Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2024 16:42
Static task
static1
Behavioral task
behavioral1
Sample
1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe
Resource
win10v2004-20240709-en
General
-
Target
1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe
-
Size
1.0MB
-
MD5
995e20db533a2ae4f14b8ccc7a94a17b
-
SHA1
b4dd9fbacd892b7c69cec499969399343a484205
-
SHA256
1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787
-
SHA512
e9357fac407375c08fe0885a8ed94bf63b53f1d7dc42c60a04bc9bd490d9964667c6e249b2d33f6f303cf3e69ae33af45ddf541f2104226438287632cc5f0936
-
SSDEEP
24576:d+1bAypcqgS7drlUPc5xCAHFEihtVachK9HhzO:EVOtSJbCAvGBzO
Malware Config
Extracted
remcos
RemoteHost
104.250.180.178:7902
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
Adobe.exe
-
copy_folder
Adobe
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Adobe-OTOIRK
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe -
Executes dropped EXE 2 IoCs
Processes:
Adobe.exeAdobe.exepid process 4332 Adobe.exe 2784 Adobe.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exeAdobe.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe-OTOIRK = "\"C:\\ProgramData\\Adobe\\Adobe.exe\"" 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe-OTOIRK = "\"C:\\ProgramData\\Adobe\\Adobe.exe\"" Adobe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe-OTOIRK = "\"C:\\ProgramData\\Adobe\\Adobe.exe\"" Adobe.exe Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe-OTOIRK = "\"C:\\ProgramData\\Adobe\\Adobe.exe\"" 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exeAdobe.exedescription pid process target process PID 4584 set thread context of 1544 4584 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe PID 4332 set thread context of 2784 4332 Adobe.exe Adobe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exeAdobe.exeAdobe.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Adobe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Adobe.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exeAdobe.exedescription pid process target process PID 4584 wrote to memory of 1544 4584 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe PID 4584 wrote to memory of 1544 4584 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe PID 4584 wrote to memory of 1544 4584 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe PID 4584 wrote to memory of 1544 4584 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe PID 4584 wrote to memory of 1544 4584 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe PID 4584 wrote to memory of 1544 4584 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe PID 4584 wrote to memory of 1544 4584 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe PID 4584 wrote to memory of 1544 4584 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe PID 4584 wrote to memory of 1544 4584 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe PID 4584 wrote to memory of 1544 4584 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe PID 4584 wrote to memory of 1544 4584 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe PID 4584 wrote to memory of 1544 4584 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe PID 1544 wrote to memory of 4332 1544 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe Adobe.exe PID 1544 wrote to memory of 4332 1544 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe Adobe.exe PID 1544 wrote to memory of 4332 1544 1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe Adobe.exe PID 4332 wrote to memory of 2784 4332 Adobe.exe Adobe.exe PID 4332 wrote to memory of 2784 4332 Adobe.exe Adobe.exe PID 4332 wrote to memory of 2784 4332 Adobe.exe Adobe.exe PID 4332 wrote to memory of 2784 4332 Adobe.exe Adobe.exe PID 4332 wrote to memory of 2784 4332 Adobe.exe Adobe.exe PID 4332 wrote to memory of 2784 4332 Adobe.exe Adobe.exe PID 4332 wrote to memory of 2784 4332 Adobe.exe Adobe.exe PID 4332 wrote to memory of 2784 4332 Adobe.exe Adobe.exe PID 4332 wrote to memory of 2784 4332 Adobe.exe Adobe.exe PID 4332 wrote to memory of 2784 4332 Adobe.exe Adobe.exe PID 4332 wrote to memory of 2784 4332 Adobe.exe Adobe.exe PID 4332 wrote to memory of 2784 4332 Adobe.exe Adobe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe"C:\Users\Admin\AppData\Local\Temp\1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe"C:\Users\Admin\AppData\Local\Temp\1b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\ProgramData\Adobe\Adobe.exe"C:\ProgramData\Adobe\Adobe.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\ProgramData\Adobe\Adobe.exe"C:\ProgramData\Adobe\Adobe.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2784
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5995e20db533a2ae4f14b8ccc7a94a17b
SHA1b4dd9fbacd892b7c69cec499969399343a484205
SHA2561b754a8b7d0c1d3be17f751d327b38961c3d6ea3b8769c9c8edb1f318dfd0787
SHA512e9357fac407375c08fe0885a8ed94bf63b53f1d7dc42c60a04bc9bd490d9964667c6e249b2d33f6f303cf3e69ae33af45ddf541f2104226438287632cc5f0936