Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2024 05:00
Static task
static1
Behavioral task
behavioral1
Sample
MalwareBazaar.exe
Resource
win7-20240708-en
General
-
Target
MalwareBazaar.exe
-
Size
1.0MB
-
MD5
7f409fdbf293c9c3ce17a1e540739e24
-
SHA1
ae25b94e4e8c95a5439947b195b1bd2d2f07fa7a
-
SHA256
52183f225975e6fa1a0c7f7917d43911deccf1375e4defa83852d06cb39c5d61
-
SHA512
1ff2d45f978b3d5b67e7dfdb717abcb6a2fc745feeade7308a6798baf8e0f9509078f9b4ff4ea7431184fa31b01fc26a8c0af6981d098849cc9c4743d4b17b58
-
SSDEEP
12288:WurSY+aZrwrmN+wYku7+yY++DSYOfGrT2LcdgrVrvFuVCJVuH71vilSeM93g:p/4rmNNtmY8YORwiPuVCnuH7hwm93
Malware Config
Extracted
remcos
BAREATA
94.156.69.174:7459
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-7AD3IP
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4616 powershell.exe 2608 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation MalwareBazaar.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4836 set thread context of 864 4836 MalwareBazaar.exe 104 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MalwareBazaar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MalwareBazaar.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2444 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 4836 MalwareBazaar.exe 2608 powershell.exe 2608 powershell.exe 4616 powershell.exe 4616 powershell.exe 4836 MalwareBazaar.exe 4836 MalwareBazaar.exe 4836 MalwareBazaar.exe 4836 MalwareBazaar.exe 2608 powershell.exe 4616 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4836 MalwareBazaar.exe Token: SeDebugPrivilege 4616 powershell.exe Token: SeDebugPrivilege 2608 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 864 MalwareBazaar.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 4836 wrote to memory of 4616 4836 MalwareBazaar.exe 97 PID 4836 wrote to memory of 4616 4836 MalwareBazaar.exe 97 PID 4836 wrote to memory of 4616 4836 MalwareBazaar.exe 97 PID 4836 wrote to memory of 2608 4836 MalwareBazaar.exe 99 PID 4836 wrote to memory of 2608 4836 MalwareBazaar.exe 99 PID 4836 wrote to memory of 2608 4836 MalwareBazaar.exe 99 PID 4836 wrote to memory of 2444 4836 MalwareBazaar.exe 101 PID 4836 wrote to memory of 2444 4836 MalwareBazaar.exe 101 PID 4836 wrote to memory of 2444 4836 MalwareBazaar.exe 101 PID 4836 wrote to memory of 656 4836 MalwareBazaar.exe 103 PID 4836 wrote to memory of 656 4836 MalwareBazaar.exe 103 PID 4836 wrote to memory of 656 4836 MalwareBazaar.exe 103 PID 4836 wrote to memory of 864 4836 MalwareBazaar.exe 104 PID 4836 wrote to memory of 864 4836 MalwareBazaar.exe 104 PID 4836 wrote to memory of 864 4836 MalwareBazaar.exe 104 PID 4836 wrote to memory of 864 4836 MalwareBazaar.exe 104 PID 4836 wrote to memory of 864 4836 MalwareBazaar.exe 104 PID 4836 wrote to memory of 864 4836 MalwareBazaar.exe 104 PID 4836 wrote to memory of 864 4836 MalwareBazaar.exe 104 PID 4836 wrote to memory of 864 4836 MalwareBazaar.exe 104 PID 4836 wrote to memory of 864 4836 MalwareBazaar.exe 104 PID 4836 wrote to memory of 864 4836 MalwareBazaar.exe 104 PID 4836 wrote to memory of 864 4836 MalwareBazaar.exe 104 PID 4836 wrote to memory of 864 4836 MalwareBazaar.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4616
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AEDsxJ.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2608
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AEDsxJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCBAC.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2444
-
-
C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"2⤵PID:656
-
-
C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:864
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD500ce446c8553c5512537f8d2d1fe542f
SHA1a7f831bde8351b68479360f0cb49c7bcad4ff563
SHA25650c83d71327e9bb58ef40fdb38c99a97a3c9c1c4485201703a8a2b1606079ce0
SHA5126a4c2dc393953ad4c9dd17e774f30d07e525bd33d23579b6017ba2280ec8bfb4431397b5561ff598c6c2c581f109b2b51a8c90474cb20d591701269bd68d0578
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD567947301ee2d9ebc6f51ab96b5748a67
SHA1c6c9f9c69f817e6dce55391b9b4b1c6f3206e175
SHA256c7acc3f2b88dd358e3226c1abd3ef75ee0ae980abf63520504bd8f031e70dd6a
SHA5129b43527ac35a0ebecf024b140a378064639dce7daf9076200d2ab8561fe1af1fcc019dc210949a418b7b6e9ed25be39a6c865f97e6de7900680c293a05a636ed
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5456b73800f83c0f23893fb6e1262fe4f
SHA12f226bcce74116ca5226abe1ec88e107cc99e2b8
SHA2565b1f9e279e290f1f451eb16399c570b142a74579436a512881f2cc89fce84903
SHA512e0ea35255bd284474d22586f23b73e9306ebcdfa381bc0e2de72d4b3827ffba5d2de8be4a62527b6bc93f0493182ca5eaefeefe143d5ca6c313f67e32d734a1d