Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26-07-2024 22:05
Static task
static1
Behavioral task
behavioral1
Sample
5e6b147668a2daabdd48ab5a50fe6c00N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5e6b147668a2daabdd48ab5a50fe6c00N.exe
Resource
win10v2004-20240709-en
General
-
Target
5e6b147668a2daabdd48ab5a50fe6c00N.exe
-
Size
951KB
-
MD5
5e6b147668a2daabdd48ab5a50fe6c00
-
SHA1
a774fbecb16314b81d396cfac947f5be4f095a2b
-
SHA256
f621ac8874113a6d73876f515e423ca6828c2a7c369e3d87de7e27aeaca926a6
-
SHA512
bc1b385e00420382c12b6261193535bf9b2932c0c48faba1edc6a4b571a33bf15793908e5cea9ad09222606c9cd662828ddfb702a6c33948bcd93d607f79a5d1
-
SSDEEP
12288:vIQIr1yi6GQd9HZ5UtcHRhBsLFw3uKeNwv1gfUduAK5eMfT5y3px3I6z7wjx:vOrwl59HZWOxhBsTjNxfUSXAo
Malware Config
Extracted
remcos
RemoteHost
103.77.243.244:3729
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-GJBYIR
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 876 powershell.exe 2828 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5e6b147668a2daabdd48ab5a50fe6c00N.exedescription pid process target process PID 2012 set thread context of 2696 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 5e6b147668a2daabdd48ab5a50fe6c00N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
5e6b147668a2daabdd48ab5a50fe6c00N.exe5e6b147668a2daabdd48ab5a50fe6c00N.exepowershell.exepowershell.exeschtasks.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5e6b147668a2daabdd48ab5a50fe6c00N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5e6b147668a2daabdd48ab5a50fe6c00N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
5e6b147668a2daabdd48ab5a50fe6c00N.exepowershell.exepowershell.exepid process 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 876 powershell.exe 2828 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
5e6b147668a2daabdd48ab5a50fe6c00N.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe Token: SeDebugPrivilege 876 powershell.exe Token: SeDebugPrivilege 2828 powershell.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
5e6b147668a2daabdd48ab5a50fe6c00N.exedescription pid process target process PID 2012 wrote to memory of 876 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe powershell.exe PID 2012 wrote to memory of 876 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe powershell.exe PID 2012 wrote to memory of 876 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe powershell.exe PID 2012 wrote to memory of 876 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe powershell.exe PID 2012 wrote to memory of 2828 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe powershell.exe PID 2012 wrote to memory of 2828 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe powershell.exe PID 2012 wrote to memory of 2828 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe powershell.exe PID 2012 wrote to memory of 2828 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe powershell.exe PID 2012 wrote to memory of 2852 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe schtasks.exe PID 2012 wrote to memory of 2852 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe schtasks.exe PID 2012 wrote to memory of 2852 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe schtasks.exe PID 2012 wrote to memory of 2852 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe schtasks.exe PID 2012 wrote to memory of 2640 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 5e6b147668a2daabdd48ab5a50fe6c00N.exe PID 2012 wrote to memory of 2640 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 5e6b147668a2daabdd48ab5a50fe6c00N.exe PID 2012 wrote to memory of 2640 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 5e6b147668a2daabdd48ab5a50fe6c00N.exe PID 2012 wrote to memory of 2640 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 5e6b147668a2daabdd48ab5a50fe6c00N.exe PID 2012 wrote to memory of 2668 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 5e6b147668a2daabdd48ab5a50fe6c00N.exe PID 2012 wrote to memory of 2668 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 5e6b147668a2daabdd48ab5a50fe6c00N.exe PID 2012 wrote to memory of 2668 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 5e6b147668a2daabdd48ab5a50fe6c00N.exe PID 2012 wrote to memory of 2668 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 5e6b147668a2daabdd48ab5a50fe6c00N.exe PID 2012 wrote to memory of 2696 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 5e6b147668a2daabdd48ab5a50fe6c00N.exe PID 2012 wrote to memory of 2696 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 5e6b147668a2daabdd48ab5a50fe6c00N.exe PID 2012 wrote to memory of 2696 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 5e6b147668a2daabdd48ab5a50fe6c00N.exe PID 2012 wrote to memory of 2696 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 5e6b147668a2daabdd48ab5a50fe6c00N.exe PID 2012 wrote to memory of 2696 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 5e6b147668a2daabdd48ab5a50fe6c00N.exe PID 2012 wrote to memory of 2696 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 5e6b147668a2daabdd48ab5a50fe6c00N.exe PID 2012 wrote to memory of 2696 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 5e6b147668a2daabdd48ab5a50fe6c00N.exe PID 2012 wrote to memory of 2696 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 5e6b147668a2daabdd48ab5a50fe6c00N.exe PID 2012 wrote to memory of 2696 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 5e6b147668a2daabdd48ab5a50fe6c00N.exe PID 2012 wrote to memory of 2696 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 5e6b147668a2daabdd48ab5a50fe6c00N.exe PID 2012 wrote to memory of 2696 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 5e6b147668a2daabdd48ab5a50fe6c00N.exe PID 2012 wrote to memory of 2696 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 5e6b147668a2daabdd48ab5a50fe6c00N.exe PID 2012 wrote to memory of 2696 2012 5e6b147668a2daabdd48ab5a50fe6c00N.exe 5e6b147668a2daabdd48ab5a50fe6c00N.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e6b147668a2daabdd48ab5a50fe6c00N.exe"C:\Users\Admin\AppData\Local\Temp\5e6b147668a2daabdd48ab5a50fe6c00N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5e6b147668a2daabdd48ab5a50fe6c00N.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:876 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nvwqfCzFzLNjg.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2828 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nvwqfCzFzLNjg" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF73A.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\5e6b147668a2daabdd48ab5a50fe6c00N.exe"C:\Users\Admin\AppData\Local\Temp\5e6b147668a2daabdd48ab5a50fe6c00N.exe"2⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\5e6b147668a2daabdd48ab5a50fe6c00N.exe"C:\Users\Admin\AppData\Local\Temp\5e6b147668a2daabdd48ab5a50fe6c00N.exe"2⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\5e6b147668a2daabdd48ab5a50fe6c00N.exe"C:\Users\Admin\AppData\Local\Temp\5e6b147668a2daabdd48ab5a50fe6c00N.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2696
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51b0a6147bcb481c2e00747e6f3eadc0e
SHA1f5dc07d3f025589e8f72789a6ee7ca4f24ed225b
SHA256a04e3a209fbe553e08c5f4d06afe0d7ddbcb92c05dbe9e319c5d0578d2a49e8e
SHA51223f6a62a39513f49bd6d8fa7e8c68086a0789fcb518dcf37db9296b72f191c6e185f03273268137df550b29f86047ad205df63a95db370fd81393d1ee5a9aa7e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\I6PXFOU9Z9OF4WFYOJLD.temp
Filesize7KB
MD5ada4702242251a22cf5239e41dfc4067
SHA1fc4a1735c18e8c206f287f12d28877812303da9e
SHA2562b1c3a624f91b3541fdd963d85dab2f49d2ded3a630d3061edace19706e3e2d2
SHA512c728f6d9c80b0a3f9aff642d4a534da134ba491181f7f8414a4363f6623a441785b75d213295902aeed295d823516bbec92c93d5f5833a87cd5338020f151674