Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24-04-2024 01:01
Static task
static1
Behavioral task
behavioral1
Sample
Enquiry 230424.bat
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Enquiry 230424.bat
Resource
win10v2004-20240412-en
General
-
Target
Enquiry 230424.bat
-
Size
4.3MB
-
MD5
a9749727f9641b10363c264695ce4822
-
SHA1
1d3d5576790a9c72ddb03eaacac1bddd25d77477
-
SHA256
49cf050274b9a52bf56ac45d548d91c5a13c6d65c36bf363447ffa3f0143c078
-
SHA512
89ea33718530b8d3e9e4814d50c8e1d8047c2bb022c6ebc62b9479c34b6f34750a52a82b51f889d6f8fad5272bd92f2132899afee7bccdcd610a26ff7f067042
-
SSDEEP
49152:yEi0F7JFavH5JDy0oqMaKcCln2UE+EMKyGY6i6KyGY6i6KyGY6i6KyGY6i6KyGYO:I
Malware Config
Extracted
remcos
RemoteHost
127.0.0.1:47212
officerem.duckdns.org:47212
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-I8N3XG
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 22 IoCs
Processes:
resource yara_rule behavioral2/memory/1076-55-0x0000000015440000-0x0000000016440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/1076-57-0x0000000015440000-0x0000000016440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/1076-58-0x0000000015440000-0x0000000016440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/1076-59-0x0000000015440000-0x0000000016440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/1076-61-0x0000000015440000-0x0000000016440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/1076-62-0x0000000015440000-0x0000000016440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/1076-69-0x0000000015440000-0x0000000016440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/1076-70-0x0000000015440000-0x0000000016440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/1076-72-0x0000000015440000-0x0000000016440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/1076-80-0x0000000015440000-0x0000000016440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/1076-81-0x0000000015440000-0x0000000016440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/1076-83-0x0000000015440000-0x0000000016440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/1076-92-0x0000000015440000-0x0000000016440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/1076-93-0x0000000015440000-0x0000000016440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/1076-95-0x0000000015440000-0x0000000016440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/1076-96-0x0000000015440000-0x0000000016440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/1076-103-0x0000000015440000-0x0000000016440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/1076-104-0x0000000015440000-0x0000000016440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/1076-105-0x0000000015440000-0x0000000016440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/1076-114-0x0000000015440000-0x0000000016440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/1076-115-0x0000000015440000-0x0000000016440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM behavioral2/memory/1076-117-0x0000000015440000-0x0000000016440000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM -
ModiLoader Second Stage 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1076-30-0x0000000002980000-0x0000000003980000-memory.dmp modiloader_stage2 -
Executes dropped EXE 9 IoCs
Processes:
alpha.exealpha.exekn.exealpha.exekn.exesppsvc.pifalpha.exealpha.exeeasinvoker.exepid process 3832 alpha.exe 1012 alpha.exe 4008 kn.exe 4740 alpha.exe 3596 kn.exe 1076 sppsvc.pif 1412 alpha.exe 4828 alpha.exe 4880 easinvoker.exe -
Loads dropped DLL 1 IoCs
Processes:
easinvoker.exepid process 4880 easinvoker.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
sppsvc.pifdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rwksdoeb = "C:\\Users\\Public\\Rwksdoeb.url" sppsvc.pif -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
xcopy.exexcopy.exexcopy.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 47 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
sppsvc.pifpid process 1076 sppsvc.pif -
Suspicious use of WriteProcessMemory 47 IoCs
Processes:
cmd.exealpha.exealpha.exealpha.exesppsvc.pifcmd.exedescription pid process target process PID 1388 wrote to memory of 2632 1388 cmd.exe extrac32.exe PID 1388 wrote to memory of 2632 1388 cmd.exe extrac32.exe PID 1388 wrote to memory of 3832 1388 cmd.exe alpha.exe PID 1388 wrote to memory of 3832 1388 cmd.exe alpha.exe PID 3832 wrote to memory of 4872 3832 alpha.exe extrac32.exe PID 3832 wrote to memory of 4872 3832 alpha.exe extrac32.exe PID 1388 wrote to memory of 1012 1388 cmd.exe alpha.exe PID 1388 wrote to memory of 1012 1388 cmd.exe alpha.exe PID 1012 wrote to memory of 4008 1012 alpha.exe kn.exe PID 1012 wrote to memory of 4008 1012 alpha.exe kn.exe PID 1388 wrote to memory of 4740 1388 cmd.exe alpha.exe PID 1388 wrote to memory of 4740 1388 cmd.exe alpha.exe PID 4740 wrote to memory of 3596 4740 alpha.exe kn.exe PID 4740 wrote to memory of 3596 4740 alpha.exe kn.exe PID 1388 wrote to memory of 1076 1388 cmd.exe sppsvc.pif PID 1388 wrote to memory of 1076 1388 cmd.exe sppsvc.pif PID 1388 wrote to memory of 1076 1388 cmd.exe sppsvc.pif PID 1388 wrote to memory of 1412 1388 cmd.exe alpha.exe PID 1388 wrote to memory of 1412 1388 cmd.exe alpha.exe PID 1388 wrote to memory of 4828 1388 cmd.exe alpha.exe PID 1388 wrote to memory of 4828 1388 cmd.exe alpha.exe PID 1076 wrote to memory of 2676 1076 sppsvc.pif cmd.exe PID 1076 wrote to memory of 2676 1076 sppsvc.pif cmd.exe PID 1076 wrote to memory of 2676 1076 sppsvc.pif cmd.exe PID 2676 wrote to memory of 244 2676 cmd.exe cmd.exe PID 2676 wrote to memory of 244 2676 cmd.exe cmd.exe PID 2676 wrote to memory of 244 2676 cmd.exe cmd.exe PID 2676 wrote to memory of 4192 2676 cmd.exe xcopy.exe PID 2676 wrote to memory of 4192 2676 cmd.exe xcopy.exe PID 2676 wrote to memory of 4192 2676 cmd.exe xcopy.exe PID 2676 wrote to memory of 428 2676 cmd.exe cmd.exe PID 2676 wrote to memory of 428 2676 cmd.exe cmd.exe PID 2676 wrote to memory of 428 2676 cmd.exe cmd.exe PID 2676 wrote to memory of 4348 2676 cmd.exe xcopy.exe PID 2676 wrote to memory of 4348 2676 cmd.exe xcopy.exe PID 2676 wrote to memory of 4348 2676 cmd.exe xcopy.exe PID 2676 wrote to memory of 3036 2676 cmd.exe cmd.exe PID 2676 wrote to memory of 3036 2676 cmd.exe cmd.exe PID 2676 wrote to memory of 3036 2676 cmd.exe cmd.exe PID 2676 wrote to memory of 1464 2676 cmd.exe xcopy.exe PID 2676 wrote to memory of 1464 2676 cmd.exe xcopy.exe PID 2676 wrote to memory of 1464 2676 cmd.exe xcopy.exe PID 2676 wrote to memory of 4880 2676 cmd.exe easinvoker.exe PID 2676 wrote to memory of 4880 2676 cmd.exe easinvoker.exe PID 1076 wrote to memory of 408 1076 sppsvc.pif extrac32.exe PID 1076 wrote to memory of 408 1076 sppsvc.pif extrac32.exe PID 1076 wrote to memory of 408 1076 sppsvc.pif extrac32.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Enquiry 230424.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\extrac32.exeC:\\Windows\\System32\\extrac32.exe /C /Y C:\\Windows\\System32\\cmd.exe C:\\Users\\Public\\alpha.exe2⤵
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c extrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\extrac32.exeextrac32.exe /C /Y C:\\Windows\\System32\\certutil.exe C:\\Users\\Public\\kn.exe3⤵
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\Enquiry 230424.bat" "C:\\Users\\Public\\sppsvc.rtf" 92⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\Users\Admin\AppData\Local\Temp\Enquiry 230424.bat" "C:\\Users\\Public\\sppsvc.rtf" 93⤵
- Executes dropped EXE
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c C:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 122⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\kn.exeC:\\Users\\Public\\kn -decodehex -F "C:\\Users\\Public\\sppsvc.rtf" "C:\\Users\\Public\\Libraries\\sppsvc.pif" 123⤵
- Executes dropped EXE
-
C:\Users\Public\Libraries\sppsvc.pifC:\Users\Public\Libraries\sppsvc.pif2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\RwksdoebO.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO F"4⤵
-
C:\Windows\SysWOW64\xcopy.exexcopy "easinvoker.exe" "C:\Windows \System32\" /K /D /H /Y4⤵
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO F"4⤵
-
C:\Windows\SysWOW64\xcopy.exexcopy "Aaa.bat" "C:\Windows \System32\" /K /D /H /Y4⤵
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO F"4⤵
-
C:\Windows\SysWOW64\xcopy.exexcopy "netutils.dll" "C:\Windows \System32\" /K /D /H /Y4⤵
- Enumerates system info in registry
-
C:\Windows \System32\easinvoker.exe"C:\Windows \System32\easinvoker.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\extrac32.exeC:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Public\Libraries\sppsvc.pif C:\\Users\\Public\\Libraries\\Rwksdoeb.PIF3⤵
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del "C:\Users\Public\sppsvc.rtf" / A / F / Q / S2⤵
- Executes dropped EXE
-
C:\Users\Public\alpha.exeC:\\Users\\Public\\alpha /c del "C:\Users\Public\kn.exe" / A / F / Q / S2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\remcos\logs.datFilesize
144B
MD5c6d1d7936068dfaf679c5b447a5d67ee
SHA1336dfcfd78d560d1d0a699c227d86ede640eae73
SHA256e922c2cb938a746335f825d077e81dda051a18edaa5a514e42347b83e1e00572
SHA512d12ff121877afa030dd4cfbb73985ec9709dee889ad4e47b1ace0ba2b834ddd5cc48b7b41072318a2828881b3e3374121f74586de3d342d1a70099de67039cd0
-
C:\Users\Public\Libraries\RwksdoebO.batFilesize
29KB
MD5828ffbf60677999579dafe4bf3919c63
SHA1a0d159a1b9a49e9eaccc53fe0c3266c0526a1bdc
SHA256abac4a967800f5da708572ec42441ec373cd52459a83a8a382d6b8579482789d
SHA512bf00909e24c5a6fb2346e8457a9adacd5f1b35988d90abbde9ff26896bbb59edafea60d9db4d10182a7b5e129bb69585d3e20bc5c63af3517b3a7ef1e45ffb7e
-
C:\Users\Public\Libraries\easinvoker.exeFilesize
128KB
MD5231ce1e1d7d98b44371ffff407d68b59
SHA125510d0f6353dbf0c9f72fc880de7585e34b28ff
SHA25630951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96
SHA512520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612
-
C:\Users\Public\Libraries\netutils.dllFilesize
112KB
MD56baaea4d3a65281b55173738795eb02c
SHA11fbe7ec7f5e2d1fb0ab1807e149eee66a86f9224
SHA2560007fa57da2e1de2e487492d00b99abaeca7e9f9cac8a10e24eb569e19f76ee1
SHA512af0285cf961aeae960ede41f195809e9b84ccb262f17f2e994da5c599ebdf712788e5a3f2e0e2ed16e67aa888bdabfd7a6096ad8dda2d062d2f82b010e81d5c5
-
C:\Users\Public\Libraries\sppsvc.pifFilesize
1.6MB
MD5dee7b7ad4c8bdd4cbe56469e34a8cadd
SHA1f723d5895c324e4454b68de3bc031b627e720ac4
SHA2567f39a73e476fd5ceea7099aaceda19836990529cba7b032244a892ddd785fe02
SHA5126af58088d2016354e4a61beedf6c11b3e7a0cd14d2aef5f6c3a3f9ed56b2feb52132fff09e9c5b13b8a99d2f754bfeeb962bba5956d8bdc21d0be8072352a419
-
C:\Users\Public\alpha.exeFilesize
283KB
MD58a2122e8162dbef04694b9c3e0b6cdee
SHA1f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA256b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
SHA51299e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397
-
C:\Users\Public\kn.exeFilesize
1.6MB
MD5bd8d9943a9b1def98eb83e0fa48796c2
SHA170e89852f023ab7cde0173eda1208dbb580f1e4f
SHA2568de7b4eb1301d6cbe4ea2c8d13b83280453eb64e3b3c80756bbd1560d65ca4d2
SHA51295630fdddad5db60cc97ec76ee1ca02dbb00ee3de7d6957ecda8968570e067ab2a9df1cc07a3ce61161a994acbe8417c83661320b54d04609818009a82552f7b
-
C:\Users\Public\sppsvc.rtfFilesize
3.1MB
MD5063a2a4888ffd2c1e64898bed64e9aa7
SHA1087cf84d030b805f9e574c3010d40bdd3d7503b5
SHA256c894d82ed3f2d258c9f663afdd16b4c1d90f0d0c57fa13707811524c5e9e30b0
SHA512a36ce728252252dbab3e800f666072923955e2f1fd262893624cbfa7a256dbb79b148be2881af9ec903fadd799e0796d9c12e34d17f4c8b8f494daa55d3e3cdb
-
memory/1076-61-0x0000000015440000-0x0000000016440000-memory.dmpFilesize
16.0MB
-
memory/1076-72-0x0000000015440000-0x0000000016440000-memory.dmpFilesize
16.0MB
-
memory/1076-30-0x0000000002980000-0x0000000003980000-memory.dmpFilesize
16.0MB
-
memory/1076-117-0x0000000015440000-0x0000000016440000-memory.dmpFilesize
16.0MB
-
memory/1076-55-0x0000000015440000-0x0000000016440000-memory.dmpFilesize
16.0MB
-
memory/1076-57-0x0000000015440000-0x0000000016440000-memory.dmpFilesize
16.0MB
-
memory/1076-58-0x0000000015440000-0x0000000016440000-memory.dmpFilesize
16.0MB
-
memory/1076-59-0x0000000015440000-0x0000000016440000-memory.dmpFilesize
16.0MB
-
memory/1076-29-0x0000000002980000-0x0000000003980000-memory.dmpFilesize
16.0MB
-
memory/1076-62-0x0000000015440000-0x0000000016440000-memory.dmpFilesize
16.0MB
-
memory/1076-69-0x0000000015440000-0x0000000016440000-memory.dmpFilesize
16.0MB
-
memory/1076-70-0x0000000015440000-0x0000000016440000-memory.dmpFilesize
16.0MB
-
memory/1076-27-0x0000000002250000-0x0000000002251000-memory.dmpFilesize
4KB
-
memory/1076-32-0x0000000000400000-0x000000000059C000-memory.dmpFilesize
1.6MB
-
memory/1076-80-0x0000000015440000-0x0000000016440000-memory.dmpFilesize
16.0MB
-
memory/1076-81-0x0000000015440000-0x0000000016440000-memory.dmpFilesize
16.0MB
-
memory/1076-83-0x0000000015440000-0x0000000016440000-memory.dmpFilesize
16.0MB
-
memory/1076-92-0x0000000015440000-0x0000000016440000-memory.dmpFilesize
16.0MB
-
memory/1076-93-0x0000000015440000-0x0000000016440000-memory.dmpFilesize
16.0MB
-
memory/1076-95-0x0000000015440000-0x0000000016440000-memory.dmpFilesize
16.0MB
-
memory/1076-96-0x0000000015440000-0x0000000016440000-memory.dmpFilesize
16.0MB
-
memory/1076-103-0x0000000015440000-0x0000000016440000-memory.dmpFilesize
16.0MB
-
memory/1076-104-0x0000000015440000-0x0000000016440000-memory.dmpFilesize
16.0MB
-
memory/1076-105-0x0000000015440000-0x0000000016440000-memory.dmpFilesize
16.0MB
-
memory/1076-114-0x0000000015440000-0x0000000016440000-memory.dmpFilesize
16.0MB
-
memory/1076-115-0x0000000015440000-0x0000000016440000-memory.dmpFilesize
16.0MB
-
memory/4880-49-0x00000000613C0000-0x00000000613E3000-memory.dmpFilesize
140KB