Analysis
-
max time kernel
33s -
max time network
33s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
05-04-2024 18:23
Behavioral task
behavioral1
Sample
remcos_a D JAM.exe
Resource
win11-20240221-en
windows11-21h2-x64
5 signatures
1800 seconds
General
-
Target
remcos_a D JAM.exe
-
Size
483KB
-
MD5
e6b7c26e0e647f45ffa4eaaa14edf5fb
-
SHA1
56a89c676780e4ad1065dded818261428f8627ad
-
SHA256
3802777efd14c1d2a5358277a30bfbac7aff9c1d308faba80cf81fe55c321b30
-
SHA512
f4bdb23d793845928831776227147e9d7eda7213f99ec5d4d67f0f9fbe391b8fe7878c41d8485ebfdd8d6038c4126ed3bea55f7ea089e1faaa4b6a75c476c69e
-
SSDEEP
6144:aXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNg5Gv:aX7tPMK8ctGe4Dzl4h2QnuPs/ZD5cv
Score
1/10
Malware Config
Signatures
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
Taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
Taskmgr.exepid process 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Taskmgr.exedescription pid process Token: SeDebugPrivilege 3740 Taskmgr.exe Token: SeSystemProfilePrivilege 3740 Taskmgr.exe Token: SeCreateGlobalPrivilege 3740 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 42 IoCs
Processes:
Taskmgr.exepid process 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe -
Suspicious use of SendNotifyMessage 42 IoCs
Processes:
Taskmgr.exepid process 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe 3740 Taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\remcos_a D JAM.exe"C:\Users\Admin\AppData\Local\Temp\remcos_a D JAM.exe"1⤵PID:1740
-
C:\Windows\System32\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3740
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3740-1-0x000001553E040000-0x000001553E041000-memory.dmpFilesize
4KB
-
memory/3740-2-0x000001553E040000-0x000001553E041000-memory.dmpFilesize
4KB
-
memory/3740-3-0x000001553E040000-0x000001553E041000-memory.dmpFilesize
4KB
-
memory/3740-7-0x000001553E040000-0x000001553E041000-memory.dmpFilesize
4KB
-
memory/3740-8-0x000001553E040000-0x000001553E041000-memory.dmpFilesize
4KB
-
memory/3740-9-0x000001553E040000-0x000001553E041000-memory.dmpFilesize
4KB
-
memory/3740-10-0x000001553E040000-0x000001553E041000-memory.dmpFilesize
4KB
-
memory/3740-11-0x000001553E040000-0x000001553E041000-memory.dmpFilesize
4KB
-
memory/3740-12-0x000001553E040000-0x000001553E041000-memory.dmpFilesize
4KB
-
memory/3740-13-0x000001553E040000-0x000001553E041000-memory.dmpFilesize
4KB