Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 00:11
Static task
static1
Behavioral task
behavioral1
Sample
Quote List.exe
Resource
win7-20240221-en
General
-
Target
Quote List.exe
-
Size
958KB
-
MD5
e2c7999f00c70d031a43c537714f7b52
-
SHA1
66306e6916c8760cbf99fa57431f56d2faf41acf
-
SHA256
70029840a2c10f707e5b6bee6a48c4c7fb1fc3efe79215d7bb01c5e2967848cb
-
SHA512
8820e701b0cdd135e295059e3971404513f9895567e91f4988ed8e168feebf6c6e1b781bbe6684496db70272b2e86d18bd69c369ee93c4614bd5a00b8db9b116
-
SSDEEP
12288:QWET/mr9KL0dPVbYuEfa3cFuX59v1vWePcN9fS0TUo12M+trJHgEyjd2u5Bh:QWtO0J/mgco9Rq9q0QUOHGjs
Malware Config
Extracted
remcos
76364
103.150.8.12:5689
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-FF0K7G
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Quote List.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation Quote List.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Quote List.exedescription pid process target process PID 2468 set thread context of 3320 2468 Quote List.exe Quote List.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 3648 powershell.exe 3648 powershell.exe 3648 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3648 powershell.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Quote List.exedescription pid process target process PID 2468 wrote to memory of 3648 2468 Quote List.exe powershell.exe PID 2468 wrote to memory of 3648 2468 Quote List.exe powershell.exe PID 2468 wrote to memory of 3648 2468 Quote List.exe powershell.exe PID 2468 wrote to memory of 3052 2468 Quote List.exe schtasks.exe PID 2468 wrote to memory of 3052 2468 Quote List.exe schtasks.exe PID 2468 wrote to memory of 3052 2468 Quote List.exe schtasks.exe PID 2468 wrote to memory of 3320 2468 Quote List.exe Quote List.exe PID 2468 wrote to memory of 3320 2468 Quote List.exe Quote List.exe PID 2468 wrote to memory of 3320 2468 Quote List.exe Quote List.exe PID 2468 wrote to memory of 3320 2468 Quote List.exe Quote List.exe PID 2468 wrote to memory of 3320 2468 Quote List.exe Quote List.exe PID 2468 wrote to memory of 3320 2468 Quote List.exe Quote List.exe PID 2468 wrote to memory of 3320 2468 Quote List.exe Quote List.exe PID 2468 wrote to memory of 3320 2468 Quote List.exe Quote List.exe PID 2468 wrote to memory of 3320 2468 Quote List.exe Quote List.exe PID 2468 wrote to memory of 3320 2468 Quote List.exe Quote List.exe PID 2468 wrote to memory of 3320 2468 Quote List.exe Quote List.exe PID 2468 wrote to memory of 3320 2468 Quote List.exe Quote List.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quote List.exe"C:\Users\Admin\AppData\Local\Temp\Quote List.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mINGIl.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mINGIl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp84DB.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Quote List.exe"C:\Users\Admin\AppData\Local\Temp\Quote List.exe"2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4248 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yzar3nzp.3dk.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp84DB.tmpFilesize
1KB
MD57661446f30765932f5052335df330292
SHA13b605aff212f9d9752deeb6157cc4ffdf43d2199
SHA256c9f2c1e2ae4be59056f7198bc0ed2e3e99bdf983c39e5cd1703bb76e61646af6
SHA51208f2fc5fa24eb5951daadec6ec3b5d1d1b692de9f603779a16ddb1706946e8daedcbc8d098f0d68d5d2fa78073b9dad00b0f50535e3b8359982f9dd8d94f5630
-
memory/2468-5-0x0000000005010000-0x000000000501A000-memory.dmpFilesize
40KB
-
memory/2468-2-0x00000000055E0000-0x0000000005B84000-memory.dmpFilesize
5.6MB
-
memory/2468-3-0x0000000005030000-0x00000000050C2000-memory.dmpFilesize
584KB
-
memory/2468-4-0x0000000074D90000-0x0000000075540000-memory.dmpFilesize
7.7MB
-
memory/2468-27-0x0000000074D90000-0x0000000075540000-memory.dmpFilesize
7.7MB
-
memory/2468-6-0x00000000053B0000-0x00000000053D2000-memory.dmpFilesize
136KB
-
memory/2468-7-0x00000000053D0000-0x00000000053DC000-memory.dmpFilesize
48KB
-
memory/2468-8-0x00000000053E0000-0x00000000053F0000-memory.dmpFilesize
64KB
-
memory/2468-9-0x000000000D390000-0x000000000D44E000-memory.dmpFilesize
760KB
-
memory/2468-10-0x0000000010BC0000-0x0000000010C5C000-memory.dmpFilesize
624KB
-
memory/2468-14-0x0000000074D9E000-0x0000000074D9F000-memory.dmpFilesize
4KB
-
memory/2468-1-0x0000000000510000-0x0000000000606000-memory.dmpFilesize
984KB
-
memory/2468-0-0x0000000074D9E000-0x0000000074D9F000-memory.dmpFilesize
4KB
-
memory/3320-25-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3320-77-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3320-26-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3320-24-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3320-28-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3320-81-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3320-80-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3320-79-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3320-78-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3320-63-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3320-76-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3320-75-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3320-20-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3320-21-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3320-74-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3320-73-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3320-69-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/3648-41-0x00000000063E0000-0x0000000006734000-memory.dmpFilesize
3.3MB
-
memory/3648-55-0x0000000006EE0000-0x0000000006EFE000-memory.dmpFilesize
120KB
-
memory/3648-56-0x0000000007B70000-0x0000000007C13000-memory.dmpFilesize
652KB
-
memory/3648-57-0x00000000082A0000-0x000000000891A000-memory.dmpFilesize
6.5MB
-
memory/3648-58-0x0000000007C40000-0x0000000007C5A000-memory.dmpFilesize
104KB
-
memory/3648-59-0x0000000007CB0000-0x0000000007CBA000-memory.dmpFilesize
40KB
-
memory/3648-60-0x0000000074D90000-0x0000000075540000-memory.dmpFilesize
7.7MB
-
memory/3648-61-0x0000000007EC0000-0x0000000007F56000-memory.dmpFilesize
600KB
-
memory/3648-62-0x0000000007E40000-0x0000000007E51000-memory.dmpFilesize
68KB
-
memory/3648-45-0x0000000071680000-0x00000000716CC000-memory.dmpFilesize
304KB
-
memory/3648-64-0x0000000007E70000-0x0000000007E7E000-memory.dmpFilesize
56KB
-
memory/3648-65-0x0000000007E80000-0x0000000007E94000-memory.dmpFilesize
80KB
-
memory/3648-66-0x0000000007F80000-0x0000000007F9A000-memory.dmpFilesize
104KB
-
memory/3648-67-0x0000000007F60000-0x0000000007F68000-memory.dmpFilesize
32KB
-
memory/3648-68-0x0000000074D90000-0x0000000075540000-memory.dmpFilesize
7.7MB
-
memory/3648-44-0x0000000006F00000-0x0000000006F32000-memory.dmpFilesize
200KB
-
memory/3648-72-0x0000000074D90000-0x0000000075540000-memory.dmpFilesize
7.7MB
-
memory/3648-43-0x0000000006970000-0x00000000069BC000-memory.dmpFilesize
304KB
-
memory/3648-42-0x0000000006890000-0x00000000068AE000-memory.dmpFilesize
120KB
-
memory/3648-31-0x0000000006230000-0x0000000006296000-memory.dmpFilesize
408KB
-
memory/3648-30-0x00000000060D0000-0x0000000006136000-memory.dmpFilesize
408KB
-
memory/3648-29-0x00000000057C0000-0x00000000057E2000-memory.dmpFilesize
136KB
-
memory/3648-22-0x0000000005930000-0x0000000005F58000-memory.dmpFilesize
6.2MB
-
memory/3648-19-0x0000000074D90000-0x0000000075540000-memory.dmpFilesize
7.7MB
-
memory/3648-18-0x0000000074D90000-0x0000000075540000-memory.dmpFilesize
7.7MB
-
memory/3648-16-0x0000000002F50000-0x0000000002F86000-memory.dmpFilesize
216KB