Analysis
-
max time kernel
118s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 09:54
Static task
static1
Behavioral task
behavioral1
Sample
bc43851a4132b4bd01e72b3da4f97460N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bc43851a4132b4bd01e72b3da4f97460N.exe
Resource
win10v2004-20240709-en
General
-
Target
bc43851a4132b4bd01e72b3da4f97460N.exe
-
Size
4.2MB
-
MD5
bc43851a4132b4bd01e72b3da4f97460
-
SHA1
73dde316598b208e1ed2e9d8d342744969090760
-
SHA256
dc87017ebc4e4ca2d7f65e4d3ede241c3c1bd5908cf5fca24c3faadecce54705
-
SHA512
b27db04034bbc4616e18ac42c3ae3cdbb3f993a785413c5d5dbe5c61b7e621e657d835ad7a31dbfc930474b114ac6720bf0ddee13bbfef62608dd546a138d091
-
SSDEEP
24576:ocSRiKAoeMxDa6JtXtSGv7MOfmOh/epNPGi3XxV73LacYLNdK+UwqJ5ji5eB+VyR:
Malware Config
Extracted
remcos
RemoteHost
horsesnje.net:3343
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-TW2LKP
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
bc43851a4132b4bd01e72b3da4f97460N.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation bc43851a4132b4bd01e72b3da4f97460N.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
bc43851a4132b4bd01e72b3da4f97460N.exedescription pid process target process PID 2840 set thread context of 4488 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 set thread context of 444 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 set thread context of 4336 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
timeout.exepowershell.exeInstallUtil.exebc43851a4132b4bd01e72b3da4f97460N.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bc43851a4132b4bd01e72b3da4f97460N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4832 timeout.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exebc43851a4132b4bd01e72b3da4f97460N.exepid process 1628 powershell.exe 1628 powershell.exe 2840 bc43851a4132b4bd01e72b3da4f97460N.exe 2840 bc43851a4132b4bd01e72b3da4f97460N.exe 2840 bc43851a4132b4bd01e72b3da4f97460N.exe 2840 bc43851a4132b4bd01e72b3da4f97460N.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
bc43851a4132b4bd01e72b3da4f97460N.exepowershell.exedescription pid process Token: SeDebugPrivilege 2840 bc43851a4132b4bd01e72b3da4f97460N.exe Token: SeDebugPrivilege 2840 bc43851a4132b4bd01e72b3da4f97460N.exe Token: SeDebugPrivilege 1628 powershell.exe Token: SeDebugPrivilege 2840 bc43851a4132b4bd01e72b3da4f97460N.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 4336 InstallUtil.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
bc43851a4132b4bd01e72b3da4f97460N.execmd.exedescription pid process target process PID 2840 wrote to memory of 3060 2840 bc43851a4132b4bd01e72b3da4f97460N.exe cmd.exe PID 2840 wrote to memory of 3060 2840 bc43851a4132b4bd01e72b3da4f97460N.exe cmd.exe PID 2840 wrote to memory of 3060 2840 bc43851a4132b4bd01e72b3da4f97460N.exe cmd.exe PID 3060 wrote to memory of 4832 3060 cmd.exe timeout.exe PID 3060 wrote to memory of 4832 3060 cmd.exe timeout.exe PID 3060 wrote to memory of 4832 3060 cmd.exe timeout.exe PID 2840 wrote to memory of 1628 2840 bc43851a4132b4bd01e72b3da4f97460N.exe powershell.exe PID 2840 wrote to memory of 1628 2840 bc43851a4132b4bd01e72b3da4f97460N.exe powershell.exe PID 2840 wrote to memory of 1628 2840 bc43851a4132b4bd01e72b3da4f97460N.exe powershell.exe PID 2840 wrote to memory of 4488 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 4488 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 4488 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 4488 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 4488 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 4488 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 4488 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 4488 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 4488 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 4488 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 4488 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 4488 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 444 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 444 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 444 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 444 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 444 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 444 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 444 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 444 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 444 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 444 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 444 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 444 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 4336 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 4336 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 4336 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 4336 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 4336 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 4336 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 4336 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 4336 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 4336 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 4336 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 4336 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2840 wrote to memory of 4336 2840 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc43851a4132b4bd01e72b3da4f97460N.exe"C:\Users\Admin\AppData\Local\Temp\bc43851a4132b4bd01e72b3da4f97460N.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c timeout 21 & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\timeout.exetimeout 213⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4832 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYgBjADQAMwA4ADUAMQBhADQAMQAzADIAYgA0AGIAZAAwADEAZQA3ADIAYgAzAGQAYQA0AGYAOQA3ADQANgAwAE4ALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAGIAYwA0ADMAOAA1ADEAYQA0ADEAMwAyAGIANABiAGQAMAAxAGUANwAyAGIAMwBkAGEANABmADkANwA0ADYAMABOAC4AZQB4AGUAOwA=2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1628 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵PID:4488
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵PID:444
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4336
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5bdeea34156bd84000c835d8ff677730d
SHA1f8781b70219f20a68123b9d47689a4b021642519
SHA256a803cfc16c85e5c8c1b4192324cf44d30c6235737f0354583cea2d3b29e4e1ab
SHA51297903c32470aa8c27061c05d25e3d5b8de640e0cb90eccac685f5b404b620f5b0df8884661e39dd52c9687457e838643ed899e91d0cf2faa609bc9cb18599738
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82