Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 07:33
Static task
static1
Behavioral task
behavioral1
Sample
a11a0d0058f12a5ce73448b24653fa20N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a11a0d0058f12a5ce73448b24653fa20N.exe
Resource
win10v2004-20240709-en
General
-
Target
a11a0d0058f12a5ce73448b24653fa20N.exe
-
Size
139KB
-
MD5
a11a0d0058f12a5ce73448b24653fa20
-
SHA1
ea55a5ac974cabf8d4d3a4ac27e28ccd00571e53
-
SHA256
b47bab6180af2d5a6d5317d311fbd94704c8504cc9bfe33014be4256fdce5531
-
SHA512
f3c465e26281d6d33713f2f9a734785e24a8ffbaff43b9a1b566311cd065f68fa7ad2c76ecd6801605eff75b3f0efb8a6157818b8fb755cf8d52ee49714b1e80
-
SSDEEP
3072:xPd4n/M+WLcilrpgGH/GwY87mVmIXhIH4:xP6/M+WLckOBhVmI1
Malware Config
Extracted
remcos
1.7 Pro
Host
systemcontrol.ddns.net:45000
systemcontrol2.ddns.net:45000
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
OfficeUpgrade.exe
-
copy_folder
OfficeUpgrade
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
Upgrader.dat
-
keylog_flag
false
-
keylog_folder
Upgrader
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
req_khauflaoyr
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
OfficeUpgrade
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a11a0d0058f12a5ce73448b24653fa20N.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation a11a0d0058f12a5ce73448b24653fa20N.exe -
Executes dropped EXE 2 IoCs
Processes:
wn2ra4ohzdr.exewn2ra4ohzdr.exepid process 1180 wn2ra4ohzdr.exe 3052 wn2ra4ohzdr.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
a11a0d0058f12a5ce73448b24653fa20N.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raj4dkhhiap = "C:\\Users\\Admin\\AppData\\Roaming\\raj4dkhhiap\\wn2ra4ohzdr.exe" a11a0d0058f12a5ce73448b24653fa20N.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
wn2ra4ohzdr.exedescription pid process target process PID 1180 set thread context of 3052 1180 wn2ra4ohzdr.exe wn2ra4ohzdr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
a11a0d0058f12a5ce73448b24653fa20N.exewn2ra4ohzdr.exewn2ra4ohzdr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a11a0d0058f12a5ce73448b24653fa20N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wn2ra4ohzdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wn2ra4ohzdr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
wn2ra4ohzdr.exepid process 3052 wn2ra4ohzdr.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
a11a0d0058f12a5ce73448b24653fa20N.exewn2ra4ohzdr.exedescription pid process target process PID 4048 wrote to memory of 1180 4048 a11a0d0058f12a5ce73448b24653fa20N.exe wn2ra4ohzdr.exe PID 4048 wrote to memory of 1180 4048 a11a0d0058f12a5ce73448b24653fa20N.exe wn2ra4ohzdr.exe PID 4048 wrote to memory of 1180 4048 a11a0d0058f12a5ce73448b24653fa20N.exe wn2ra4ohzdr.exe PID 1180 wrote to memory of 3052 1180 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 1180 wrote to memory of 3052 1180 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 1180 wrote to memory of 3052 1180 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 1180 wrote to memory of 3052 1180 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 1180 wrote to memory of 3052 1180 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 1180 wrote to memory of 3052 1180 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 1180 wrote to memory of 3052 1180 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 1180 wrote to memory of 3052 1180 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 1180 wrote to memory of 3052 1180 wn2ra4ohzdr.exe wn2ra4ohzdr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a11a0d0058f12a5ce73448b24653fa20N.exe"C:\Users\Admin\AppData\Local\Temp\a11a0d0058f12a5ce73448b24653fa20N.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exeFilesize
139KB
MD5d20cde0cac2575480da70677ea4761c5
SHA18c6e5625eb68c7663c4d36d5ec096e1816269aac
SHA256c927f5f6070359af17a396b99f5a239eb1a888a9f49488904d21f60a3baad32e
SHA5121c3c669262f926e0421fa44ca00e063367c4bc08d362fc0cb1ec06f9529a084e6f0e7724c049bd76052a9e5707fc9ce77b770e0dd6e0f19c734658a9c7ff5863
-
memory/1180-34-0x0000000074D50000-0x0000000075500000-memory.dmpFilesize
7.7MB
-
memory/1180-22-0x0000000074D50000-0x0000000075500000-memory.dmpFilesize
7.7MB
-
memory/1180-20-0x0000000074D50000-0x0000000075500000-memory.dmpFilesize
7.7MB
-
memory/3052-26-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3052-23-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3052-30-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3052-29-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3052-24-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3052-25-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/4048-21-0x0000000074D50000-0x0000000075500000-memory.dmpFilesize
7.7MB
-
memory/4048-2-0x0000000005430000-0x00000000059D4000-memory.dmpFilesize
5.6MB
-
memory/4048-0-0x0000000074D5E000-0x0000000074D5F000-memory.dmpFilesize
4KB
-
memory/4048-3-0x0000000004E80000-0x0000000004F12000-memory.dmpFilesize
584KB
-
memory/4048-5-0x0000000074D50000-0x0000000075500000-memory.dmpFilesize
7.7MB
-
memory/4048-4-0x0000000004E10000-0x0000000004E1A000-memory.dmpFilesize
40KB
-
memory/4048-6-0x0000000005280000-0x00000000052A0000-memory.dmpFilesize
128KB
-
memory/4048-1-0x00000000003E0000-0x0000000000408000-memory.dmpFilesize
160KB