Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 16:06
Static task
static1
Behavioral task
behavioral1
Sample
PEDIDO DE COMPRA I122825.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
PEDIDO DE COMPRA I122825.exe
Resource
win10v2004-20240508-en
General
-
Target
PEDIDO DE COMPRA I122825.exe
-
Size
975KB
-
MD5
6bc3017aa0b572802c23e8fad4c7a612
-
SHA1
262fb0d7951854d4ba58ad2a38480fb0bbe4f6d1
-
SHA256
062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5
-
SHA512
86c6dd6d2786d01990d86b4b69d624aa373f441e4b25f6730071a5336eb32939874e8c9dd445330dfa33a5598c23c7427b6a741ecdc178678507fcab0a1b1354
-
SSDEEP
24576:8LZq8lDaXLp5C7UMUoloIG8h3IP8trNwNoZ:8oUDaXLnC7Ia68FCO
Malware Config
Extracted
remcos
RemoteHost
46.183.223.69:13452
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-UJROWN
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PEDIDO DE COMPRA I122825.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation PEDIDO DE COMPRA I122825.exe -
Executes dropped EXE 2 IoCs
Processes:
remcos.exeremcos.exepid process 384 remcos.exe 1300 remcos.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
remcos.exePEDIDO DE COMPRA I122825.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-UJROWN = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" remcos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-UJROWN = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-UJROWN = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" PEDIDO DE COMPRA I122825.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-UJROWN = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" PEDIDO DE COMPRA I122825.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
PEDIDO DE COMPRA I122825.exeremcos.exedescription pid process target process PID 1160 set thread context of 3452 1160 PEDIDO DE COMPRA I122825.exe PEDIDO DE COMPRA I122825.exe PID 384 set thread context of 1300 384 remcos.exe remcos.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
remcos.exepid process 1300 remcos.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
PEDIDO DE COMPRA I122825.exePEDIDO DE COMPRA I122825.exeremcos.exedescription pid process target process PID 1160 wrote to memory of 3452 1160 PEDIDO DE COMPRA I122825.exe PEDIDO DE COMPRA I122825.exe PID 1160 wrote to memory of 3452 1160 PEDIDO DE COMPRA I122825.exe PEDIDO DE COMPRA I122825.exe PID 1160 wrote to memory of 3452 1160 PEDIDO DE COMPRA I122825.exe PEDIDO DE COMPRA I122825.exe PID 1160 wrote to memory of 3452 1160 PEDIDO DE COMPRA I122825.exe PEDIDO DE COMPRA I122825.exe PID 1160 wrote to memory of 3452 1160 PEDIDO DE COMPRA I122825.exe PEDIDO DE COMPRA I122825.exe PID 1160 wrote to memory of 3452 1160 PEDIDO DE COMPRA I122825.exe PEDIDO DE COMPRA I122825.exe PID 1160 wrote to memory of 3452 1160 PEDIDO DE COMPRA I122825.exe PEDIDO DE COMPRA I122825.exe PID 1160 wrote to memory of 3452 1160 PEDIDO DE COMPRA I122825.exe PEDIDO DE COMPRA I122825.exe PID 1160 wrote to memory of 3452 1160 PEDIDO DE COMPRA I122825.exe PEDIDO DE COMPRA I122825.exe PID 1160 wrote to memory of 3452 1160 PEDIDO DE COMPRA I122825.exe PEDIDO DE COMPRA I122825.exe PID 1160 wrote to memory of 3452 1160 PEDIDO DE COMPRA I122825.exe PEDIDO DE COMPRA I122825.exe PID 1160 wrote to memory of 3452 1160 PEDIDO DE COMPRA I122825.exe PEDIDO DE COMPRA I122825.exe PID 3452 wrote to memory of 384 3452 PEDIDO DE COMPRA I122825.exe remcos.exe PID 3452 wrote to memory of 384 3452 PEDIDO DE COMPRA I122825.exe remcos.exe PID 3452 wrote to memory of 384 3452 PEDIDO DE COMPRA I122825.exe remcos.exe PID 384 wrote to memory of 1300 384 remcos.exe remcos.exe PID 384 wrote to memory of 1300 384 remcos.exe remcos.exe PID 384 wrote to memory of 1300 384 remcos.exe remcos.exe PID 384 wrote to memory of 1300 384 remcos.exe remcos.exe PID 384 wrote to memory of 1300 384 remcos.exe remcos.exe PID 384 wrote to memory of 1300 384 remcos.exe remcos.exe PID 384 wrote to memory of 1300 384 remcos.exe remcos.exe PID 384 wrote to memory of 1300 384 remcos.exe remcos.exe PID 384 wrote to memory of 1300 384 remcos.exe remcos.exe PID 384 wrote to memory of 1300 384 remcos.exe remcos.exe PID 384 wrote to memory of 1300 384 remcos.exe remcos.exe PID 384 wrote to memory of 1300 384 remcos.exe remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PEDIDO DE COMPRA I122825.exe"C:\Users\Admin\AppData\Local\Temp\PEDIDO DE COMPRA I122825.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\PEDIDO DE COMPRA I122825.exe"C:\Users\Admin\AppData\Local\Temp\PEDIDO DE COMPRA I122825.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\ProgramData\Remcos\remcos.exe"C:\ProgramData\Remcos\remcos.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:384 -
C:\ProgramData\Remcos\remcos.exe"C:\ProgramData\Remcos\remcos.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1300
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD59b8b9afad9422cc48caa31e5fbc127c8
SHA11a1bd3dd93a8ef43be12b863585f35fe067256b9
SHA256933688623b2919c80e11ccafa57d9efd25dcffec6fbf79b5f039f66deb1a378f
SHA512b3eeff2b0daf113695cc0e6b01348fcff025909bb8f971963307ba32edbc5b0017d346b5cdc54a06f8c262ccc52d7641c55531f51529160114f443ec7e813a37
-
Filesize
975KB
MD56bc3017aa0b572802c23e8fad4c7a612
SHA1262fb0d7951854d4ba58ad2a38480fb0bbe4f6d1
SHA256062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5
SHA51286c6dd6d2786d01990d86b4b69d624aa373f441e4b25f6730071a5336eb32939874e8c9dd445330dfa33a5598c23c7427b6a741ecdc178678507fcab0a1b1354