Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23-07-2024 04:57
Static task
static1
Behavioral task
behavioral1
Sample
fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exe
Resource
win7-20240708-en
General
-
Target
fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exe
-
Size
1.3MB
-
MD5
f3dcd81603a7b53421fcedce515a7c80
-
SHA1
6f5e15a2415801651cbe54b63eeaddd7df07ab45
-
SHA256
fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab
-
SHA512
f5e969de331afee0b3bed2a58d5159d95c9bbe93eb419980fe061cdcac8de94cc4dfcdd917951c9b6af0003f58f737f7716884472b1fb11a334af78073f51220
-
SSDEEP
24576:fAHnh+eWsN3skA4RV1Hom2KXMmHaRJKismWzPkXLPsvfOo/LwJ5:Ch+ZkldoPK8YaRlEbk7Psvf4
Malware Config
Extracted
remcos
Ranko7
kennyremcosbelintourismedleonline.gleeze.com:7027
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-OEVWWH
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Drops startup file 1 IoCs
Processes:
nouses.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nouses.vbs nouses.exe -
Executes dropped EXE 1 IoCs
Processes:
nouses.exepid Process 2336 nouses.exe -
Loads dropped DLL 1 IoCs
Processes:
fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exepid Process 2412 fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/files/0x0009000000016dec-12.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
nouses.exedescription pid Process procid_target PID 2336 set thread context of 2220 2336 nouses.exe 30 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
nouses.exepid Process 2336 nouses.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exenouses.exedescription pid Process procid_target PID 2412 wrote to memory of 2336 2412 fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exe 29 PID 2412 wrote to memory of 2336 2412 fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exe 29 PID 2412 wrote to memory of 2336 2412 fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exe 29 PID 2412 wrote to memory of 2336 2412 fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exe 29 PID 2336 wrote to memory of 2220 2336 nouses.exe 30 PID 2336 wrote to memory of 2220 2336 nouses.exe 30 PID 2336 wrote to memory of 2220 2336 nouses.exe 30 PID 2336 wrote to memory of 2220 2336 nouses.exe 30 PID 2336 wrote to memory of 2220 2336 nouses.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exe"C:\Users\Admin\AppData\Local\Temp\fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\caprone\nouses.exe"C:\Users\Admin\AppData\Local\Temp\fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exe"3⤵PID:2220
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
1.3MB
MD5f3dcd81603a7b53421fcedce515a7c80
SHA16f5e15a2415801651cbe54b63eeaddd7df07ab45
SHA256fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab
SHA512f5e969de331afee0b3bed2a58d5159d95c9bbe93eb419980fe061cdcac8de94cc4dfcdd917951c9b6af0003f58f737f7716884472b1fb11a334af78073f51220