Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
13-07-2024 06:32
Static task
static1
Behavioral task
behavioral1
Sample
5d0fc271f0606b92ab5c9ad53a790cb0N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5d0fc271f0606b92ab5c9ad53a790cb0N.exe
Resource
win10v2004-20240709-en
General
-
Target
5d0fc271f0606b92ab5c9ad53a790cb0N.exe
-
Size
1.8MB
-
MD5
5d0fc271f0606b92ab5c9ad53a790cb0
-
SHA1
c127a41f0cbd5fdb93126f99df6b411db705051c
-
SHA256
5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b
-
SHA512
295be396acfb54e1211a54479aa628d67ba6e0658533724b9b19e904bbbc509170fe53b3d4b179a7837f766a29a83d86d24baf8fdd52ae5068b83bd5f00ed7e5
-
SSDEEP
49152:9ayHCQ8W4dod2vKSsd4rGj8fCs4bIwaRsAOwcd0bVNtcqOjLc:UE8oQvj+wpwaqAOd0JcqY
Malware Config
Extracted
remcos
spacolombia2707RAPTOR
areaseguras.con-ip.com:2707
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
loggsdSSC
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Rmc121455011-7TOVMS
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
5d0fc271f0606b92ab5c9ad53a790cb0N.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pzpgzqlkyf = "C:\\Users\\Admin\\AppData\\Roaming\\Pzpgzqlkyf.exe" 5d0fc271f0606b92ab5c9ad53a790cb0N.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5d0fc271f0606b92ab5c9ad53a790cb0N.exedescription pid process target process PID 2128 set thread context of 3184 2128 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5d0fc271f0606b92ab5c9ad53a790cb0N.exedescription pid process Token: SeDebugPrivilege 2128 5d0fc271f0606b92ab5c9ad53a790cb0N.exe Token: SeDebugPrivilege 2128 5d0fc271f0606b92ab5c9ad53a790cb0N.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
5d0fc271f0606b92ab5c9ad53a790cb0N.exepid process 3184 5d0fc271f0606b92ab5c9ad53a790cb0N.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
5d0fc271f0606b92ab5c9ad53a790cb0N.exedescription pid process target process PID 2128 wrote to memory of 3184 2128 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe PID 2128 wrote to memory of 3184 2128 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe PID 2128 wrote to memory of 3184 2128 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe PID 2128 wrote to memory of 3184 2128 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe PID 2128 wrote to memory of 3184 2128 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe PID 2128 wrote to memory of 3184 2128 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe PID 2128 wrote to memory of 3184 2128 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe PID 2128 wrote to memory of 3184 2128 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe PID 2128 wrote to memory of 3184 2128 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe PID 2128 wrote to memory of 3184 2128 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe PID 2128 wrote to memory of 3184 2128 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe PID 2128 wrote to memory of 3184 2128 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe PID 2128 wrote to memory of 3184 2128 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d0fc271f0606b92ab5c9ad53a790cb0N.exe"C:\Users\Admin\AppData\Local\Temp\5d0fc271f0606b92ab5c9ad53a790cb0N.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\5d0fc271f0606b92ab5c9ad53a790cb0N.exe"C:\Users\Admin\AppData\Local\Temp\5d0fc271f0606b92ab5c9ad53a790cb0N.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:3184
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184B
MD5747914c9ae0818f2a44d54c155d886bc
SHA1a0369df5650daca266a9f7830eccc9b8aece8026
SHA25628b8aebb652b031a9dd0b0b01677f9474107dacc9f2fc16cd833c3a1680b857f
SHA5128f862b0e13109e3d6f2a46a0ea7dd8750648d106150a318ec510d4a1678d715f779992e8936b056438068427162d33f03209498bc8694eae5e2639b0f9bad982