Analysis
-
max time kernel
1798s -
max time network
1501s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
19-04-2024 16:02
Static task
static1
Behavioral task
behavioral1
Sample
Sig.exe
Resource
win11-20240412-en
General
-
Target
Sig.exe
-
Size
2.4MB
-
MD5
85b9954d8d5f3c814543f471e1f012f9
-
SHA1
4f8c4132247d42d7fd21b2fad3972d2c18319210
-
SHA256
f045bfccb64d78fca3716eaf1e03b7e4e4b53a4adb678e22d5ed2d6ba63b6ea3
-
SHA512
47667140d38b5e43514911842ae3f81bdf42d90c7979b8ee813a95f765ba74a4b05e92c351f786836e2630f784fec232a80cee0d589e288b84108b6d1893f298
-
SSDEEP
49152:S6bkzSYl+aFUUhf3LIE3VEa9Ml6MW0svKrZ2Z+ItVzp0:SgoL33VEa9yIQZ0tA
Malware Config
Extracted
remcos
4.9.3 Light
RemoteHost
127.0.0.1:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-52SPIJ
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
Sig.exepid process 4932 Sig.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Sig.exepid process 2428 Sig.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
Sig.exepid process 2428 Sig.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Sig.exedescription pid process target process PID 4932 wrote to memory of 2428 4932 Sig.exe Sig.exe PID 4932 wrote to memory of 2428 4932 Sig.exe Sig.exe PID 4932 wrote to memory of 2428 4932 Sig.exe Sig.exe PID 4932 wrote to memory of 2428 4932 Sig.exe Sig.exe PID 4932 wrote to memory of 2428 4932 Sig.exe Sig.exe PID 4932 wrote to memory of 2428 4932 Sig.exe Sig.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sig.exe"C:\Users\Admin\AppData\Local\Temp\Sig.exe"1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Sig.exe"C:\Users\Admin\AppData\Local\Temp\Sig.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2428-39-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-20-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-9-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-10-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-11-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-4-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/2428-13-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-14-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-15-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-16-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-17-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-18-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-19-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-40-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-21-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-22-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-23-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-24-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-25-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-26-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-27-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-28-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-29-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-30-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-31-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-41-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-33-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-34-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-35-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-36-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-37-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-38-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-12-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-8-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-32-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-42-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-43-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-44-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-45-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-46-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-47-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-48-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-49-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-50-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-51-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-52-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-53-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-54-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-55-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-56-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-57-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-58-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-59-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-60-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-61-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-62-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-63-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-64-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-65-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-66-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/2428-67-0x0000000000660000-0x00000000006D5000-memory.dmpFilesize
468KB
-
memory/4932-0-0x0000000000400000-0x000000000065D000-memory.dmpFilesize
2.4MB
-
memory/4932-1-0x0000000000400000-0x000000000065D000-memory.dmpFilesize
2.4MB
-
memory/4932-2-0x0000000000400000-0x000000000065D000-memory.dmpFilesize
2.4MB
-
memory/4932-7-0x0000000000400000-0x000000000065D000-memory.dmpFilesize
2.4MB