Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2024 10:18
Static task
static1
Behavioral task
behavioral1
Sample
bc43851a4132b4bd01e72b3da4f97460N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bc43851a4132b4bd01e72b3da4f97460N.exe
Resource
win10v2004-20240709-en
General
-
Target
bc43851a4132b4bd01e72b3da4f97460N.exe
-
Size
4.2MB
-
MD5
bc43851a4132b4bd01e72b3da4f97460
-
SHA1
73dde316598b208e1ed2e9d8d342744969090760
-
SHA256
dc87017ebc4e4ca2d7f65e4d3ede241c3c1bd5908cf5fca24c3faadecce54705
-
SHA512
b27db04034bbc4616e18ac42c3ae3cdbb3f993a785413c5d5dbe5c61b7e621e657d835ad7a31dbfc930474b114ac6720bf0ddee13bbfef62608dd546a138d091
-
SSDEEP
24576:ocSRiKAoeMxDa6JtXtSGv7MOfmOh/epNPGi3XxV73LacYLNdK+UwqJ5ji5eB+VyR:
Malware Config
Extracted
remcos
RemoteHost
horsesnje.net:3343
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-TW2LKP
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
bc43851a4132b4bd01e72b3da4f97460N.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation bc43851a4132b4bd01e72b3da4f97460N.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
bc43851a4132b4bd01e72b3da4f97460N.exedescription pid process target process PID 1252 set thread context of 1944 1252 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
bc43851a4132b4bd01e72b3da4f97460N.execmd.exetimeout.exepowershell.exeInstallUtil.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bc43851a4132b4bd01e72b3da4f97460N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4244 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 4084 powershell.exe 4084 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
bc43851a4132b4bd01e72b3da4f97460N.exepowershell.exedescription pid process Token: SeDebugPrivilege 1252 bc43851a4132b4bd01e72b3da4f97460N.exe Token: SeDebugPrivilege 1252 bc43851a4132b4bd01e72b3da4f97460N.exe Token: SeDebugPrivilege 4084 powershell.exe Token: SeDebugPrivilege 1252 bc43851a4132b4bd01e72b3da4f97460N.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 1944 InstallUtil.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
bc43851a4132b4bd01e72b3da4f97460N.execmd.exedescription pid process target process PID 1252 wrote to memory of 3044 1252 bc43851a4132b4bd01e72b3da4f97460N.exe cmd.exe PID 1252 wrote to memory of 3044 1252 bc43851a4132b4bd01e72b3da4f97460N.exe cmd.exe PID 1252 wrote to memory of 3044 1252 bc43851a4132b4bd01e72b3da4f97460N.exe cmd.exe PID 3044 wrote to memory of 4244 3044 cmd.exe timeout.exe PID 3044 wrote to memory of 4244 3044 cmd.exe timeout.exe PID 3044 wrote to memory of 4244 3044 cmd.exe timeout.exe PID 1252 wrote to memory of 4084 1252 bc43851a4132b4bd01e72b3da4f97460N.exe powershell.exe PID 1252 wrote to memory of 4084 1252 bc43851a4132b4bd01e72b3da4f97460N.exe powershell.exe PID 1252 wrote to memory of 4084 1252 bc43851a4132b4bd01e72b3da4f97460N.exe powershell.exe PID 1252 wrote to memory of 1944 1252 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 1252 wrote to memory of 1944 1252 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 1252 wrote to memory of 1944 1252 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 1252 wrote to memory of 1944 1252 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 1252 wrote to memory of 1944 1252 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 1252 wrote to memory of 1944 1252 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 1252 wrote to memory of 1944 1252 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 1252 wrote to memory of 1944 1252 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 1252 wrote to memory of 1944 1252 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 1252 wrote to memory of 1944 1252 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 1252 wrote to memory of 1944 1252 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 1252 wrote to memory of 1944 1252 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc43851a4132b4bd01e72b3da4f97460N.exe"C:\Users\Admin\AppData\Local\Temp\bc43851a4132b4bd01e72b3da4f97460N.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c timeout 21 & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\timeout.exetimeout 213⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4244 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYgBjADQAMwA4ADUAMQBhADQAMQAzADIAYgA0AGIAZAAwADEAZQA3ADIAYgAzAGQAYQA0AGYAOQA3ADQANgAwAE4ALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAGIAYwA0ADMAOAA1ADEAYQA0ADEAMwAyAGIANABiAGQAMAAxAGUANwAyAGIAMwBkAGEANABmADkANwA0ADYAMABOAC4AZQB4AGUAOwA=2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4084 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1944
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5fd6f666d727c5b9d1c53144f69eec87a
SHA18579f5123910173c607ee5297b0e535ef10f90fd
SHA256aa1bd9a09f1af7e77f7d8f862f91f026aed0a9ca510d1e4f2db3d5693b0dcdeb
SHA512a45e2f3032e9f71cf350e2d601b91bae4a111d31d664b6f8b9dda16cf1a9964f2ec6ae7a29318221d4155f04b92fa2369996bbebd35e8e29eddda0e2b4735bf3
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82