Analysis
-
max time kernel
17s -
max time network
21s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23-07-2024 19:03
Static task
static1
Behavioral task
behavioral1
Sample
MODELO DE CONTRATO DE CONSIGNACIÓN INTERBANCARIO.exe
Resource
win10v2004-20240709-en
General
-
Target
MODELO DE CONTRATO DE CONSIGNACIÓN INTERBANCARIO.exe
-
Size
2.3MB
-
MD5
bfd0dbc1912afeb88b179dd0be89b3d2
-
SHA1
52d38d8e67998ff9a14f4758d8ad208d0725a6d5
-
SHA256
57d090bb702a1d4bc4e7b159d4a5d09b5cad8b55965e914d608322e496ee593d
-
SHA512
3472820c683ee923065584880c2e978da1d8e2101424794e9bcc802c56e3f449db78431cf77fb681ebd02e86882c263c68e98aa107056dcf425301b2b9946bd7
-
SSDEEP
24576:vsZeKmlsUZs/yP3pgXWeoVeVph4UsytS0MOzCMWrUjYDP/lNzU9YIuMuyzGYyC:v+epZayP3pgXWFVeVpPsytS0f6EYjLAx
Malware Config
Extracted
remcos
KILOS
card25.con-ip.com:1664
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-E50BIC
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mukaka = "C:\\Users\\Admin\\Documents\\Ounsa\\OOffupdater.exe" MODELO DE CONTRATO DE CONSIGNACIÓN INTERBANCARIO.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MODELO DE CONTRATO DE CONSIGNACIÓN INTERBANCARIO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MODELO DE CONTRATO DE CONSIGNACIÓN INTERBANCARIO.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4724 MODELO DE CONTRATO DE CONSIGNACIÓN INTERBANCARIO.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1400 wrote to memory of 4724 1400 MODELO DE CONTRATO DE CONSIGNACIÓN INTERBANCARIO.exe 95 PID 1400 wrote to memory of 4724 1400 MODELO DE CONTRATO DE CONSIGNACIÓN INTERBANCARIO.exe 95 PID 1400 wrote to memory of 4724 1400 MODELO DE CONTRATO DE CONSIGNACIÓN INTERBANCARIO.exe 95 PID 1400 wrote to memory of 4724 1400 MODELO DE CONTRATO DE CONSIGNACIÓN INTERBANCARIO.exe 95 PID 1400 wrote to memory of 4724 1400 MODELO DE CONTRATO DE CONSIGNACIÓN INTERBANCARIO.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\MODELO DE CONTRATO DE CONSIGNACIÓN INTERBANCARIO.exe"C:\Users\Admin\AppData\Local\Temp\MODELO DE CONTRATO DE CONSIGNACIÓN INTERBANCARIO.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\MODELO DE CONTRATO DE CONSIGNACIÓN INTERBANCARIO.exe"C:\Users\Admin\AppData\Local\Temp\MODELO DE CONTRATO DE CONSIGNACIÓN INTERBANCARIO.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4724
-