Analysis
-
max time kernel
148s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12-07-2024 23:45
Static task
static1
Behavioral task
behavioral1
Sample
PO 11072024.exe
Resource
win7-20240708-en
General
-
Target
PO 11072024.exe
-
Size
999KB
-
MD5
04a0409b44c06cd15f68cef8bdfc9b17
-
SHA1
ec17ab0fb9a01fa208da02445056b68f30232520
-
SHA256
f6bf4471924e9dba31be59f8b96df06d02c69416c4c0518148507ff5b8f7cd48
-
SHA512
48fad9e7c7a3a7686b308a4e1b0d122e00b964b6c179f31d54bd6207c9b085cb0aa246c7b4b6ec1f875d84f33582058b63353f8db11f20760f5084a3efb8b8ac
-
SSDEEP
24576:iLl1+oR/hMvKHTnJkRvxAMAvu2lHu6wRudqGlXSo:AZqVxAzvuOKqfS
Malware Config
Extracted
remcos
5764576
172.93.218.178:45667
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
765-XJJE0J
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PO 11072024.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation PO 11072024.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PO 11072024.exedescription pid process target process PID 2472 set thread context of 5100 2472 PO 11072024.exe PO 11072024.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 3468 powershell.exe 3468 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3468 powershell.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
PO 11072024.exedescription pid process target process PID 2472 wrote to memory of 3468 2472 PO 11072024.exe powershell.exe PID 2472 wrote to memory of 3468 2472 PO 11072024.exe powershell.exe PID 2472 wrote to memory of 3468 2472 PO 11072024.exe powershell.exe PID 2472 wrote to memory of 3480 2472 PO 11072024.exe schtasks.exe PID 2472 wrote to memory of 3480 2472 PO 11072024.exe schtasks.exe PID 2472 wrote to memory of 3480 2472 PO 11072024.exe schtasks.exe PID 2472 wrote to memory of 5100 2472 PO 11072024.exe PO 11072024.exe PID 2472 wrote to memory of 5100 2472 PO 11072024.exe PO 11072024.exe PID 2472 wrote to memory of 5100 2472 PO 11072024.exe PO 11072024.exe PID 2472 wrote to memory of 5100 2472 PO 11072024.exe PO 11072024.exe PID 2472 wrote to memory of 5100 2472 PO 11072024.exe PO 11072024.exe PID 2472 wrote to memory of 5100 2472 PO 11072024.exe PO 11072024.exe PID 2472 wrote to memory of 5100 2472 PO 11072024.exe PO 11072024.exe PID 2472 wrote to memory of 5100 2472 PO 11072024.exe PO 11072024.exe PID 2472 wrote to memory of 5100 2472 PO 11072024.exe PO 11072024.exe PID 2472 wrote to memory of 5100 2472 PO 11072024.exe PO 11072024.exe PID 2472 wrote to memory of 5100 2472 PO 11072024.exe PO 11072024.exe PID 2472 wrote to memory of 5100 2472 PO 11072024.exe PO 11072024.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO 11072024.exe"C:\Users\Admin\AppData\Local\Temp\PO 11072024.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ppUSXdJgAIFILG.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3468 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ppUSXdJgAIFILG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF79E.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\PO 11072024.exe"C:\Users\Admin\AppData\Local\Temp\PO 11072024.exe"2⤵PID:5100
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD58a95b7f85db23348fd1e456b30fedede
SHA189b5304104279657eb8982ad8cd58834c8bfc283
SHA2560a41df1ae34d3417881f569b1ad05c40384e961cfb992596e49cdd240af644cd
SHA51294aa7a20c03077738396e47198c374c5a4f80097b0d79fe85dfeea9d3fd31db2928c1dbc942b6b0f647a63c3d7715ef8e13a71a820f0ffaa38ad57a4e0a56977