Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
10/04/2024, 09:31
Static task
static1
Behavioral task
behavioral1
Sample
0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe
Resource
win10v2004-20240226-en
General
-
Target
0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe
-
Size
686KB
-
MD5
51da9d817874e8eb7020e708e263f79a
-
SHA1
2f175ccb80f9103865bf89c0c9ea7754a6d99ba3
-
SHA256
0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799
-
SHA512
366875c7f4af27f74c7603fed936bbb9ecb0f6bf2e37b2ff9f00643ab1df2753930721c41ac09cce882ca577e98ad369adb7658759f34070bc165c3aeb8de82b
-
SSDEEP
12288:X5XDpqFdFi3XnNdPPI9OREbw9UdzHgbtTT4mNBMFJDaa:JXDcbs3XNdPPIUWsbtTT4oeFJDaa
Malware Config
Extracted
remcos
1.7 Pro
Harry
newremc22.ddns.net:2717
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_qvoysmnedqksues
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
bin
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
remcos
Harry
newremc22.ddns.net:2717
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_qvoysmnedqksues
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
bin
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2872 remcos.exe 2620 remcos.exe -
Loads dropped DLL 1 IoCs
pid Process 2240 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\bin = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe Set value (str) \REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\bin = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" remcos.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2228 set thread context of 2484 2228 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 30 PID 2872 set thread context of 2620 2872 remcos.exe 35 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1660 PING.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2620 remcos.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 2228 wrote to memory of 2484 2228 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 30 PID 2228 wrote to memory of 2484 2228 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 30 PID 2228 wrote to memory of 2484 2228 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 30 PID 2228 wrote to memory of 2484 2228 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 30 PID 2228 wrote to memory of 2484 2228 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 30 PID 2228 wrote to memory of 2484 2228 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 30 PID 2228 wrote to memory of 2484 2228 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 30 PID 2228 wrote to memory of 2484 2228 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 30 PID 2228 wrote to memory of 2484 2228 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 30 PID 2228 wrote to memory of 2484 2228 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 30 PID 2484 wrote to memory of 2240 2484 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 31 PID 2484 wrote to memory of 2240 2484 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 31 PID 2484 wrote to memory of 2240 2484 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 31 PID 2484 wrote to memory of 2240 2484 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 31 PID 2484 wrote to memory of 2240 2484 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 31 PID 2484 wrote to memory of 2240 2484 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 31 PID 2484 wrote to memory of 2240 2484 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 31 PID 2240 wrote to memory of 1660 2240 cmd.exe 33 PID 2240 wrote to memory of 1660 2240 cmd.exe 33 PID 2240 wrote to memory of 1660 2240 cmd.exe 33 PID 2240 wrote to memory of 1660 2240 cmd.exe 33 PID 2240 wrote to memory of 2872 2240 cmd.exe 34 PID 2240 wrote to memory of 2872 2240 cmd.exe 34 PID 2240 wrote to memory of 2872 2240 cmd.exe 34 PID 2240 wrote to memory of 2872 2240 cmd.exe 34 PID 2872 wrote to memory of 2620 2872 remcos.exe 35 PID 2872 wrote to memory of 2620 2872 remcos.exe 35 PID 2872 wrote to memory of 2620 2872 remcos.exe 35 PID 2872 wrote to memory of 2620 2872 remcos.exe 35 PID 2872 wrote to memory of 2620 2872 remcos.exe 35 PID 2872 wrote to memory of 2620 2872 remcos.exe 35 PID 2872 wrote to memory of 2620 2872 remcos.exe 35 PID 2872 wrote to memory of 2620 2872 remcos.exe 35 PID 2872 wrote to memory of 2620 2872 remcos.exe 35 PID 2872 wrote to memory of 2620 2872 remcos.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe"C:\Users\Admin\AppData\Local\Temp\0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe"C:\Users\Admin\AppData\Local\Temp\0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\PING.EXEPING 127.0.0.1 -n 24⤵
- Runs ping.exe
PID:1660
-
-
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2620
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99B
MD576c1687d97dfdbcea62ef1490bec5001
SHA15f4d1aeafa7d840cde67b76f97416dd68efd1bed
SHA25679f04ea049979ffd2232c459fdd57fae97a5255aea9b4a2c7dce7ead856f37a4
SHA512da250f0628632a644f159d818a82a8b9cca8224e46843bddbe0f6f9c32a2d04f7736a620af49ab6d77616317ca7d68285e60043965fe86c03d940835bd30a925
-
Filesize
686KB
MD551da9d817874e8eb7020e708e263f79a
SHA12f175ccb80f9103865bf89c0c9ea7754a6d99ba3
SHA2560a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799
SHA512366875c7f4af27f74c7603fed936bbb9ecb0f6bf2e37b2ff9f00643ab1df2753930721c41ac09cce882ca577e98ad369adb7658759f34070bc165c3aeb8de82b