Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
17-04-2024 01:28
Static task
static1
Behavioral task
behavioral1
Sample
f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
Resource
win7-20240215-en
General
-
Target
f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
-
Size
967KB
-
MD5
6d53853d0d56802e6ad845407f61eee7
-
SHA1
3cfb6e47d65afb417444d23908e28163ab83a341
-
SHA256
f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2
-
SHA512
20279d70d086aec743a7c6df92384fe5100e4a9e9f7cb710ac3c947b2a36a0a3b307638a0f3dfcd93cf26ba2172db1d546ffa311939ebc28c5b3988d0b6b00e5
-
SSDEEP
24576:Zo5Cx4T0Nq036gAfCwpOypJ4k4ZS3yWw:C5Cx4QN/OCypJ4ZZSCWw
Malware Config
Extracted
remcos
BUDDY
192.210.201.57:52499
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-LMLI87
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exedescription pid process target process PID 3012 set thread context of 2584 3012 f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exepid process 2584 f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exedescription pid process target process PID 3012 wrote to memory of 2584 3012 f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe PID 3012 wrote to memory of 2584 3012 f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe PID 3012 wrote to memory of 2584 3012 f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe PID 3012 wrote to memory of 2584 3012 f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe PID 3012 wrote to memory of 2584 3012 f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe PID 3012 wrote to memory of 2584 3012 f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe PID 3012 wrote to memory of 2584 3012 f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe PID 3012 wrote to memory of 2584 3012 f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe PID 3012 wrote to memory of 2584 3012 f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe PID 3012 wrote to memory of 2584 3012 f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe PID 3012 wrote to memory of 2584 3012 f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe PID 3012 wrote to memory of 2584 3012 f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe PID 3012 wrote to memory of 2584 3012 f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe"C:\Users\Admin\AppData\Local\Temp\f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe"C:\Users\Admin\AppData\Local\Temp\f5d0cc0b20705f516fd4b613c5e10473dd6a49aff8f9a03db004e6e8b80f46d2.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\remcos\logs.datFilesize
144B
MD53ba04df0f0593851a8dbfbea86607f43
SHA18e7a3f2c66f714c48f3e674b1b66854f91cf6804
SHA2568e9d8894034725f97bce10856bca1e06d282a210ee98ed39e0ef1b664a3f198d
SHA5125529a62c56e6418f463406217e52944f1c49fbac7090f7e7bf8d234eb1224e1834534e9fb2049cd5d55b5def5df6a321525d4f82e8317307994988f1949d57b7
-
memory/2584-43-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2584-83-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-82-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-80-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-79-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-7-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-42-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-11-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-13-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-15-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-16-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-21-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-78-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-23-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-77-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-18-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-44-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-25-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-26-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-28-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-29-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-30-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-31-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-32-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-33-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-35-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-36-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-37-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-38-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-39-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-41-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-9-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-75-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-17-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-46-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-47-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-48-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-49-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-51-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-52-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-53-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-54-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-55-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-74-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-57-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-58-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-59-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-60-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-62-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-63-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-64-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-65-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-67-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-68-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-69-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-70-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-72-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2584-73-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3012-1-0x0000000074160000-0x000000007484E000-memory.dmpFilesize
6.9MB
-
memory/3012-2-0x0000000001110000-0x0000000001150000-memory.dmpFilesize
256KB
-
memory/3012-24-0x0000000074160000-0x000000007484E000-memory.dmpFilesize
6.9MB
-
memory/3012-0-0x0000000001150000-0x0000000001248000-memory.dmpFilesize
992KB
-
memory/3012-6-0x0000000005C50000-0x0000000005D10000-memory.dmpFilesize
768KB
-
memory/3012-5-0x0000000000940000-0x000000000094C000-memory.dmpFilesize
48KB
-
memory/3012-4-0x0000000000930000-0x0000000000938000-memory.dmpFilesize
32KB
-
memory/3012-3-0x00000000004F0000-0x000000000050C000-memory.dmpFilesize
112KB