Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05-04-2024 13:10
Static task
static1
Behavioral task
behavioral1
Sample
GST e-Payment Challan.exe
Resource
win7-20240215-en
General
-
Target
GST e-Payment Challan.exe
-
Size
548KB
-
MD5
10a4cb3233c444bcf6211100ab9bad9a
-
SHA1
2f4a679479fdff9d22226676d7a7eacab84311eb
-
SHA256
2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65
-
SHA512
0c847f9723d1e65a03d0e129555160a7730e3ab4625d488540dd82dc968b354e31ab042dd820da6b61662af62d0687696e458440ab66b940e3fa168c09af9303
-
SSDEEP
12288:FUH8UsiMHGMZY/QZsg4rvpvK9+uH2OG/4RY+ajkrSyxPln+07bSsEAmD:yH8XvHFA6sgyvxK4uHBLRPaArSuPl19
Malware Config
Extracted
remcos
1.7 Pro
gg
62.102.148.185:9771
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
newstart
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_wgwfvnfssp
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
GST e-Payment Challan.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation GST e-Payment Challan.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
GST e-Payment Challan.exedescription pid process target process PID 3808 set thread context of 1480 3808 GST e-Payment Challan.exe GST e-Payment Challan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
GST e-Payment Challan.exepowershell.exepowershell.exepid process 3808 GST e-Payment Challan.exe 3808 GST e-Payment Challan.exe 3808 GST e-Payment Challan.exe 3808 GST e-Payment Challan.exe 3808 GST e-Payment Challan.exe 3808 GST e-Payment Challan.exe 3808 GST e-Payment Challan.exe 3808 GST e-Payment Challan.exe 3764 powershell.exe 2652 powershell.exe 3808 GST e-Payment Challan.exe 3808 GST e-Payment Challan.exe 3764 powershell.exe 3808 GST e-Payment Challan.exe 2652 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
GST e-Payment Challan.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3808 GST e-Payment Challan.exe Token: SeDebugPrivilege 2652 powershell.exe Token: SeDebugPrivilege 3764 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
GST e-Payment Challan.exepid process 1480 GST e-Payment Challan.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
GST e-Payment Challan.exedescription pid process target process PID 3808 wrote to memory of 3764 3808 GST e-Payment Challan.exe powershell.exe PID 3808 wrote to memory of 3764 3808 GST e-Payment Challan.exe powershell.exe PID 3808 wrote to memory of 3764 3808 GST e-Payment Challan.exe powershell.exe PID 3808 wrote to memory of 2652 3808 GST e-Payment Challan.exe powershell.exe PID 3808 wrote to memory of 2652 3808 GST e-Payment Challan.exe powershell.exe PID 3808 wrote to memory of 2652 3808 GST e-Payment Challan.exe powershell.exe PID 3808 wrote to memory of 448 3808 GST e-Payment Challan.exe schtasks.exe PID 3808 wrote to memory of 448 3808 GST e-Payment Challan.exe schtasks.exe PID 3808 wrote to memory of 448 3808 GST e-Payment Challan.exe schtasks.exe PID 3808 wrote to memory of 3860 3808 GST e-Payment Challan.exe GST e-Payment Challan.exe PID 3808 wrote to memory of 3860 3808 GST e-Payment Challan.exe GST e-Payment Challan.exe PID 3808 wrote to memory of 3860 3808 GST e-Payment Challan.exe GST e-Payment Challan.exe PID 3808 wrote to memory of 1480 3808 GST e-Payment Challan.exe GST e-Payment Challan.exe PID 3808 wrote to memory of 1480 3808 GST e-Payment Challan.exe GST e-Payment Challan.exe PID 3808 wrote to memory of 1480 3808 GST e-Payment Challan.exe GST e-Payment Challan.exe PID 3808 wrote to memory of 1480 3808 GST e-Payment Challan.exe GST e-Payment Challan.exe PID 3808 wrote to memory of 1480 3808 GST e-Payment Challan.exe GST e-Payment Challan.exe PID 3808 wrote to memory of 1480 3808 GST e-Payment Challan.exe GST e-Payment Challan.exe PID 3808 wrote to memory of 1480 3808 GST e-Payment Challan.exe GST e-Payment Challan.exe PID 3808 wrote to memory of 1480 3808 GST e-Payment Challan.exe GST e-Payment Challan.exe PID 3808 wrote to memory of 1480 3808 GST e-Payment Challan.exe GST e-Payment Challan.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\GST e-Payment Challan.exe"C:\Users\Admin\AppData\Local\Temp\GST e-Payment Challan.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\GST e-Payment Challan.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oFkpbhjTJbn.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oFkpbhjTJbn" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA77B.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\GST e-Payment Challan.exe"C:\Users\Admin\AppData\Local\Temp\GST e-Payment Challan.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\GST e-Payment Challan.exe"C:\Users\Admin\AppData\Local\Temp\GST e-Payment Challan.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5da42c25de6a64c4e7fd493ec89349223
SHA10eb9558345cb1da97f71b5f34bb44e9ef1581066
SHA2569f701b9f997ffdf8e32be516a13051994bb3a5a16e1eeda9c6ab0df2831077f9
SHA512ca8fcb4a6fd1172b0f424dd07a77613dcb6e5e57e3cb7cc24381e044cf8ecd7c10a4c1f000fda2f469cb7d9ce0bcff1ff685103affb3c6b9def67ada24b18e2b
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mevjm55u.vcz.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpA77B.tmpFilesize
1KB
MD59d0d620d529a9c0b39d4cbaccb2a316c
SHA1fd98fca22d8745ff9bf8ce7b7d4d20e1bb12e27d
SHA256fd0b0ae233dd4f0f5cad15b406b8bf956626c50f8a74610a31061a9dda6a3dac
SHA512b7317571a3d17a20a2a3d0325614d18e7f333c9a38ca2a3dabc5762fb80f7766b21ce672c37abc28988a8ff8b933e9998fba1856166d8b855f6a4aa7c736cb4e
-
memory/1480-115-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1480-106-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1480-116-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1480-49-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1480-114-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1480-112-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1480-111-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1480-110-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1480-109-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1480-108-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1480-107-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1480-117-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1480-105-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1480-103-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1480-102-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1480-118-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1480-119-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1480-120-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1480-121-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1480-57-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1480-56-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1480-46-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1480-53-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/1480-51-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2652-21-0x00000000743C0000-0x0000000074B70000-memory.dmpFilesize
7.7MB
-
memory/2652-87-0x00000000076A0000-0x00000000076BA000-memory.dmpFilesize
104KB
-
memory/2652-22-0x00000000012D0000-0x00000000012E0000-memory.dmpFilesize
64KB
-
memory/2652-100-0x00000000743C0000-0x0000000074B70000-memory.dmpFilesize
7.7MB
-
memory/2652-45-0x0000000005EE0000-0x0000000006234000-memory.dmpFilesize
3.3MB
-
memory/2652-30-0x0000000005C90000-0x0000000005CF6000-memory.dmpFilesize
408KB
-
memory/2652-59-0x000000007F050000-0x000000007F060000-memory.dmpFilesize
64KB
-
memory/2652-60-0x00000000072F0000-0x0000000007322000-memory.dmpFilesize
200KB
-
memory/2652-61-0x0000000070B70000-0x0000000070BBC000-memory.dmpFilesize
304KB
-
memory/2652-94-0x00000000079C0000-0x00000000079C8000-memory.dmpFilesize
32KB
-
memory/2652-75-0x00000000072D0000-0x00000000072EE000-memory.dmpFilesize
120KB
-
memory/2652-83-0x00000000012D0000-0x00000000012E0000-memory.dmpFilesize
64KB
-
memory/2652-93-0x00000000079E0000-0x00000000079FA000-memory.dmpFilesize
104KB
-
memory/2652-92-0x00000000078E0000-0x00000000078F4000-memory.dmpFilesize
80KB
-
memory/2652-89-0x0000000007920000-0x00000000079B6000-memory.dmpFilesize
600KB
-
memory/3764-82-0x0000000005310000-0x0000000005320000-memory.dmpFilesize
64KB
-
memory/3764-20-0x0000000005310000-0x0000000005320000-memory.dmpFilesize
64KB
-
memory/3764-88-0x0000000007B20000-0x0000000007B2A000-memory.dmpFilesize
40KB
-
memory/3764-85-0x0000000007770000-0x0000000007813000-memory.dmpFilesize
652KB
-
memory/3764-90-0x0000000007CB0000-0x0000000007CC1000-memory.dmpFilesize
68KB
-
memory/3764-91-0x0000000007CE0000-0x0000000007CEE000-memory.dmpFilesize
56KB
-
memory/3764-62-0x000000007F420000-0x000000007F430000-memory.dmpFilesize
64KB
-
memory/3764-16-0x0000000005200000-0x0000000005236000-memory.dmpFilesize
216KB
-
memory/3764-63-0x0000000070B70000-0x0000000070BBC000-memory.dmpFilesize
304KB
-
memory/3764-55-0x0000000006830000-0x000000000687C000-memory.dmpFilesize
304KB
-
memory/3764-31-0x0000000006120000-0x0000000006186000-memory.dmpFilesize
408KB
-
memory/3764-24-0x00000000058C0000-0x00000000058E2000-memory.dmpFilesize
136KB
-
memory/3764-101-0x00000000743C0000-0x0000000074B70000-memory.dmpFilesize
7.7MB
-
memory/3764-54-0x0000000006790000-0x00000000067AE000-memory.dmpFilesize
120KB
-
memory/3764-18-0x0000000005950000-0x0000000005F78000-memory.dmpFilesize
6.2MB
-
memory/3764-86-0x00000000080F0000-0x000000000876A000-memory.dmpFilesize
6.5MB
-
memory/3764-19-0x0000000005310000-0x0000000005320000-memory.dmpFilesize
64KB
-
memory/3764-17-0x00000000743C0000-0x0000000074B70000-memory.dmpFilesize
7.7MB
-
memory/3808-7-0x0000000005320000-0x000000000532C000-memory.dmpFilesize
48KB
-
memory/3808-50-0x00000000743C0000-0x0000000074B70000-memory.dmpFilesize
7.7MB
-
memory/3808-11-0x0000000004DF0000-0x0000000004E00000-memory.dmpFilesize
64KB
-
memory/3808-10-0x00000000743C0000-0x0000000074B70000-memory.dmpFilesize
7.7MB
-
memory/3808-9-0x0000000009D60000-0x0000000009DFC000-memory.dmpFilesize
624KB
-
memory/3808-8-0x00000000062B0000-0x0000000006310000-memory.dmpFilesize
384KB
-
memory/3808-0-0x0000000000410000-0x000000000049E000-memory.dmpFilesize
568KB
-
memory/3808-6-0x0000000005300000-0x0000000005310000-memory.dmpFilesize
64KB
-
memory/3808-5-0x0000000005010000-0x000000000501A000-memory.dmpFilesize
40KB
-
memory/3808-4-0x0000000004DF0000-0x0000000004E00000-memory.dmpFilesize
64KB
-
memory/3808-3-0x0000000004E70000-0x0000000004F02000-memory.dmpFilesize
584KB
-
memory/3808-2-0x0000000005340000-0x00000000058E4000-memory.dmpFilesize
5.6MB
-
memory/3808-1-0x00000000743C0000-0x0000000074B70000-memory.dmpFilesize
7.7MB