Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 03:56
Static task
static1
Behavioral task
behavioral1
Sample
d6d9bd64b35182791b01933dcfce5cac49204c9040fc19c64b7ecb7f88d215e1.exe
Resource
win7-20240419-en
General
-
Target
d6d9bd64b35182791b01933dcfce5cac49204c9040fc19c64b7ecb7f88d215e1.exe
-
Size
1.7MB
-
MD5
625767ba7b66ed0d18c617d693d93157
-
SHA1
8d5823ea96c7587234014880c7901e97cea17d1a
-
SHA256
d6d9bd64b35182791b01933dcfce5cac49204c9040fc19c64b7ecb7f88d215e1
-
SHA512
7010ac5ee9980c2b49a2d203f63131b5fc204c231452118e0e42fd9ccb114c596435b0fd07d52813f5ab787e134cf1ae2218be91cda4f3ad258c849b390919a7
-
SSDEEP
24576:SD39v74lfGQrFUspugRNJI2DJ53J/J/L5dJPjY0:Sp7E+QrFUBgq2V
Malware Config
Extracted
remcos
Host
213.183.58.19:4000
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
read.dat
-
keylog_flag
false
-
keylog_folder
CastC
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_sccafsoidz
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
detects Windows exceutables potentially bypassing UAC using eventvwr.exe 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2800-50-0x0000000000080000-0x0000000000097000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer behavioral1/memory/2800-55-0x0000000000080000-0x0000000000097000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer behavioral1/memory/2800-48-0x0000000000080000-0x0000000000097000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer -
Executes dropped EXE 2 IoCs
Processes:
sbietrcl.exesbietrcl.exepid process 2780 sbietrcl.exe 2800 sbietrcl.exe -
Loads dropped DLL 1 IoCs
Processes:
d6d9bd64b35182791b01933dcfce5cac49204c9040fc19c64b7ecb7f88d215e1.exepid process 3024 d6d9bd64b35182791b01933dcfce5cac49204c9040fc19c64b7ecb7f88d215e1.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
d6d9bd64b35182791b01933dcfce5cac49204c9040fc19c64b7ecb7f88d215e1.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\sbietrcl.exe" d6d9bd64b35182791b01933dcfce5cac49204c9040fc19c64b7ecb7f88d215e1.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
sbietrcl.exedescription pid process target process PID 2780 set thread context of 2800 2780 sbietrcl.exe sbietrcl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
d6d9bd64b35182791b01933dcfce5cac49204c9040fc19c64b7ecb7f88d215e1.exesbietrcl.exepid process 3024 d6d9bd64b35182791b01933dcfce5cac49204c9040fc19c64b7ecb7f88d215e1.exe 3024 d6d9bd64b35182791b01933dcfce5cac49204c9040fc19c64b7ecb7f88d215e1.exe 3024 d6d9bd64b35182791b01933dcfce5cac49204c9040fc19c64b7ecb7f88d215e1.exe 3024 d6d9bd64b35182791b01933dcfce5cac49204c9040fc19c64b7ecb7f88d215e1.exe 3024 d6d9bd64b35182791b01933dcfce5cac49204c9040fc19c64b7ecb7f88d215e1.exe 3024 d6d9bd64b35182791b01933dcfce5cac49204c9040fc19c64b7ecb7f88d215e1.exe 2780 sbietrcl.exe 2780 sbietrcl.exe 2780 sbietrcl.exe 2780 sbietrcl.exe 2780 sbietrcl.exe 2780 sbietrcl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
d6d9bd64b35182791b01933dcfce5cac49204c9040fc19c64b7ecb7f88d215e1.exesbietrcl.exedescription pid process Token: SeDebugPrivilege 3024 d6d9bd64b35182791b01933dcfce5cac49204c9040fc19c64b7ecb7f88d215e1.exe Token: SeDebugPrivilege 2780 sbietrcl.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
d6d9bd64b35182791b01933dcfce5cac49204c9040fc19c64b7ecb7f88d215e1.exesbietrcl.exedescription pid process target process PID 3024 wrote to memory of 2780 3024 d6d9bd64b35182791b01933dcfce5cac49204c9040fc19c64b7ecb7f88d215e1.exe sbietrcl.exe PID 3024 wrote to memory of 2780 3024 d6d9bd64b35182791b01933dcfce5cac49204c9040fc19c64b7ecb7f88d215e1.exe sbietrcl.exe PID 3024 wrote to memory of 2780 3024 d6d9bd64b35182791b01933dcfce5cac49204c9040fc19c64b7ecb7f88d215e1.exe sbietrcl.exe PID 3024 wrote to memory of 2780 3024 d6d9bd64b35182791b01933dcfce5cac49204c9040fc19c64b7ecb7f88d215e1.exe sbietrcl.exe PID 2780 wrote to memory of 2800 2780 sbietrcl.exe sbietrcl.exe PID 2780 wrote to memory of 2800 2780 sbietrcl.exe sbietrcl.exe PID 2780 wrote to memory of 2800 2780 sbietrcl.exe sbietrcl.exe PID 2780 wrote to memory of 2800 2780 sbietrcl.exe sbietrcl.exe PID 2780 wrote to memory of 2800 2780 sbietrcl.exe sbietrcl.exe PID 2780 wrote to memory of 2800 2780 sbietrcl.exe sbietrcl.exe PID 2780 wrote to memory of 2800 2780 sbietrcl.exe sbietrcl.exe PID 2780 wrote to memory of 2800 2780 sbietrcl.exe sbietrcl.exe PID 2780 wrote to memory of 2800 2780 sbietrcl.exe sbietrcl.exe PID 2780 wrote to memory of 2800 2780 sbietrcl.exe sbietrcl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6d9bd64b35182791b01933dcfce5cac49204c9040fc19c64b7ecb7f88d215e1.exe"C:\Users\Admin\AppData\Local\Temp\d6d9bd64b35182791b01933dcfce5cac49204c9040fc19c64b7ecb7f88d215e1.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD50332f238b084a5d236f981e8f505c265
SHA1a05a8aadcd9d38a08812e0a4aa2653a29847c079
SHA256bc2c785233a8414871267a2425c5317f2fc26975f40119bafc67696f7d58b1aa
SHA5126a1ee5ce7f7b36ad0e280841aa7d527b24a33f5fe830f8e5fe6e96426d1344d525b277538117e51e6bae79a6787c45c312536bbe7cadb1ff69965a1280179d19
-
C:\Users\Admin\AppData\Local\Temp\Cab3756.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exeFilesize
1.7MB
MD54ffda793bb7c9b865294994a2dcd4d8a
SHA17ec88a38e25e5638b21d079c4644c22181fd7a49
SHA25683ef8492c4c1505379c06a1edf2b9e9ff0b7162d6c6077747dc521754a45ae0a
SHA512cf26b397d8dfaace8eaaf64313d928283a7bf731d4528e295647e3236a156cfc88a6bc59edd57bd3cf2b8b30ce0e2635b4f4c38633108b25f51af78c17b3e1d9
-
memory/2780-40-0x0000000073FE0000-0x000000007458B000-memory.dmpFilesize
5.7MB
-
memory/2780-58-0x0000000073FE0000-0x000000007458B000-memory.dmpFilesize
5.7MB
-
memory/2780-31-0x0000000073FE0000-0x000000007458B000-memory.dmpFilesize
5.7MB
-
memory/2780-41-0x0000000073FE0000-0x000000007458B000-memory.dmpFilesize
5.7MB
-
memory/2800-48-0x0000000000080000-0x0000000000097000-memory.dmpFilesize
92KB
-
memory/2800-42-0x0000000000080000-0x0000000000097000-memory.dmpFilesize
92KB
-
memory/2800-50-0x0000000000080000-0x0000000000097000-memory.dmpFilesize
92KB
-
memory/2800-55-0x0000000000080000-0x0000000000097000-memory.dmpFilesize
92KB
-
memory/2800-52-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2800-46-0x0000000000080000-0x0000000000097000-memory.dmpFilesize
92KB
-
memory/2800-44-0x0000000000080000-0x0000000000097000-memory.dmpFilesize
92KB
-
memory/3024-1-0x0000000073FE0000-0x000000007458B000-memory.dmpFilesize
5.7MB
-
memory/3024-11-0x0000000073FE0000-0x000000007458B000-memory.dmpFilesize
5.7MB
-
memory/3024-30-0x0000000073FE0000-0x000000007458B000-memory.dmpFilesize
5.7MB
-
memory/3024-12-0x0000000073FE0000-0x000000007458B000-memory.dmpFilesize
5.7MB
-
memory/3024-0-0x0000000073FE1000-0x0000000073FE2000-memory.dmpFilesize
4KB