Analysis
-
max time kernel
57s -
max time network
50s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23-07-2024 07:08
Static task
static1
Behavioral task
behavioral1
Sample
doc_00394039424.exe
Resource
win10v2004-20240709-en
General
-
Target
doc_00394039424.exe
-
Size
903KB
-
MD5
e34683e560b0c2a5cddcffe98956ea62
-
SHA1
89a3dc3e4b06a8c4bd94bffc48adac82e620d910
-
SHA256
f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054
-
SHA512
4bf4a8fef3b740ba3e6a04bedaaa90970a60b72fc950d53de6e2bf597d89d5d399f9258f9f8088f0ea6304bfa219c5537271c9df59c463893d9589370a27ebff
-
SSDEEP
24576:7CHszWooWQhqSJgZjY0ZbnC8DOCZs64HE:7CHNtqSEY0ZbntQ64HE
Malware Config
Extracted
remcos
2404
107.173.4.16:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-QBT08L
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Detected Nirsoft tools 3 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
Processes:
resource yara_rule behavioral1/memory/2540-225-0x0000000000400000-0x0000000000424000-memory.dmp Nirsoft behavioral1/memory/320-220-0x0000000000400000-0x0000000000478000-memory.dmp Nirsoft behavioral1/memory/4376-221-0x0000000000400000-0x0000000000462000-memory.dmp Nirsoft -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/4376-221-0x0000000000400000-0x0000000000462000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/320-220-0x0000000000400000-0x0000000000478000-memory.dmp WebBrowserPassView -
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepid Process 4744 powershell.exe 4340 powershell.exe 5080 powershell.exe 3488 powershell.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
doc_00394039424.exedoc_00394039424.exeremcos.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation doc_00394039424.exe Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation doc_00394039424.exe Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation remcos.exe -
Executes dropped EXE 6 IoCs
Processes:
remcos.exeremcos.exeremcos.exeremcos.exeremcos.exeremcos.exepid Process 1948 remcos.exe 1824 remcos.exe 320 remcos.exe 4364 remcos.exe 4376 remcos.exe 2540 remcos.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
remcos.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts remcos.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
remcos.exedoc_00394039424.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-QBT08L = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-QBT08L = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" doc_00394039424.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-QBT08L = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" doc_00394039424.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-QBT08L = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\"" remcos.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
doc_00394039424.exeremcos.exeremcos.exedescription pid Process procid_target PID 3236 set thread context of 32 3236 doc_00394039424.exe 99 PID 1948 set thread context of 1824 1948 remcos.exe 109 PID 1824 set thread context of 1540 1824 remcos.exe 110 PID 1824 set thread context of 320 1824 remcos.exe 112 PID 1824 set thread context of 4376 1824 remcos.exe 114 PID 1824 set thread context of 2540 1824 remcos.exe 115 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
doc_00394039424.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ doc_00394039424.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid Process 4324 schtasks.exe 2680 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
doc_00394039424.exepowershell.exepowershell.exeremcos.exepowershell.exepowershell.exeremcos.exeremcos.exepid Process 3236 doc_00394039424.exe 4744 powershell.exe 4340 powershell.exe 3236 doc_00394039424.exe 4744 powershell.exe 4744 powershell.exe 4340 powershell.exe 1948 remcos.exe 5080 powershell.exe 3488 powershell.exe 1948 remcos.exe 1948 remcos.exe 5080 powershell.exe 3488 powershell.exe 320 remcos.exe 320 remcos.exe 2540 remcos.exe 2540 remcos.exe 320 remcos.exe 320 remcos.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
remcos.exepid Process 1824 remcos.exe 1824 remcos.exe 1824 remcos.exe 1824 remcos.exe 1824 remcos.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
doc_00394039424.exepowershell.exepowershell.exeremcos.exepowershell.exepowershell.exeremcos.exedescription pid Process Token: SeDebugPrivilege 3236 doc_00394039424.exe Token: SeDebugPrivilege 4744 powershell.exe Token: SeDebugPrivilege 4340 powershell.exe Token: SeDebugPrivilege 1948 remcos.exe Token: SeDebugPrivilege 5080 powershell.exe Token: SeDebugPrivilege 3488 powershell.exe Token: SeDebugPrivilege 2540 remcos.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
doc_00394039424.exedoc_00394039424.exeremcos.exeremcos.exedescription pid Process procid_target PID 3236 wrote to memory of 4744 3236 doc_00394039424.exe 92 PID 3236 wrote to memory of 4744 3236 doc_00394039424.exe 92 PID 3236 wrote to memory of 4744 3236 doc_00394039424.exe 92 PID 3236 wrote to memory of 4340 3236 doc_00394039424.exe 94 PID 3236 wrote to memory of 4340 3236 doc_00394039424.exe 94 PID 3236 wrote to memory of 4340 3236 doc_00394039424.exe 94 PID 3236 wrote to memory of 4324 3236 doc_00394039424.exe 96 PID 3236 wrote to memory of 4324 3236 doc_00394039424.exe 96 PID 3236 wrote to memory of 4324 3236 doc_00394039424.exe 96 PID 3236 wrote to memory of 32 3236 doc_00394039424.exe 99 PID 3236 wrote to memory of 32 3236 doc_00394039424.exe 99 PID 3236 wrote to memory of 32 3236 doc_00394039424.exe 99 PID 3236 wrote to memory of 32 3236 doc_00394039424.exe 99 PID 3236 wrote to memory of 32 3236 doc_00394039424.exe 99 PID 3236 wrote to memory of 32 3236 doc_00394039424.exe 99 PID 3236 wrote to memory of 32 3236 doc_00394039424.exe 99 PID 3236 wrote to memory of 32 3236 doc_00394039424.exe 99 PID 3236 wrote to memory of 32 3236 doc_00394039424.exe 99 PID 3236 wrote to memory of 32 3236 doc_00394039424.exe 99 PID 3236 wrote to memory of 32 3236 doc_00394039424.exe 99 PID 3236 wrote to memory of 32 3236 doc_00394039424.exe 99 PID 32 wrote to memory of 1948 32 doc_00394039424.exe 100 PID 32 wrote to memory of 1948 32 doc_00394039424.exe 100 PID 32 wrote to memory of 1948 32 doc_00394039424.exe 100 PID 1948 wrote to memory of 5080 1948 remcos.exe 103 PID 1948 wrote to memory of 5080 1948 remcos.exe 103 PID 1948 wrote to memory of 5080 1948 remcos.exe 103 PID 1948 wrote to memory of 3488 1948 remcos.exe 105 PID 1948 wrote to memory of 3488 1948 remcos.exe 105 PID 1948 wrote to memory of 3488 1948 remcos.exe 105 PID 1948 wrote to memory of 2680 1948 remcos.exe 107 PID 1948 wrote to memory of 2680 1948 remcos.exe 107 PID 1948 wrote to memory of 2680 1948 remcos.exe 107 PID 1948 wrote to memory of 1824 1948 remcos.exe 109 PID 1948 wrote to memory of 1824 1948 remcos.exe 109 PID 1948 wrote to memory of 1824 1948 remcos.exe 109 PID 1948 wrote to memory of 1824 1948 remcos.exe 109 PID 1948 wrote to memory of 1824 1948 remcos.exe 109 PID 1948 wrote to memory of 1824 1948 remcos.exe 109 PID 1948 wrote to memory of 1824 1948 remcos.exe 109 PID 1948 wrote to memory of 1824 1948 remcos.exe 109 PID 1948 wrote to memory of 1824 1948 remcos.exe 109 PID 1948 wrote to memory of 1824 1948 remcos.exe 109 PID 1948 wrote to memory of 1824 1948 remcos.exe 109 PID 1948 wrote to memory of 1824 1948 remcos.exe 109 PID 1824 wrote to memory of 1540 1824 remcos.exe 110 PID 1824 wrote to memory of 1540 1824 remcos.exe 110 PID 1824 wrote to memory of 1540 1824 remcos.exe 110 PID 1824 wrote to memory of 1540 1824 remcos.exe 110 PID 1824 wrote to memory of 320 1824 remcos.exe 112 PID 1824 wrote to memory of 320 1824 remcos.exe 112 PID 1824 wrote to memory of 320 1824 remcos.exe 112 PID 1824 wrote to memory of 320 1824 remcos.exe 112 PID 1824 wrote to memory of 4364 1824 remcos.exe 113 PID 1824 wrote to memory of 4364 1824 remcos.exe 113 PID 1824 wrote to memory of 4364 1824 remcos.exe 113 PID 1824 wrote to memory of 4376 1824 remcos.exe 114 PID 1824 wrote to memory of 4376 1824 remcos.exe 114 PID 1824 wrote to memory of 4376 1824 remcos.exe 114 PID 1824 wrote to memory of 4376 1824 remcos.exe 114 PID 1824 wrote to memory of 2540 1824 remcos.exe 115 PID 1824 wrote to memory of 2540 1824 remcos.exe 115 PID 1824 wrote to memory of 2540 1824 remcos.exe 115 PID 1824 wrote to memory of 2540 1824 remcos.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\doc_00394039424.exe"C:\Users\Admin\AppData\Local\Temp\doc_00394039424.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\doc_00394039424.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4744
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AZjibU.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4340
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AZjibU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC4D6.tmp"2⤵
- Scheduled Task/Job: Scheduled Task
PID:4324
-
-
C:\Users\Admin\AppData\Local\Temp\doc_00394039424.exe"C:\Users\Admin\AppData\Local\Temp\doc_00394039424.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5080
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AZjibU.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3488
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AZjibU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFE94.tmp"4⤵
- Scheduled Task/Job: Scheduled Task
PID:2680
-
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\SysWOW64\svchost.exesvchost.exe5⤵PID:1540
-
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\sbeeutuxpkbbgljmjdlxohmevj"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:320
-
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\dwjwvleqdstgrrfytoxyruhnwxmqt"5⤵
- Executes dropped EXE
PID:4364
-
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\dwjwvleqdstgrrfytoxyruhnwxmqt"5⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
PID:4376
-
-
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exeC:\Users\Admin\AppData\Roaming\Remcos\remcos.exe /stext "C:\Users\Admin\AppData\Local\Temp\nqopvdpsralltxtckykaczbefedruxhqk"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2540
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD5ab63e7116c4ed149d6ee04238fa31964
SHA1a67369f5f7622c48d97528ca478756d2172e8b6f
SHA25619fd08b9dff9e4e654c13c693d8257dbe1cd595fa49801e74dc7dec14cb8ccd6
SHA512c3678334adcb0fa5357fed0522f81c714dff74f05b5963b524037980616f52b8027f2675bc0012f371602117bf64e67ab93b4ee9bae11d0b56b684534edace32
-
Filesize
18KB
MD5ed4bd0d8aa160368486a32d54be957f0
SHA17786b8dddade7ce53296e55c7a25c64b0c6605d8
SHA256a18ff4a181d1dfe57a596510c8b1bf3c411c5c0f7102de3b98ab3d2f73fc16c3
SHA51281be809f46084cb1d1c7888f0b1992a79a4ae078fae0343f1a0add597ba0ff3577aaefe399f24b17900f34e3be6540566d2513675f39a4bf6629b81c1b5b2973
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD51d22632ab7786a15873206bd9aeaaf47
SHA1f982816e813cfdd43ad3339fa6ca7bf2425651e7
SHA256c26d371c3209dea4e8cb298ab279746f0209643a1ef95ff627e2cfe193be838b
SHA512456ee2bf5faefb56b5c9864ecb340293412c0ab50d47ff8ead5b0db88f3e61e74278a46063d4b816e1143020344add8bfd8f6baac142d984693e0d7be72e4ae0
-
Filesize
1KB
MD5166923428686b614a2fc9030a06e9da4
SHA1ee3993fdffe5d11f0ac7a3422ef3fedd28a03ee6
SHA256c2491db4cdb9e806c60ee47a115fb15c444513480d6fc866412652f7f88bb89f
SHA51225397ba66054ff5d6ad1615feb0a58c2807d87f250474f11b744da824f665f96b47dfbbb1509e5685a1c24a15de5e8e6643d29caf6473906f0e8f5bca8fcc2fc
-
Filesize
903KB
MD5e34683e560b0c2a5cddcffe98956ea62
SHA189a3dc3e4b06a8c4bd94bffc48adac82e620d910
SHA256f377f9ebb865d686833a830718e6d4eb3898a20e87b0b89e26436c10496c5054
SHA5124bf4a8fef3b740ba3e6a04bedaaa90970a60b72fc950d53de6e2bf597d89d5d399f9258f9f8088f0ea6304bfa219c5537271c9df59c463893d9589370a27ebff