Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2024 04:46
Static task
static1
Behavioral task
behavioral1
Sample
HDEBERTAD3423.exe
Resource
win7-20240705-en
General
-
Target
HDEBERTAD3423.exe
-
Size
1.0MB
-
MD5
7f409fdbf293c9c3ce17a1e540739e24
-
SHA1
ae25b94e4e8c95a5439947b195b1bd2d2f07fa7a
-
SHA256
52183f225975e6fa1a0c7f7917d43911deccf1375e4defa83852d06cb39c5d61
-
SHA512
1ff2d45f978b3d5b67e7dfdb717abcb6a2fc745feeade7308a6798baf8e0f9509078f9b4ff4ea7431184fa31b01fc26a8c0af6981d098849cc9c4743d4b17b58
-
SSDEEP
12288:WurSY+aZrwrmN+wYku7+yY++DSYOfGrT2LcdgrVrvFuVCJVuH71vilSeM93g:p/4rmNNtmY8YORwiPuVCnuH7hwm93
Malware Config
Extracted
remcos
BAREATA
94.156.69.174:7459
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-7AD3IP
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 388 powershell.exe 4560 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation HDEBERTAD3423.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3744 set thread context of 1080 3744 HDEBERTAD3423.exe 101 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HDEBERTAD3423.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HDEBERTAD3423.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4004 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3744 HDEBERTAD3423.exe 4560 powershell.exe 3744 HDEBERTAD3423.exe 388 powershell.exe 388 powershell.exe 4560 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3744 HDEBERTAD3423.exe Token: SeDebugPrivilege 388 powershell.exe Token: SeDebugPrivilege 4560 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1080 HDEBERTAD3423.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3744 wrote to memory of 388 3744 HDEBERTAD3423.exe 95 PID 3744 wrote to memory of 388 3744 HDEBERTAD3423.exe 95 PID 3744 wrote to memory of 388 3744 HDEBERTAD3423.exe 95 PID 3744 wrote to memory of 4560 3744 HDEBERTAD3423.exe 97 PID 3744 wrote to memory of 4560 3744 HDEBERTAD3423.exe 97 PID 3744 wrote to memory of 4560 3744 HDEBERTAD3423.exe 97 PID 3744 wrote to memory of 4004 3744 HDEBERTAD3423.exe 99 PID 3744 wrote to memory of 4004 3744 HDEBERTAD3423.exe 99 PID 3744 wrote to memory of 4004 3744 HDEBERTAD3423.exe 99 PID 3744 wrote to memory of 1080 3744 HDEBERTAD3423.exe 101 PID 3744 wrote to memory of 1080 3744 HDEBERTAD3423.exe 101 PID 3744 wrote to memory of 1080 3744 HDEBERTAD3423.exe 101 PID 3744 wrote to memory of 1080 3744 HDEBERTAD3423.exe 101 PID 3744 wrote to memory of 1080 3744 HDEBERTAD3423.exe 101 PID 3744 wrote to memory of 1080 3744 HDEBERTAD3423.exe 101 PID 3744 wrote to memory of 1080 3744 HDEBERTAD3423.exe 101 PID 3744 wrote to memory of 1080 3744 HDEBERTAD3423.exe 101 PID 3744 wrote to memory of 1080 3744 HDEBERTAD3423.exe 101 PID 3744 wrote to memory of 1080 3744 HDEBERTAD3423.exe 101 PID 3744 wrote to memory of 1080 3744 HDEBERTAD3423.exe 101 PID 3744 wrote to memory of 1080 3744 HDEBERTAD3423.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\HDEBERTAD3423.exe"C:\Users\Admin\AppData\Local\Temp\HDEBERTAD3423.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\HDEBERTAD3423.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:388
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AEDsxJ.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4560
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AEDsxJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCF46.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4004
-
-
C:\Users\Admin\AppData\Local\Temp\HDEBERTAD3423.exe"C:\Users\Admin\AppData\Local\Temp\HDEBERTAD3423.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD55665a44d81860823342bfe2a139a5bbc
SHA1c6d8af8670a1f0b60a37578beb9befe156c75a65
SHA256bef796e37c8ca31d425c151e38268fe940702fe7c86aa3f7142d0bfc846eca26
SHA512f329d1b233243b4837f724930509798644ab90f5473649c8d52b4ec93534b07cf3ffbcccb727f7b6770312c8950a3b40318441ba48ae010c4b97d3649a5ad57f
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD5ac479391eb30a2f63dc5ca2a09b67fe9
SHA1b6294f7bb856539240b38a7440064f232286eb04
SHA256b8dfe4a70d58652aa9ac2262ad68b8e4cec412974b2da12c5c0a40596fe561e3
SHA5123d75704e925935053506bcfa35830771f19f896874943cd6a7ffae42583ec365057446d39e3aa40d4b1379d13e342373b9b4d95db639b4fb8478c298d35a7c20
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5bc47c9816f9edf88418257b6c8364bcf
SHA17fcad540c912e530c58a00ed91dd64fd71b274e4
SHA2566332fd18cfc475b10cd8c045deb00e47515683d1c14af6d4dd4e08ac4556c903
SHA512f616a1e9d0705636bd0f99137b802ece7f534a05fb931099fc774f7f28405d7137f92ad8a67f93bf239106349277511d74d5420360c06f1046ac1545531f7e06