Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
22-04-2024 16:04
Static task
static1
Behavioral task
behavioral1
Sample
z1PROOFOFPAYMENT.exe
Resource
win7-20240221-en
General
-
Target
z1PROOFOFPAYMENT.exe
-
Size
963KB
-
MD5
3b8dd99d65b19a84a276a05804005790
-
SHA1
c300f31e8e67b4bd92504b94d5d2294b0f8ef5cb
-
SHA256
efbde8c3fc0f8f18b6b2c93fae4c7aaaa137f866a9d112ebdc534b8477485261
-
SHA512
6c15f448fdbe5cd63fcb010aae0aa253f9a9702d1edf7527ab73917896fd83b9f5bbd25f8494deabf7c612f7cf3448115f4f9925beaedf395e534158fb630bb5
-
SSDEEP
24576:uC8wC9aeW7T4WfjBrAodA0bbwkTQ8NmCQN0iiLX:uCG9+FvbzaCQ1
Malware Config
Extracted
remcos
STHost
89.249.73.162:2479
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-TH3UQH
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
z1PROOFOFPAYMENT.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation z1PROOFOFPAYMENT.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
z1PROOFOFPAYMENT.exedescription pid process target process PID 4864 set thread context of 1328 4864 z1PROOFOFPAYMENT.exe z1PROOFOFPAYMENT.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
z1PROOFOFPAYMENT.exepowershell.exepid process 4864 z1PROOFOFPAYMENT.exe 4584 powershell.exe 4584 powershell.exe 4864 z1PROOFOFPAYMENT.exe 4864 z1PROOFOFPAYMENT.exe 4864 z1PROOFOFPAYMENT.exe 4864 z1PROOFOFPAYMENT.exe 4584 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
z1PROOFOFPAYMENT.exepowershell.exedescription pid process Token: SeDebugPrivilege 4864 z1PROOFOFPAYMENT.exe Token: SeDebugPrivilege 4584 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
z1PROOFOFPAYMENT.exepid process 1328 z1PROOFOFPAYMENT.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
z1PROOFOFPAYMENT.exedescription pid process target process PID 4864 wrote to memory of 4584 4864 z1PROOFOFPAYMENT.exe powershell.exe PID 4864 wrote to memory of 4584 4864 z1PROOFOFPAYMENT.exe powershell.exe PID 4864 wrote to memory of 4584 4864 z1PROOFOFPAYMENT.exe powershell.exe PID 4864 wrote to memory of 3100 4864 z1PROOFOFPAYMENT.exe schtasks.exe PID 4864 wrote to memory of 3100 4864 z1PROOFOFPAYMENT.exe schtasks.exe PID 4864 wrote to memory of 3100 4864 z1PROOFOFPAYMENT.exe schtasks.exe PID 4864 wrote to memory of 3932 4864 z1PROOFOFPAYMENT.exe z1PROOFOFPAYMENT.exe PID 4864 wrote to memory of 3932 4864 z1PROOFOFPAYMENT.exe z1PROOFOFPAYMENT.exe PID 4864 wrote to memory of 3932 4864 z1PROOFOFPAYMENT.exe z1PROOFOFPAYMENT.exe PID 4864 wrote to memory of 1328 4864 z1PROOFOFPAYMENT.exe z1PROOFOFPAYMENT.exe PID 4864 wrote to memory of 1328 4864 z1PROOFOFPAYMENT.exe z1PROOFOFPAYMENT.exe PID 4864 wrote to memory of 1328 4864 z1PROOFOFPAYMENT.exe z1PROOFOFPAYMENT.exe PID 4864 wrote to memory of 1328 4864 z1PROOFOFPAYMENT.exe z1PROOFOFPAYMENT.exe PID 4864 wrote to memory of 1328 4864 z1PROOFOFPAYMENT.exe z1PROOFOFPAYMENT.exe PID 4864 wrote to memory of 1328 4864 z1PROOFOFPAYMENT.exe z1PROOFOFPAYMENT.exe PID 4864 wrote to memory of 1328 4864 z1PROOFOFPAYMENT.exe z1PROOFOFPAYMENT.exe PID 4864 wrote to memory of 1328 4864 z1PROOFOFPAYMENT.exe z1PROOFOFPAYMENT.exe PID 4864 wrote to memory of 1328 4864 z1PROOFOFPAYMENT.exe z1PROOFOFPAYMENT.exe PID 4864 wrote to memory of 1328 4864 z1PROOFOFPAYMENT.exe z1PROOFOFPAYMENT.exe PID 4864 wrote to memory of 1328 4864 z1PROOFOFPAYMENT.exe z1PROOFOFPAYMENT.exe PID 4864 wrote to memory of 1328 4864 z1PROOFOFPAYMENT.exe z1PROOFOFPAYMENT.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\z1PROOFOFPAYMENT.exe"C:\Users\Admin\AppData\Local\Temp\z1PROOFOFPAYMENT.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VbYQdeNcfJk.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VbYQdeNcfJk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp84C0.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\z1PROOFOFPAYMENT.exe"C:\Users\Admin\AppData\Local\Temp\z1PROOFOFPAYMENT.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\z1PROOFOFPAYMENT.exe"C:\Users\Admin\AppData\Local\Temp\z1PROOFOFPAYMENT.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\remcos\logs.datFilesize
144B
MD556a390a314e195a346b6ea290a690392
SHA1796231988668ce79fa1bdebccaf23e8abd405a75
SHA256bd4d6026e2c41bcb423389f8f9f196465a759f5d30b63d0a9f7e3906f2f6c02f
SHA512ab0d80b4ee37e08d75188d6f7a27ae8bd4623d62bc8ebc74efc9d86b51b477e98d03997fd62ca4d147183db222732828cafc369ad46b170fc0b2b9009f72a934
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0bestx5p.lx4.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp84C0.tmpFilesize
1KB
MD51b94005d183f623582c09a5ee1f05154
SHA177bf6cde3de624f57d30f25f659b7258cb701983
SHA2568f3240ac5b352b160127fa64865fe319df286e01cd6d204ddb4f5510df451447
SHA5122bca434ab2ddbf02ebf6dbb0307c8c912c7e821e0111c21c1341d8367755da13462950d59eeff6dd5f42a31fe1526e46172540c0f0e85dc78524c555083d30fb
-
memory/1328-86-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1328-81-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1328-100-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1328-99-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1328-94-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1328-93-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1328-87-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1328-35-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1328-107-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1328-105-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1328-80-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1328-78-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1328-46-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1328-44-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1328-112-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1328-43-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1328-113-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1328-41-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1328-38-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/1328-34-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4584-19-0x0000000005420000-0x0000000005430000-memory.dmpFilesize
64KB
-
memory/4584-66-0x0000000007E60000-0x0000000007EF6000-memory.dmpFilesize
600KB
-
memory/4584-16-0x0000000005300000-0x0000000005336000-memory.dmpFilesize
216KB
-
memory/4584-23-0x0000000006200000-0x0000000006266000-memory.dmpFilesize
408KB
-
memory/4584-29-0x00000000062E0000-0x0000000006346000-memory.dmpFilesize
408KB
-
memory/4584-22-0x00000000058F0000-0x0000000005912000-memory.dmpFilesize
136KB
-
memory/4584-20-0x0000000005420000-0x0000000005430000-memory.dmpFilesize
64KB
-
memory/4584-45-0x00000000068D0000-0x00000000068EE000-memory.dmpFilesize
120KB
-
memory/4584-17-0x0000000074A50000-0x0000000075200000-memory.dmpFilesize
7.7MB
-
memory/4584-47-0x0000000006960000-0x00000000069AC000-memory.dmpFilesize
304KB
-
memory/4584-48-0x000000007F690000-0x000000007F6A0000-memory.dmpFilesize
64KB
-
memory/4584-49-0x0000000006E70000-0x0000000006EA2000-memory.dmpFilesize
200KB
-
memory/4584-50-0x0000000073520000-0x000000007356C000-memory.dmpFilesize
304KB
-
memory/4584-60-0x0000000006E50000-0x0000000006E6E000-memory.dmpFilesize
120KB
-
memory/4584-61-0x0000000005420000-0x0000000005430000-memory.dmpFilesize
64KB
-
memory/4584-62-0x0000000007AD0000-0x0000000007B73000-memory.dmpFilesize
652KB
-
memory/4584-63-0x0000000008220000-0x000000000889A000-memory.dmpFilesize
6.5MB
-
memory/4584-64-0x0000000007BE0000-0x0000000007BFA000-memory.dmpFilesize
104KB
-
memory/4584-65-0x0000000007C50000-0x0000000007C5A000-memory.dmpFilesize
40KB
-
memory/4584-36-0x0000000006530000-0x0000000006884000-memory.dmpFilesize
3.3MB
-
memory/4584-67-0x0000000007DE0000-0x0000000007DF1000-memory.dmpFilesize
68KB
-
memory/4584-68-0x0000000007E10000-0x0000000007E1E000-memory.dmpFilesize
56KB
-
memory/4584-69-0x0000000007E20000-0x0000000007E34000-memory.dmpFilesize
80KB
-
memory/4584-70-0x0000000007F20000-0x0000000007F3A000-memory.dmpFilesize
104KB
-
memory/4584-71-0x0000000007F00000-0x0000000007F08000-memory.dmpFilesize
32KB
-
memory/4584-74-0x0000000074A50000-0x0000000075200000-memory.dmpFilesize
7.7MB
-
memory/4584-18-0x0000000005A60000-0x0000000006088000-memory.dmpFilesize
6.2MB
-
memory/4864-7-0x0000000005020000-0x0000000005038000-memory.dmpFilesize
96KB
-
memory/4864-40-0x0000000074A50000-0x0000000075200000-memory.dmpFilesize
7.7MB
-
memory/4864-11-0x000000000CE00000-0x000000000CE9C000-memory.dmpFilesize
624KB
-
memory/4864-10-0x0000000009CA0000-0x0000000009D60000-memory.dmpFilesize
768KB
-
memory/4864-9-0x0000000005390000-0x00000000053A4000-memory.dmpFilesize
80KB
-
memory/4864-8-0x0000000005380000-0x000000000538E000-memory.dmpFilesize
56KB
-
memory/4864-0-0x00000000002E0000-0x00000000003D6000-memory.dmpFilesize
984KB
-
memory/4864-6-0x0000000007790000-0x000000000786E000-memory.dmpFilesize
888KB
-
memory/4864-5-0x0000000004DA0000-0x0000000004DAA000-memory.dmpFilesize
40KB
-
memory/4864-4-0x0000000005060000-0x0000000005070000-memory.dmpFilesize
64KB
-
memory/4864-3-0x0000000004DF0000-0x0000000004E82000-memory.dmpFilesize
584KB
-
memory/4864-2-0x00000000053A0000-0x0000000005944000-memory.dmpFilesize
5.6MB
-
memory/4864-1-0x0000000074A50000-0x0000000075200000-memory.dmpFilesize
7.7MB