Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13-07-2024 06:32
Static task
static1
Behavioral task
behavioral1
Sample
5d0fc271f0606b92ab5c9ad53a790cb0N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5d0fc271f0606b92ab5c9ad53a790cb0N.exe
Resource
win10v2004-20240709-en
General
-
Target
5d0fc271f0606b92ab5c9ad53a790cb0N.exe
-
Size
1.8MB
-
MD5
5d0fc271f0606b92ab5c9ad53a790cb0
-
SHA1
c127a41f0cbd5fdb93126f99df6b411db705051c
-
SHA256
5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b
-
SHA512
295be396acfb54e1211a54479aa628d67ba6e0658533724b9b19e904bbbc509170fe53b3d4b179a7837f766a29a83d86d24baf8fdd52ae5068b83bd5f00ed7e5
-
SSDEEP
49152:9ayHCQ8W4dod2vKSsd4rGj8fCs4bIwaRsAOwcd0bVNtcqOjLc:UE8oQvj+wpwaqAOd0JcqY
Malware Config
Extracted
remcos
spacolombia2707RAPTOR
areaseguras.con-ip.com:2707
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
loggsdSSC
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Rmc121455011-7TOVMS
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
5d0fc271f0606b92ab5c9ad53a790cb0N.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pzpgzqlkyf = "C:\\Users\\Admin\\AppData\\Roaming\\Pzpgzqlkyf.exe" 5d0fc271f0606b92ab5c9ad53a790cb0N.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5d0fc271f0606b92ab5c9ad53a790cb0N.exedescription pid process target process PID 1992 set thread context of 4412 1992 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5d0fc271f0606b92ab5c9ad53a790cb0N.exedescription pid process Token: SeDebugPrivilege 1992 5d0fc271f0606b92ab5c9ad53a790cb0N.exe Token: SeDebugPrivilege 1992 5d0fc271f0606b92ab5c9ad53a790cb0N.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
5d0fc271f0606b92ab5c9ad53a790cb0N.exepid process 4412 5d0fc271f0606b92ab5c9ad53a790cb0N.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
5d0fc271f0606b92ab5c9ad53a790cb0N.exedescription pid process target process PID 1992 wrote to memory of 4412 1992 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe PID 1992 wrote to memory of 4412 1992 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe PID 1992 wrote to memory of 4412 1992 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe PID 1992 wrote to memory of 4412 1992 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe PID 1992 wrote to memory of 4412 1992 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe PID 1992 wrote to memory of 4412 1992 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe PID 1992 wrote to memory of 4412 1992 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe PID 1992 wrote to memory of 4412 1992 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe PID 1992 wrote to memory of 4412 1992 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe PID 1992 wrote to memory of 4412 1992 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe PID 1992 wrote to memory of 4412 1992 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe PID 1992 wrote to memory of 4412 1992 5d0fc271f0606b92ab5c9ad53a790cb0N.exe 5d0fc271f0606b92ab5c9ad53a790cb0N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d0fc271f0606b92ab5c9ad53a790cb0N.exe"C:\Users\Admin\AppData\Local\Temp\5d0fc271f0606b92ab5c9ad53a790cb0N.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\5d0fc271f0606b92ab5c9ad53a790cb0N.exe"C:\Users\Admin\AppData\Local\Temp\5d0fc271f0606b92ab5c9ad53a790cb0N.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:4412
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184B
MD582c3adf6dd74b41775765e289e479b5e
SHA1895191e89f044cb21afaab41e38355b91c231597
SHA2566f0b216b78efa2d2e9162386e187a62038edf686552f00c77b32a0b85c8eb404
SHA51276beeaaf3d3b01c02aa1e9dcd322d4a1d167438b140888cee7c7fc500124acdea59ab8b6f329adb36a907ad3b185093d69b69ba93410f959fcd0fd5a6a040ba1