Analysis
-
max time kernel
1800s -
max time network
1808s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
10/04/2024, 13:58
Static task
static1
Behavioral task
behavioral1
Sample
New Purchase Order-030220- SMART SOURCING INC.exe
Resource
win10v2004-20240226-en
General
-
Target
New Purchase Order-030220- SMART SOURCING INC.exe
-
Size
678KB
-
MD5
3207acb14184189a3800a8e20a82b023
-
SHA1
65d2ad175339e0dc644b301c85e7f02f098bbb63
-
SHA256
1f3358783cef07f7a60b0530c0de90be8a1131715faaf9d841ce830d9116434b
-
SHA512
71ccfda46c9c98944153398afebe09708d9c071da3e821f238b865fb77551734e94fbf6e39445c45da926efac9a7b6f9fcc6fe0d93ba8a2274d0fdc25c569bd0
-
SSDEEP
12288:qMu7vJgCfeUA94QAyS3ewHXsnn38zVzMfpNemioprHlJ:q5mZ2emcnn38pzE4In
Malware Config
Extracted
remcos
SOLOMON
grantadistciaret.com:3212
grantadistciaret.com:3223
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%Temp%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
RmcxeJ-GSQVVR
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4204 set thread context of 676 4204 New Purchase Order-030220- SMART SOURCING INC.exe 79 -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 676 Caspol.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4204 wrote to memory of 676 4204 New Purchase Order-030220- SMART SOURCING INC.exe 79 PID 4204 wrote to memory of 676 4204 New Purchase Order-030220- SMART SOURCING INC.exe 79 PID 4204 wrote to memory of 676 4204 New Purchase Order-030220- SMART SOURCING INC.exe 79 PID 4204 wrote to memory of 676 4204 New Purchase Order-030220- SMART SOURCING INC.exe 79 PID 4204 wrote to memory of 676 4204 New Purchase Order-030220- SMART SOURCING INC.exe 79 PID 4204 wrote to memory of 676 4204 New Purchase Order-030220- SMART SOURCING INC.exe 79 PID 4204 wrote to memory of 676 4204 New Purchase Order-030220- SMART SOURCING INC.exe 79 PID 4204 wrote to memory of 676 4204 New Purchase Order-030220- SMART SOURCING INC.exe 79 PID 4204 wrote to memory of 676 4204 New Purchase Order-030220- SMART SOURCING INC.exe 79 PID 4204 wrote to memory of 676 4204 New Purchase Order-030220- SMART SOURCING INC.exe 79 PID 4204 wrote to memory of 676 4204 New Purchase Order-030220- SMART SOURCING INC.exe 79 PID 4204 wrote to memory of 676 4204 New Purchase Order-030220- SMART SOURCING INC.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Purchase Order-030220- SMART SOURCING INC.exe"C:\Users\Admin\AppData\Local\Temp\New Purchase Order-030220- SMART SOURCING INC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:676
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5a1269564ba4ead3b7202813b327ca586
SHA183211e4b9e6261f2e1bc12fd4639dd7c08e23cda
SHA256cafccfc0d964867b3c2994d4bd038897d381eeefd5d510b880f14ba5d9a2214e
SHA5129a37c4d73c5e5f08eb5364cb1cbac7a8da25ef284cd45a363c88401a2efb22c7737bb0b6b3c7ad5995adf12281e4f210c65b3e66d0d9fa5abff71998a3dc65a7