Overview
overview
10Static
static
3dcdc99a71a...3b.exe
windows7-x64
10dcdc99a71a...3b.exe
windows10-2004-x64
10$TEMP/Part...ri.dll
windows7-x64
10$TEMP/Part...ri.dll
windows10-2004-x64
10$TEMP/what...60.dll
windows7-x64
1$TEMP/what...60.dll
windows10-2004-x64
1$TEMP/what...60.dll
windows7-x64
1$TEMP/what...60.dll
windows10-2004-x64
1$TEMP/what...60.dll
windows7-x64
1$TEMP/what...60.dll
windows10-2004-x64
1$TEMP/what...ps.dll
windows7-x64
1$TEMP/what...ps.dll
windows10-2004-x64
1$TEMP/what...ui.dll
windows7-x64
1$TEMP/what...ui.dll
windows10-2004-x64
1$TEMP/what...er.dll
windows7-x64
1$TEMP/what...er.dll
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/04/2024, 07:58
Static task
static1
Behavioral task
behavioral1
Sample
dcdc99a71af2d3db2cb3004dd3e91a4908d71a876179b447ed116742cff8ba3b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dcdc99a71af2d3db2cb3004dd3e91a4908d71a876179b447ed116742cff8ba3b.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$TEMP/PartiShikari.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$TEMP/PartiShikari.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$TEMP/whatnot/failure/cgi-bin/33.opends60.dll
Resource
win7-20240319-en
Behavioral task
behavioral6
Sample
$TEMP/whatnot/failure/cgi-bin/33.opends60.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$TEMP/whatnot/failure/cgi-bin/69.opends60.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$TEMP/whatnot/failure/cgi-bin/69.opends60.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$TEMP/whatnot/failure/cgi-bin/79.opends60.dll
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
$TEMP/whatnot/failure/cgi-bin/79.opends60.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
$TEMP/whatnot/failure/cgi-bin/edbgps.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$TEMP/whatnot/failure/cgi-bin/edbgps.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
$TEMP/whatnot/failure/cgi-bin/hxvzui.dll
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
$TEMP/whatnot/failure/cgi-bin/hxvzui.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
$TEMP/whatnot/failure/cgi-bin/sbsdiasymreader.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$TEMP/whatnot/failure/cgi-bin/sbsdiasymreader.dll
Resource
win10v2004-20240226-en
General
-
Target
$TEMP/PartiShikari.dll
-
Size
50KB
-
MD5
8aec2b9bf7b0156601b5738445c89afb
-
SHA1
72a3cf230083d1b882181bda3320ee5592a058d2
-
SHA256
e288f1292df61e692e2ba9f2a163bcaa620403b30fad40155c37edc9c9e53f76
-
SHA512
a92939475c2d0ac2331428d42628fc035ef98b3bb7ff9c154d99b441a38e11419de74fea0b07765de695dc02f0610ac9aba2ce7f82d500703b87f5f1183fe9ba
-
SSDEEP
1536:dJOsygYsjOO8ziIJJNAB/qepudoVoD3Qu3IE:7s2IJM
Malware Config
Extracted
remcos
2.5.0 Pro
TREINTAYOCHO
treintayochorem.duckdns.org:1010
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-H7ZOSI
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 484 rundll32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 484 rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1504 wrote to memory of 484 1504 rundll32.exe 28 PID 1504 wrote to memory of 484 1504 rundll32.exe 28 PID 1504 wrote to memory of 484 1504 rundll32.exe 28 PID 1504 wrote to memory of 484 1504 rundll32.exe 28 PID 1504 wrote to memory of 484 1504 rundll32.exe 28 PID 1504 wrote to memory of 484 1504 rundll32.exe 28 PID 1504 wrote to memory of 484 1504 rundll32.exe 28 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 484 wrote to memory of 2456 484 rundll32.exe 29 PID 2456 wrote to memory of 2484 2456 cmd.exe 32 PID 2456 wrote to memory of 2484 2456 cmd.exe 32 PID 2456 wrote to memory of 2484 2456 cmd.exe 32 PID 2456 wrote to memory of 2484 2456 cmd.exe 32 PID 2456 wrote to memory of 1976 2456 cmd.exe 34 PID 2456 wrote to memory of 1976 2456 cmd.exe 34 PID 2456 wrote to memory of 1976 2456 cmd.exe 34 PID 2456 wrote to memory of 1976 2456 cmd.exe 34 PID 2456 wrote to memory of 768 2456 cmd.exe 36 PID 2456 wrote to memory of 768 2456 cmd.exe 36 PID 2456 wrote to memory of 768 2456 cmd.exe 36 PID 2456 wrote to memory of 768 2456 cmd.exe 36
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\PartiShikari.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\PartiShikari.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "COPY /Y /B "" "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\msfeedssync.exe""4⤵PID:2484
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "COPY /Y /B "" "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\msfeedssync.exe""4⤵PID:1976
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "COPY /Y /B "" "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\msfeedssync.exe""4⤵PID:768
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "COPY /Y /B "" "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\msfeedssync.exe""4⤵PID:1472
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "COPY /Y /B "" "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\msfeedssync.exe""4⤵PID:2872
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "COPY /Y /B "" "C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\msfeedssync.exe""4⤵PID:748
-
-
-