Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2024 02:01
Static task
static1
Behavioral task
behavioral1
Sample
a8e25a2520c09dd71e17afbde126f58514921c6d967a786bde096fafda08701a.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
a8e25a2520c09dd71e17afbde126f58514921c6d967a786bde096fafda08701a.exe
Resource
win10v2004-20240709-en
General
-
Target
a8e25a2520c09dd71e17afbde126f58514921c6d967a786bde096fafda08701a.exe
-
Size
2.2MB
-
MD5
6c3b88c4675ff6cad62702925a3390f1
-
SHA1
d7c0fdc2b3b92df96b5bcd7a390aa7312df086a5
-
SHA256
a8e25a2520c09dd71e17afbde126f58514921c6d967a786bde096fafda08701a
-
SHA512
ee611d1b240a25a02d8ea9ecca3deb943da34dfcb03a38c2e5d8b40a2cea60d4d4446f968b4af6dc6c9f21bd951b3023e16939ebd1fe0a3fd0867f6a0d143e4a
-
SSDEEP
49152:qB1BRf3rOSzOzrFNj8e1KbWF8K7Vk3SZTH4OWOEkw/R8jDYWg16pb67Wy/Zz:aaRrFCI4v7p
Malware Config
Extracted
remcos
RemoteHost
103.198.26.25:96
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-IPUJM4
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
a8e25a2520c09dd71e17afbde126f58514921c6d967a786bde096fafda08701a.exedescription pid process target process PID 4728 set thread context of 4856 4728 a8e25a2520c09dd71e17afbde126f58514921c6d967a786bde096fafda08701a.exe regsvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 4340 powershell.exe 4340 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 4340 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
a8e25a2520c09dd71e17afbde126f58514921c6d967a786bde096fafda08701a.exedescription pid process target process PID 4728 wrote to memory of 4340 4728 a8e25a2520c09dd71e17afbde126f58514921c6d967a786bde096fafda08701a.exe powershell.exe PID 4728 wrote to memory of 4340 4728 a8e25a2520c09dd71e17afbde126f58514921c6d967a786bde096fafda08701a.exe powershell.exe PID 4728 wrote to memory of 4856 4728 a8e25a2520c09dd71e17afbde126f58514921c6d967a786bde096fafda08701a.exe regsvcs.exe PID 4728 wrote to memory of 4856 4728 a8e25a2520c09dd71e17afbde126f58514921c6d967a786bde096fafda08701a.exe regsvcs.exe PID 4728 wrote to memory of 4856 4728 a8e25a2520c09dd71e17afbde126f58514921c6d967a786bde096fafda08701a.exe regsvcs.exe PID 4728 wrote to memory of 4856 4728 a8e25a2520c09dd71e17afbde126f58514921c6d967a786bde096fafda08701a.exe regsvcs.exe PID 4728 wrote to memory of 4856 4728 a8e25a2520c09dd71e17afbde126f58514921c6d967a786bde096fafda08701a.exe regsvcs.exe PID 4728 wrote to memory of 4856 4728 a8e25a2520c09dd71e17afbde126f58514921c6d967a786bde096fafda08701a.exe regsvcs.exe PID 4728 wrote to memory of 4856 4728 a8e25a2520c09dd71e17afbde126f58514921c6d967a786bde096fafda08701a.exe regsvcs.exe PID 4728 wrote to memory of 4856 4728 a8e25a2520c09dd71e17afbde126f58514921c6d967a786bde096fafda08701a.exe regsvcs.exe PID 4728 wrote to memory of 4856 4728 a8e25a2520c09dd71e17afbde126f58514921c6d967a786bde096fafda08701a.exe regsvcs.exe PID 4728 wrote to memory of 4856 4728 a8e25a2520c09dd71e17afbde126f58514921c6d967a786bde096fafda08701a.exe regsvcs.exe PID 4728 wrote to memory of 4856 4728 a8e25a2520c09dd71e17afbde126f58514921c6d967a786bde096fafda08701a.exe regsvcs.exe PID 4728 wrote to memory of 4856 4728 a8e25a2520c09dd71e17afbde126f58514921c6d967a786bde096fafda08701a.exe regsvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8e25a2520c09dd71e17afbde126f58514921c6d967a786bde096fafda08701a.exe"C:\Users\Admin\AppData\Local\Temp\a8e25a2520c09dd71e17afbde126f58514921c6d967a786bde096fafda08701a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath $env:UserProfile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_laze35ir.top.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/4340-16-0x00007FFBFE0C0000-0x00007FFBFEB81000-memory.dmpFilesize
10.8MB
-
memory/4340-10-0x0000020630620000-0x0000020630642000-memory.dmpFilesize
136KB
-
memory/4340-0-0x00007FFBFE0C3000-0x00007FFBFE0C5000-memory.dmpFilesize
8KB
-
memory/4340-28-0x00007FFBFE0C0000-0x00007FFBFEB81000-memory.dmpFilesize
10.8MB
-
memory/4856-44-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-12-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-17-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-18-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-19-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-20-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-21-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-22-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-23-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-24-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-25-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-26-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-27-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-48-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-29-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-30-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-31-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-32-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-33-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-34-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-35-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-36-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-37-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-38-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-39-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-40-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-41-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-42-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-43-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-11-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-49-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-46-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-52-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-15-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-45-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-50-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-51-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-47-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-53-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-54-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-55-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-56-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-57-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-58-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-59-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-60-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-61-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-62-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-63-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-64-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-65-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-66-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-67-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-68-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-69-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-70-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-71-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-72-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-73-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-74-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-75-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-76-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-77-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-78-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-79-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4856-80-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB