
notess
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Rmc-P0AEMX
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
TSTS 0005A.exedescription pid process target process PID 2184 set thread context of 2600 2184 TSTS 0005A.exe TSTS 0005A.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
TSTS 0005A.exepowershell.exepid process 2184 TSTS 0005A.exe 2564 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
TSTS 0005A.exepowershell.exedescription pid process Token: SeDebugPrivilege 2184 TSTS 0005A.exe Token: SeDebugPrivilege 2564 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
TSTS 0005A.exepid process 2600 TSTS 0005A.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
TSTS 0005A.exedescription pid process target process PID 2184 wrote to memory of 2564 2184 TSTS 0005A.exe powershell.exe PID 2184 wrote to memory of 2564 2184 TSTS 0005A.exe powershell.exe PID 2184 wrote to memory of 2564 2184 TSTS 0005A.exe powershell.exe PID 2184 wrote to memory of 2564 2184 TSTS 0005A.exe powershell.exe PID 2184 wrote to memory of 2612 2184 TSTS 0005A.exe schtasks.exe PID 2184 wrote to memory of 2612 2184 TSTS 0005A.exe schtasks.exe PID 2184 wrote to memory of 2612 2184 TSTS 0005A.exe schtasks.exe PID 2184 wrote to memory of 2612 2184 TSTS 0005A.exe schtasks.exe PID 2184 wrote to memory of 2156 2184 TSTS 0005A.exe TSTS 0005A.exe PID 2184 wrote to memory of 2156 2184 TSTS 0005A.exe TSTS 0005A.exe PID 2184 wrote to memory of 2156 2184 TSTS 0005A.exe TSTS 0005A.exe PID 2184 wrote to memory of 2156 2184 TSTS 0005A.exe TSTS 0005A.exe PID 2184 wrote to memory of 2600 2184 TSTS 0005A.exe TSTS 0005A.exe PID 2184 wrote to memory of 2600 2184 TSTS 0005A.exe TSTS 0005A.exe PID 2184 wrote to memory of 2600 2184 TSTS 0005A.exe TSTS 0005A.exe PID 2184 wrote to memory of 2600 2184 TSTS 0005A.exe TSTS 0005A.exe PID 2184 wrote to memory of 2600 2184 TSTS 0005A.exe TSTS 0005A.exe PID 2184 wrote to memory of 2600 2184 TSTS 0005A.exe TSTS 0005A.exe PID 2184 wrote to memory of 2600 2184 TSTS 0005A.exe TSTS 0005A.exe PID 2184 wrote to memory of 2600 2184 TSTS 0005A.exe TSTS 0005A.exe PID 2184 wrote to memory of 2600 2184 TSTS 0005A.exe TSTS 0005A.exe PID 2184 wrote to memory of 2600 2184 TSTS 0005A.exe TSTS 0005A.exe PID 2184 wrote to memory of 2600 2184 TSTS 0005A.exe TSTS 0005A.exe PID 2184 wrote to memory of 2600 2184 TSTS 0005A.exe TSTS 0005A.exe PID 2184 wrote to memory of 2600 2184 TSTS 0005A.exe TSTS 0005A.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vcEDbAjawlTHE.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vcEDbAjawlTHE" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB193.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpB193.tmpFilesize
1KB
MD5754e8fc137cfc99cc52b7ca6a5efbf2a
SHA178a5e1abc24171a84f0d58428b08f3c4b6afd499
SHA256c61c88894ede5a9fe05d275b5e1f2f0de731bf191cf7a37770355c90c0554e20
SHA51234da61d70899a7946b19bbd183bde570a0bdeb51c12a901bcca9478eafc89f604edaf9993433bbba59d7e6733954c2978add838b4faab843d068a607e34ee946
-
C:\Users\Admin\AppData\Roaming\notess\logs.datFilesize
144B
MD59dfc39dd21ff27915ba4d5932915c976
SHA18417e61b0b3b1fcc93037b14e99e34db9f27125f
SHA2563727563e342a1374d90ac62d1ca1eb4b04834582d0bc20b8f6d5e2bfb3858811
SHA51269577d8425d057cbbf43ea5ee72f35d965f700fc2f1db8b75e64c8cc029caf4995cec590f06429de727b159a52d96b5ba86e6b1cfe725497cc888e874c28397f
-
memory/2184-3-0x00000000005B0000-0x00000000005C0000-memory.dmpFilesize
64KB
-
memory/2184-30-0x00000000741F0000-0x00000000748DE000-memory.dmpFilesize
6.9MB
-
memory/2184-4-0x0000000000640000-0x000000000064C000-memory.dmpFilesize
48KB
-
memory/2184-5-0x0000000005460000-0x0000000005520000-memory.dmpFilesize
768KB
-
memory/2184-2-0x0000000004E00000-0x0000000004E40000-memory.dmpFilesize
256KB
-
memory/2184-1-0x00000000741F0000-0x00000000748DE000-memory.dmpFilesize
6.9MB
-
memory/2184-0-0x0000000001170000-0x0000000001258000-memory.dmpFilesize
928KB
-
memory/2564-43-0x000000006E850000-0x000000006EDFB000-memory.dmpFilesize
5.7MB
-
memory/2564-38-0x00000000020A0000-0x00000000020E0000-memory.dmpFilesize
256KB
-
memory/2564-37-0x00000000020A0000-0x00000000020E0000-memory.dmpFilesize
256KB
-
memory/2564-35-0x00000000020A0000-0x00000000020E0000-memory.dmpFilesize
256KB
-
memory/2564-32-0x000000006E850000-0x000000006EDFB000-memory.dmpFilesize
5.7MB
-
memory/2600-34-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-40-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-26-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-28-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-22-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-29-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-33-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-21-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-20-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-19-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-18-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-17-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-36-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-39-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-41-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2600-42-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-15-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-48-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-49-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-13-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-53-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-57-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-58-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-65-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-66-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-73-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-74-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-81-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2600-82-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB