Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12-08-2024 22:22
Behavioral task
behavioral1
Sample
WaveCracked.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
WaveCracked.exe
Resource
win10v2004-20240802-en
General
-
Target
WaveCracked.exe
-
Size
233KB
-
MD5
54e2d75d45916e3ef7626b295a46fe5e
-
SHA1
31d13380d5770f71bce90d7d9dfed53e521bec69
-
SHA256
d2d5b60e6c8c766465f2423b8ce7b5ec80037ec3d074963be092619ae5351e51
-
SHA512
5bac07a43a48fc50f23ab62e930b2ae762b13679aba771af76919e84f07d19de508198b41a7a6dbb54816948422b5a95e5f537020b9d386b0035c221960ad1c0
-
SSDEEP
6144:9RLoVADCdeGx+T9mu2umTe7QBm+ip7BG:9VWzQT9DmTaQBPid
Malware Config
Extracted
remcos
RemoteHost
software-julia.gl.at.ply.gg:17106
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
Windows.exe
-
copy_folder
Windows
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%WinDir%\System32
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-YXDVYL
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Processes:
reg.exereg.exereg.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Executes dropped EXE 1 IoCs
Processes:
Windows.exepid Process 1744 Windows.exe -
Loads dropped DLL 2 IoCs
Processes:
WaveCracked.exepid Process 2092 WaveCracked.exe 2092 WaveCracked.exe -
Processes:
resource yara_rule behavioral1/memory/2092-0-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/files/0x0008000000018c18-4.dat upx behavioral1/memory/2092-10-0x00000000034B0000-0x000000000353A000-memory.dmp upx behavioral1/memory/2092-14-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1744-15-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1744-20-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-23-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-22-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-29-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-27-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-21-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-18-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-35-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-37-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-38-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-40-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-41-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-43-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-44-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-47-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-48-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-50-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-51-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-64-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-65-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-68-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-67-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-69-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-74-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-73-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-75-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-76-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-79-0x0000000000400000-0x000000000048A000-memory.dmp upx behavioral1/memory/1980-78-0x0000000000400000-0x000000000048A000-memory.dmp upx -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
WaveCracked.exeWindows.exeiexplore.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-YXDVYL = "\"C:\\Windows\\SysWOW64\\Windows\\Windows.exe\"" WaveCracked.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-YXDVYL = "\"C:\\Windows\\SysWOW64\\Windows\\Windows.exe\"" Windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-YXDVYL = "\"C:\\Windows\\SysWOW64\\Windows\\Windows.exe\"" Windows.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-YXDVYL = "\"C:\\Windows\\SysWOW64\\Windows\\Windows.exe\"" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-YXDVYL = "\"C:\\Windows\\SysWOW64\\Windows\\Windows.exe\"" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-YXDVYL = "\"C:\\Windows\\SysWOW64\\Windows\\Windows.exe\"" WaveCracked.exe -
Drops file in System32 directory 3 IoCs
Processes:
WaveCracked.exedescription ioc Process File created C:\Windows\SysWOW64\Windows\Windows.exe WaveCracked.exe File opened for modification C:\Windows\SysWOW64\Windows\Windows.exe WaveCracked.exe File opened for modification C:\Windows\SysWOW64\Windows WaveCracked.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Windows.exeiexplore.exedescription pid Process procid_target PID 1744 set thread context of 1980 1744 Windows.exe 36 PID 1980 set thread context of 2728 1980 iexplore.exe 41 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.exereg.exeWaveCracked.exereg.exeiexplore.execmd.exereg.execmd.exeWindows.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaveCracked.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Windows.exe -
Modifies registry key 1 TTPs 3 IoCs
Processes:
reg.exereg.exereg.exepid Process 2528 reg.exe 836 reg.exe 2848 reg.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Windows.exepid Process 1744 Windows.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid Process 1980 iexplore.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
Windows.exeiexplore.exepid Process 1744 Windows.exe 1980 iexplore.exe 1980 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid Process 1980 iexplore.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
WaveCracked.execmd.exeWindows.exeiexplore.execmd.execmd.exedescription pid Process procid_target PID 2092 wrote to memory of 2384 2092 WaveCracked.exe 30 PID 2092 wrote to memory of 2384 2092 WaveCracked.exe 30 PID 2092 wrote to memory of 2384 2092 WaveCracked.exe 30 PID 2092 wrote to memory of 2384 2092 WaveCracked.exe 30 PID 2384 wrote to memory of 2528 2384 cmd.exe 32 PID 2384 wrote to memory of 2528 2384 cmd.exe 32 PID 2384 wrote to memory of 2528 2384 cmd.exe 32 PID 2384 wrote to memory of 2528 2384 cmd.exe 32 PID 2092 wrote to memory of 1744 2092 WaveCracked.exe 34 PID 2092 wrote to memory of 1744 2092 WaveCracked.exe 34 PID 2092 wrote to memory of 1744 2092 WaveCracked.exe 34 PID 2092 wrote to memory of 1744 2092 WaveCracked.exe 34 PID 1744 wrote to memory of 2760 1744 Windows.exe 35 PID 1744 wrote to memory of 2760 1744 Windows.exe 35 PID 1744 wrote to memory of 2760 1744 Windows.exe 35 PID 1744 wrote to memory of 2760 1744 Windows.exe 35 PID 1744 wrote to memory of 1980 1744 Windows.exe 36 PID 1744 wrote to memory of 1980 1744 Windows.exe 36 PID 1744 wrote to memory of 1980 1744 Windows.exe 36 PID 1744 wrote to memory of 1980 1744 Windows.exe 36 PID 1744 wrote to memory of 1980 1744 Windows.exe 36 PID 1980 wrote to memory of 1028 1980 iexplore.exe 38 PID 1980 wrote to memory of 1028 1980 iexplore.exe 38 PID 1980 wrote to memory of 1028 1980 iexplore.exe 38 PID 1980 wrote to memory of 1028 1980 iexplore.exe 38 PID 1980 wrote to memory of 2780 1980 iexplore.exe 40 PID 1980 wrote to memory of 2780 1980 iexplore.exe 40 PID 1980 wrote to memory of 2780 1980 iexplore.exe 40 PID 1980 wrote to memory of 2780 1980 iexplore.exe 40 PID 1980 wrote to memory of 2728 1980 iexplore.exe 41 PID 1980 wrote to memory of 2728 1980 iexplore.exe 41 PID 1980 wrote to memory of 2728 1980 iexplore.exe 41 PID 1980 wrote to memory of 2728 1980 iexplore.exe 41 PID 1980 wrote to memory of 2728 1980 iexplore.exe 41 PID 1028 wrote to memory of 836 1028 cmd.exe 42 PID 1028 wrote to memory of 836 1028 cmd.exe 42 PID 1028 wrote to memory of 836 1028 cmd.exe 42 PID 1028 wrote to memory of 836 1028 cmd.exe 42 PID 2760 wrote to memory of 2848 2760 cmd.exe 43 PID 2760 wrote to memory of 2848 2760 cmd.exe 43 PID 2760 wrote to memory of 2848 2760 cmd.exe 43 PID 2760 wrote to memory of 2848 2760 cmd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\WaveCracked.exe"C:\Users\Admin\AppData\Local\Temp\WaveCracked.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2528
-
-
-
C:\Windows\SysWOW64\Windows\Windows.exe"C:\Windows\SysWOW64\Windows\Windows.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2848
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"3⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f5⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:836
-
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe4⤵PID:2780
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe4⤵PID:2728
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD50cca0a4049fd4880fda6fb3ed4a1be1e
SHA115ef78b06b825c6e6d62bed4e4ded7130378e255
SHA256a67d4a842a69130c40035d7383ffd9813bbcb9d715531e72cd6f52d30f8a071b
SHA5123b690e4bbb90781fbfa0c48aa915aab78b31202d14da7a9fb48e5af3c56f71c413d1c355bb1edddb2108d93b690ec0365609970c3f028b9b580600b97ef1f110
-
Filesize
233KB
MD554e2d75d45916e3ef7626b295a46fe5e
SHA131d13380d5770f71bce90d7d9dfed53e521bec69
SHA256d2d5b60e6c8c766465f2423b8ce7b5ec80037ec3d074963be092619ae5351e51
SHA5125bac07a43a48fc50f23ab62e930b2ae762b13679aba771af76919e84f07d19de508198b41a7a6dbb54816948422b5a95e5f537020b9d386b0035c221960ad1c0