Analysis
-
max time kernel
134s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 12:26
Static task
static1
Behavioral task
behavioral1
Sample
fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe
Resource
win7-20240221-en
General
-
Target
fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe
-
Size
617KB
-
MD5
d822c95bd53f00fca100fd5a8e262c84
-
SHA1
5198d2fdc041d5b71fa0ca9e12308b0d835a2e6f
-
SHA256
fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02
-
SHA512
3579eff385d1b1c5695f12c061052b594f2659971384d7ea37c4b7f9e46043ed6e7cfdcfa332fc249878ee9efc1b2da85ddb69851f812eb14f072979209bf59c
-
SSDEEP
12288:+CHNBT5iQt+QD+pkBFJsoFlTlNeg8jQHhpKISzAHEAmD:lNlpBr3d8j8H
Malware Config
Extracted
remcos
1.7 Pro
gg
62.102.148.185:9771
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
newstart
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_wgwfvnfssp
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exedescription pid process target process PID 5000 set thread context of 2556 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exepowershell.exepowershell.exepid process 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe 4472 powershell.exe 4548 powershell.exe 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe 4548 powershell.exe 4472 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe Token: SeDebugPrivilege 4472 powershell.exe Token: SeDebugPrivilege 4548 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exepid process 2556 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exedescription pid process target process PID 5000 wrote to memory of 4472 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe powershell.exe PID 5000 wrote to memory of 4472 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe powershell.exe PID 5000 wrote to memory of 4472 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe powershell.exe PID 5000 wrote to memory of 4548 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe powershell.exe PID 5000 wrote to memory of 4548 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe powershell.exe PID 5000 wrote to memory of 4548 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe powershell.exe PID 5000 wrote to memory of 1104 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe schtasks.exe PID 5000 wrote to memory of 1104 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe schtasks.exe PID 5000 wrote to memory of 1104 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe schtasks.exe PID 5000 wrote to memory of 2556 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe PID 5000 wrote to memory of 2556 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe PID 5000 wrote to memory of 2556 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe PID 5000 wrote to memory of 2556 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe PID 5000 wrote to memory of 2556 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe PID 5000 wrote to memory of 2556 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe PID 5000 wrote to memory of 2556 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe PID 5000 wrote to memory of 2556 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe PID 5000 wrote to memory of 2556 5000 fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe"C:\Users\Admin\AppData\Local\Temp\fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oloHsnLTUx.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oloHsnLTUx" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD968.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe"C:\Users\Admin\AppData\Local\Temp\fadcd7b36622cde793fdb8b3c509c13efb05a57e5227ea5c0dac37ef49a5cb02.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3n5nfl53.yzv.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpD968.tmpFilesize
1KB
MD5f8aa9dbe478b59b5a8b91c805ad280d5
SHA119fcaef14c978a1b61417af9d847ca1965e0330e
SHA2563accbd5d685cf3c59047532d290f3eb85a7ba42753e53eb44fbb22e7e4a9ded7
SHA5128e16f3ee2c65dd3ad9402fd02c896021c0777e1525207606f37a09210011ae76263250e2eb45ebaca4d71d284c151fc06c93d6818e729bb771c8ae0b42dc5a0b
-
memory/2556-104-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2556-103-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2556-110-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2556-109-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2556-108-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2556-107-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2556-106-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2556-105-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2556-112-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2556-111-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2556-101-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2556-100-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2556-59-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2556-58-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2556-52-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2556-55-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2556-51-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2556-39-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2556-113-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/4472-20-0x0000000004890000-0x00000000048A0000-memory.dmpFilesize
64KB
-
memory/4472-18-0x0000000074D10000-0x00000000754C0000-memory.dmpFilesize
7.7MB
-
memory/4472-24-0x0000000005670000-0x00000000056D6000-memory.dmpFilesize
408KB
-
memory/4472-98-0x0000000074D10000-0x00000000754C0000-memory.dmpFilesize
7.7MB
-
memory/4472-92-0x0000000007240000-0x000000000724E000-memory.dmpFilesize
56KB
-
memory/4472-23-0x0000000005600000-0x0000000005666000-memory.dmpFilesize
408KB
-
memory/4472-38-0x00000000056E0000-0x0000000005A34000-memory.dmpFilesize
3.3MB
-
memory/4472-22-0x0000000004C30000-0x0000000004C52000-memory.dmpFilesize
136KB
-
memory/4472-90-0x0000000007290000-0x0000000007326000-memory.dmpFilesize
600KB
-
memory/4472-88-0x0000000007010000-0x000000000702A000-memory.dmpFilesize
104KB
-
memory/4472-21-0x0000000004ED0000-0x00000000054F8000-memory.dmpFilesize
6.2MB
-
memory/4472-73-0x00000000711F0000-0x000000007123C000-memory.dmpFilesize
304KB
-
memory/4472-86-0x0000000004890000-0x00000000048A0000-memory.dmpFilesize
64KB
-
memory/4472-17-0x00000000023E0000-0x0000000002416000-memory.dmpFilesize
216KB
-
memory/4472-19-0x0000000004890000-0x00000000048A0000-memory.dmpFilesize
64KB
-
memory/4472-80-0x0000000004890000-0x00000000048A0000-memory.dmpFilesize
64KB
-
memory/4472-85-0x0000000006CE0000-0x0000000006D83000-memory.dmpFilesize
652KB
-
memory/4472-62-0x0000000006C60000-0x0000000006C92000-memory.dmpFilesize
200KB
-
memory/4548-99-0x0000000074D10000-0x00000000754C0000-memory.dmpFilesize
7.7MB
-
memory/4548-89-0x0000000007080000-0x000000000708A000-memory.dmpFilesize
40KB
-
memory/4548-74-0x0000000006290000-0x00000000062AE000-memory.dmpFilesize
120KB
-
memory/4548-57-0x0000000005D30000-0x0000000005D7C000-memory.dmpFilesize
304KB
-
memory/4548-26-0x0000000002420000-0x0000000002430000-memory.dmpFilesize
64KB
-
memory/4548-93-0x0000000007250000-0x0000000007264000-memory.dmpFilesize
80KB
-
memory/4548-87-0x0000000007650000-0x0000000007CCA000-memory.dmpFilesize
6.5MB
-
memory/4548-56-0x0000000005D10000-0x0000000005D2E000-memory.dmpFilesize
120KB
-
memory/4548-63-0x00000000711F0000-0x000000007123C000-memory.dmpFilesize
304KB
-
memory/4548-91-0x0000000007210000-0x0000000007221000-memory.dmpFilesize
68KB
-
memory/4548-25-0x0000000074D10000-0x00000000754C0000-memory.dmpFilesize
7.7MB
-
memory/4548-27-0x0000000002420000-0x0000000002430000-memory.dmpFilesize
64KB
-
memory/4548-94-0x0000000007350000-0x000000000736A000-memory.dmpFilesize
104KB
-
memory/4548-95-0x0000000007330000-0x0000000007338000-memory.dmpFilesize
32KB
-
memory/4548-61-0x000000007F720000-0x000000007F730000-memory.dmpFilesize
64KB
-
memory/5000-0-0x0000000000900000-0x00000000009A0000-memory.dmpFilesize
640KB
-
memory/5000-53-0x0000000074D10000-0x00000000754C0000-memory.dmpFilesize
7.7MB
-
memory/5000-12-0x0000000005330000-0x0000000005340000-memory.dmpFilesize
64KB
-
memory/5000-11-0x0000000074D10000-0x00000000754C0000-memory.dmpFilesize
7.7MB
-
memory/5000-10-0x000000000A300000-0x000000000A39C000-memory.dmpFilesize
624KB
-
memory/5000-9-0x0000000006660000-0x00000000066C0000-memory.dmpFilesize
384KB
-
memory/5000-8-0x00000000065E0000-0x00000000065EC000-memory.dmpFilesize
48KB
-
memory/5000-7-0x00000000065D0000-0x00000000065D8000-memory.dmpFilesize
32KB
-
memory/5000-6-0x00000000065A0000-0x00000000065B2000-memory.dmpFilesize
72KB
-
memory/5000-5-0x0000000005560000-0x000000000556A000-memory.dmpFilesize
40KB
-
memory/5000-4-0x0000000005330000-0x0000000005340000-memory.dmpFilesize
64KB
-
memory/5000-3-0x0000000005360000-0x00000000053F2000-memory.dmpFilesize
584KB
-
memory/5000-2-0x00000000059C0000-0x0000000005F64000-memory.dmpFilesize
5.6MB
-
memory/5000-1-0x0000000074D10000-0x00000000754C0000-memory.dmpFilesize
7.7MB