Analysis
-
max time kernel
147s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24-04-2024 02:17
Static task
static1
Behavioral task
behavioral1
Sample
2023_TAX_ORGANIZER/Tax Organizer.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2023_TAX_ORGANIZER/Tax Organizer.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
2023_TAX_ORGANIZER/g2m.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
2023_TAX_ORGANIZER/g2m.dll
Resource
win10v2004-20240412-en
General
-
Target
2023_TAX_ORGANIZER/g2m.dll
-
Size
6.6MB
-
MD5
dd2a773c6b767755a12e43c02f07d0f4
-
SHA1
8dac463057c09eca19e4dbadfb3daa2bf501c53e
-
SHA256
09173af3144979177cd188a990000eba43d627ac5728969a78f186124dc2255b
-
SHA512
27790b9366a78d4b4e2f368073cb101d8f73b63d989a51396e81d22cf2c8b30736d302d5f434e87cdc584d0e38a5ee9b748be0e832d4f8494fdc8faa99c776dc
-
SSDEEP
98304:nHQXidDnBW0hcthSDnqDO5rzRQfaxcxV4dqahqlO:6i9gDmyhu+M
Malware Config
Extracted
remcos
RemoteHost
faststaynow.duckdns.org:5057
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-Q95C1N
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*Chrome = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\HEARTB.dll,EntryPoint" reg.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
regsvr32.exepid process 2092 regsvr32.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
regsvr32.exeregsvr32.execmd.exedescription pid process target process PID 4420 wrote to memory of 2092 4420 regsvr32.exe regsvr32.exe PID 4420 wrote to memory of 2092 4420 regsvr32.exe regsvr32.exe PID 4420 wrote to memory of 2092 4420 regsvr32.exe regsvr32.exe PID 2092 wrote to memory of 1812 2092 regsvr32.exe regsvr32.exe PID 2092 wrote to memory of 1812 2092 regsvr32.exe regsvr32.exe PID 2092 wrote to memory of 1812 2092 regsvr32.exe regsvr32.exe PID 2092 wrote to memory of 1812 2092 regsvr32.exe regsvr32.exe PID 2092 wrote to memory of 1812 2092 regsvr32.exe regsvr32.exe PID 2092 wrote to memory of 1812 2092 regsvr32.exe regsvr32.exe PID 2092 wrote to memory of 5112 2092 regsvr32.exe cmd.exe PID 2092 wrote to memory of 5112 2092 regsvr32.exe cmd.exe PID 2092 wrote to memory of 5112 2092 regsvr32.exe cmd.exe PID 5112 wrote to memory of 4840 5112 cmd.exe reg.exe PID 5112 wrote to memory of 4840 5112 cmd.exe reg.exe PID 5112 wrote to memory of 4840 5112 cmd.exe reg.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2023_TAX_ORGANIZER\g2m.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\2023_TAX_ORGANIZER\g2m.dll2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe"3⤵PID:1812
-
C:\Windows\SysWOW64\cmd.execmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\Admin\AppData\Roaming\HEARTB.dll",EntryPoint /f & exit3⤵
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\Admin\AppData\Roaming\HEARTB.dll",EntryPoint /f4⤵
- Adds Run key to start application
PID:4840