Analysis
-
max time kernel
156s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2024, 09:31
Static task
static1
Behavioral task
behavioral1
Sample
0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe
Resource
win10v2004-20240226-en
General
-
Target
0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe
-
Size
686KB
-
MD5
51da9d817874e8eb7020e708e263f79a
-
SHA1
2f175ccb80f9103865bf89c0c9ea7754a6d99ba3
-
SHA256
0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799
-
SHA512
366875c7f4af27f74c7603fed936bbb9ecb0f6bf2e37b2ff9f00643ab1df2753930721c41ac09cce882ca577e98ad369adb7658759f34070bc165c3aeb8de82b
-
SSDEEP
12288:X5XDpqFdFi3XnNdPPI9OREbw9UdzHgbtTT4mNBMFJDaa:JXDcbs3XNdPPIUWsbtTT4oeFJDaa
Malware Config
Extracted
remcos
1.7 Pro
Harry
newremc22.ddns.net:2717
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_qvoysmnedqksues
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
bin
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\Control Panel\International\Geo\Nation 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe -
Executes dropped EXE 2 IoCs
pid Process 956 remcos.exe 4780 remcos.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bin = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe Set value (str) \REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bin = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" remcos.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3264 set thread context of 2732 3264 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 95 PID 956 set thread context of 4780 956 remcos.exe 100 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 5016 PING.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4780 remcos.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 3264 wrote to memory of 2732 3264 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 95 PID 3264 wrote to memory of 2732 3264 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 95 PID 3264 wrote to memory of 2732 3264 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 95 PID 3264 wrote to memory of 2732 3264 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 95 PID 3264 wrote to memory of 2732 3264 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 95 PID 3264 wrote to memory of 2732 3264 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 95 PID 3264 wrote to memory of 2732 3264 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 95 PID 3264 wrote to memory of 2732 3264 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 95 PID 3264 wrote to memory of 2732 3264 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 95 PID 2732 wrote to memory of 3432 2732 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 96 PID 2732 wrote to memory of 3432 2732 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 96 PID 2732 wrote to memory of 3432 2732 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe 96 PID 3432 wrote to memory of 5016 3432 cmd.exe 98 PID 3432 wrote to memory of 5016 3432 cmd.exe 98 PID 3432 wrote to memory of 5016 3432 cmd.exe 98 PID 3432 wrote to memory of 956 3432 cmd.exe 99 PID 3432 wrote to memory of 956 3432 cmd.exe 99 PID 3432 wrote to memory of 956 3432 cmd.exe 99 PID 956 wrote to memory of 4780 956 remcos.exe 100 PID 956 wrote to memory of 4780 956 remcos.exe 100 PID 956 wrote to memory of 4780 956 remcos.exe 100 PID 956 wrote to memory of 4780 956 remcos.exe 100 PID 956 wrote to memory of 4780 956 remcos.exe 100 PID 956 wrote to memory of 4780 956 remcos.exe 100 PID 956 wrote to memory of 4780 956 remcos.exe 100 PID 956 wrote to memory of 4780 956 remcos.exe 100 PID 956 wrote to memory of 4780 956 remcos.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe"C:\Users\Admin\AppData\Local\Temp\0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe"C:\Users\Admin\AppData\Local\Temp\0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\PING.EXEPING 127.0.0.1 -n 24⤵
- Runs ping.exe
PID:5016
-
-
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:4780
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99B
MD576c1687d97dfdbcea62ef1490bec5001
SHA15f4d1aeafa7d840cde67b76f97416dd68efd1bed
SHA25679f04ea049979ffd2232c459fdd57fae97a5255aea9b4a2c7dce7ead856f37a4
SHA512da250f0628632a644f159d818a82a8b9cca8224e46843bddbe0f6f9c32a2d04f7736a620af49ab6d77616317ca7d68285e60043965fe86c03d940835bd30a925
-
Filesize
686KB
MD551da9d817874e8eb7020e708e263f79a
SHA12f175ccb80f9103865bf89c0c9ea7754a6d99ba3
SHA2560a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799
SHA512366875c7f4af27f74c7603fed936bbb9ecb0f6bf2e37b2ff9f00643ab1df2753930721c41ac09cce882ca577e98ad369adb7658759f34070bc165c3aeb8de82b