Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23-07-2024 04:57
Static task
static1
Behavioral task
behavioral1
Sample
fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exe
Resource
win7-20240708-en
General
-
Target
fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exe
-
Size
1.3MB
-
MD5
f3dcd81603a7b53421fcedce515a7c80
-
SHA1
6f5e15a2415801651cbe54b63eeaddd7df07ab45
-
SHA256
fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab
-
SHA512
f5e969de331afee0b3bed2a58d5159d95c9bbe93eb419980fe061cdcac8de94cc4dfcdd917951c9b6af0003f58f737f7716884472b1fb11a334af78073f51220
-
SSDEEP
24576:fAHnh+eWsN3skA4RV1Hom2KXMmHaRJKismWzPkXLPsvfOo/LwJ5:Ch+ZkldoPK8YaRlEbk7Psvf4
Malware Config
Extracted
remcos
Ranko7
kennyremcosbelintourismedleonline.gleeze.com:7027
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-OEVWWH
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Drops startup file 1 IoCs
Processes:
nouses.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nouses.vbs nouses.exe -
Executes dropped EXE 1 IoCs
Processes:
nouses.exepid Process 3036 nouses.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/files/0x0007000000023455-13.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
nouses.exedescription pid Process procid_target PID 3036 set thread context of 816 3036 nouses.exe 88 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
nouses.exepid Process 3036 nouses.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exenouses.exedescription pid Process procid_target PID 5068 wrote to memory of 3036 5068 fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exe 87 PID 5068 wrote to memory of 3036 5068 fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exe 87 PID 5068 wrote to memory of 3036 5068 fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exe 87 PID 3036 wrote to memory of 816 3036 nouses.exe 88 PID 3036 wrote to memory of 816 3036 nouses.exe 88 PID 3036 wrote to memory of 816 3036 nouses.exe 88 PID 3036 wrote to memory of 816 3036 nouses.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exe"C:\Users\Admin\AppData\Local\Temp\fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\caprone\nouses.exe"C:\Users\Admin\AppData\Local\Temp\fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exe"3⤵PID:816
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5afaf8231eb3ca65fab3692ce2bc01752
SHA17423205a0a2ba079d87afcd696514d7774a5a767
SHA2561530b374165530f6156105c241b036bd707eda46030e48d8a2ca5a80de042e95
SHA5127cd28b7e9ca7bb8321a2b4c7063d304dd3cb0aa47e2f1d77efd83846845edb630fc7d7027fed072b96703f651c65ed2b2ea629deb9fd4d9891fa9df5f186cb4e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
1.3MB
MD5f3dcd81603a7b53421fcedce515a7c80
SHA16f5e15a2415801651cbe54b63eeaddd7df07ab45
SHA256fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab
SHA512f5e969de331afee0b3bed2a58d5159d95c9bbe93eb419980fe061cdcac8de94cc4dfcdd917951c9b6af0003f58f737f7716884472b1fb11a334af78073f51220