Overview
overview
10Static
static
3dcdc99a71a...3b.exe
windows7-x64
10dcdc99a71a...3b.exe
windows10-2004-x64
10$TEMP/Part...ri.dll
windows7-x64
10$TEMP/Part...ri.dll
windows10-2004-x64
10$TEMP/what...60.dll
windows7-x64
1$TEMP/what...60.dll
windows10-2004-x64
1$TEMP/what...60.dll
windows7-x64
1$TEMP/what...60.dll
windows10-2004-x64
1$TEMP/what...60.dll
windows7-x64
1$TEMP/what...60.dll
windows10-2004-x64
1$TEMP/what...ps.dll
windows7-x64
1$TEMP/what...ps.dll
windows10-2004-x64
1$TEMP/what...ui.dll
windows7-x64
1$TEMP/what...ui.dll
windows10-2004-x64
1$TEMP/what...er.dll
windows7-x64
1$TEMP/what...er.dll
windows10-2004-x64
1Analysis
-
max time kernel
166s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2024, 07:58
Static task
static1
Behavioral task
behavioral1
Sample
dcdc99a71af2d3db2cb3004dd3e91a4908d71a876179b447ed116742cff8ba3b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dcdc99a71af2d3db2cb3004dd3e91a4908d71a876179b447ed116742cff8ba3b.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$TEMP/PartiShikari.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$TEMP/PartiShikari.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$TEMP/whatnot/failure/cgi-bin/33.opends60.dll
Resource
win7-20240319-en
Behavioral task
behavioral6
Sample
$TEMP/whatnot/failure/cgi-bin/33.opends60.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$TEMP/whatnot/failure/cgi-bin/69.opends60.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$TEMP/whatnot/failure/cgi-bin/69.opends60.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$TEMP/whatnot/failure/cgi-bin/79.opends60.dll
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
$TEMP/whatnot/failure/cgi-bin/79.opends60.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
$TEMP/whatnot/failure/cgi-bin/edbgps.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$TEMP/whatnot/failure/cgi-bin/edbgps.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
$TEMP/whatnot/failure/cgi-bin/hxvzui.dll
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
$TEMP/whatnot/failure/cgi-bin/hxvzui.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
$TEMP/whatnot/failure/cgi-bin/sbsdiasymreader.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$TEMP/whatnot/failure/cgi-bin/sbsdiasymreader.dll
Resource
win10v2004-20240226-en
General
-
Target
$TEMP/PartiShikari.dll
-
Size
50KB
-
MD5
8aec2b9bf7b0156601b5738445c89afb
-
SHA1
72a3cf230083d1b882181bda3320ee5592a058d2
-
SHA256
e288f1292df61e692e2ba9f2a163bcaa620403b30fad40155c37edc9c9e53f76
-
SHA512
a92939475c2d0ac2331428d42628fc035ef98b3bb7ff9c154d99b441a38e11419de74fea0b07765de695dc02f0610ac9aba2ce7f82d500703b87f5f1183fe9ba
-
SSDEEP
1536:dJOsygYsjOO8ziIJJNAB/qepudoVoD3Qu3IE:7s2IJM
Malware Config
Extracted
remcos
2.5.0 Pro
TREINTAYOCHO
treintayochorem.duckdns.org:1010
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-H7ZOSI
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\msfeedssync.job notepad.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5088 rundll32.exe 5088 rundll32.exe 5088 rundll32.exe 5088 rundll32.exe 5088 rundll32.exe 5088 rundll32.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 5088 rundll32.exe 5088 rundll32.exe 5088 rundll32.exe 5088 rundll32.exe 5088 rundll32.exe 5088 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1636 notepad.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1900 wrote to memory of 5088 1900 rundll32.exe 84 PID 1900 wrote to memory of 5088 1900 rundll32.exe 84 PID 1900 wrote to memory of 5088 1900 rundll32.exe 84 PID 5088 wrote to memory of 5028 5088 rundll32.exe 88 PID 5088 wrote to memory of 5028 5088 rundll32.exe 88 PID 5088 wrote to memory of 5028 5088 rundll32.exe 88 PID 5088 wrote to memory of 5028 5088 rundll32.exe 88 PID 5088 wrote to memory of 5028 5088 rundll32.exe 88 PID 5088 wrote to memory of 5028 5088 rundll32.exe 88 PID 5088 wrote to memory of 5028 5088 rundll32.exe 88 PID 5088 wrote to memory of 5028 5088 rundll32.exe 88 PID 5088 wrote to memory of 5028 5088 rundll32.exe 88 PID 5088 wrote to memory of 4808 5088 rundll32.exe 89 PID 5088 wrote to memory of 4808 5088 rundll32.exe 89 PID 5088 wrote to memory of 4808 5088 rundll32.exe 89 PID 5088 wrote to memory of 4808 5088 rundll32.exe 89 PID 5088 wrote to memory of 4808 5088 rundll32.exe 89 PID 5088 wrote to memory of 4808 5088 rundll32.exe 89 PID 5088 wrote to memory of 4808 5088 rundll32.exe 89 PID 5088 wrote to memory of 4808 5088 rundll32.exe 89 PID 5088 wrote to memory of 4808 5088 rundll32.exe 89 PID 5088 wrote to memory of 4620 5088 rundll32.exe 90 PID 5088 wrote to memory of 4620 5088 rundll32.exe 90 PID 5088 wrote to memory of 4620 5088 rundll32.exe 90 PID 5088 wrote to memory of 4620 5088 rundll32.exe 90 PID 5088 wrote to memory of 4620 5088 rundll32.exe 90 PID 5088 wrote to memory of 4620 5088 rundll32.exe 90 PID 5088 wrote to memory of 4620 5088 rundll32.exe 90 PID 5088 wrote to memory of 4620 5088 rundll32.exe 90 PID 5088 wrote to memory of 4620 5088 rundll32.exe 90 PID 5088 wrote to memory of 1404 5088 rundll32.exe 91 PID 5088 wrote to memory of 1404 5088 rundll32.exe 91 PID 5088 wrote to memory of 1404 5088 rundll32.exe 91 PID 5088 wrote to memory of 1404 5088 rundll32.exe 91 PID 5088 wrote to memory of 1404 5088 rundll32.exe 91 PID 5088 wrote to memory of 1404 5088 rundll32.exe 91 PID 5088 wrote to memory of 1404 5088 rundll32.exe 91 PID 5088 wrote to memory of 1404 5088 rundll32.exe 91 PID 5088 wrote to memory of 1404 5088 rundll32.exe 91 PID 5088 wrote to memory of 2024 5088 rundll32.exe 92 PID 5088 wrote to memory of 2024 5088 rundll32.exe 92 PID 5088 wrote to memory of 2024 5088 rundll32.exe 92 PID 5088 wrote to memory of 2024 5088 rundll32.exe 92 PID 5088 wrote to memory of 2024 5088 rundll32.exe 92 PID 5088 wrote to memory of 2024 5088 rundll32.exe 92 PID 5088 wrote to memory of 2024 5088 rundll32.exe 92 PID 5088 wrote to memory of 2024 5088 rundll32.exe 92 PID 5088 wrote to memory of 2024 5088 rundll32.exe 92 PID 5088 wrote to memory of 1636 5088 rundll32.exe 93 PID 5088 wrote to memory of 1636 5088 rundll32.exe 93 PID 5088 wrote to memory of 1636 5088 rundll32.exe 93 PID 5088 wrote to memory of 1636 5088 rundll32.exe 93 PID 5088 wrote to memory of 1636 5088 rundll32.exe 93 PID 5088 wrote to memory of 1636 5088 rundll32.exe 93 PID 5088 wrote to memory of 1636 5088 rundll32.exe 93 PID 5088 wrote to memory of 1636 5088 rundll32.exe 93 PID 5088 wrote to memory of 1636 5088 rundll32.exe 93 PID 5088 wrote to memory of 1636 5088 rundll32.exe 93 PID 5088 wrote to memory of 1636 5088 rundll32.exe 93 PID 5088 wrote to memory of 1636 5088 rundll32.exe 93 PID 5088 wrote to memory of 1636 5088 rundll32.exe 93 PID 5088 wrote to memory of 1636 5088 rundll32.exe 93 PID 5088 wrote to memory of 1636 5088 rundll32.exe 93 PID 5088 wrote to memory of 1636 5088 rundll32.exe 93
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\PartiShikari.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\PartiShikari.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:5028
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:4808
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:4620
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:1404
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:2024
-
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1636
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74B
MD5bd390322d86739b0572f0c4341ce9b1a
SHA12cce2128cd9f54639e60928060709cc3f13d08da
SHA2567fdb5d06505a55fb098f9b17b09070c1e389068ab2eaa9a14a91c627855e7603
SHA5124645f3689edb6a82a5d1493c98fab55eaff48ac46b5aa6d824bc64f108c5c771b7445412cc3d7ed9fe85dac0fa75375e03738379811ef6be88d7da99bec8835c