Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12-08-2024 22:56
Behavioral task
behavioral1
Sample
ImageLogger.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ImageLogger.exe
Resource
win10v2004-20240802-en
General
-
Target
ImageLogger.exe
-
Size
483KB
-
MD5
3bb489034bbe5a50f866a3b4257d8efc
-
SHA1
ac7b71c48cb0bcd81db38afb5f88eb196fc55c6d
-
SHA256
b722366efcf9c6f32c697164a821dbdbcb7abdab41e2685e16944d659ee5dc4c
-
SHA512
827f669d0bee715bf49ef0e50bc7689eb1e78408df60d79ed720bb0e8444daca89bd4f0396202394a5b01e2efa8511838d7aad1af70609c47b859ff8d688f566
-
SSDEEP
6144:QTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZBAXccr2T4:QTlrYw1RUh3NFn+N5WfIQIjbs/ZBhT4
Malware Config
Extracted
remcos
RemoteHost
software-julia.gl.at.ply.gg:17106
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
Windows.exe
-
copy_folder
Windows
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-H2REJ9
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Processes:
reg.exereg.exereg.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ImageLogger.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation ImageLogger.exe -
Executes dropped EXE 1 IoCs
Processes:
Windows.exepid Process 324 Windows.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
ImageLogger.exeWindows.exeiexplore.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-H2REJ9 = "\"C:\\ProgramData\\Windows\\Windows.exe\"" ImageLogger.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-H2REJ9 = "\"C:\\ProgramData\\Windows\\Windows.exe\"" ImageLogger.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-H2REJ9 = "\"C:\\ProgramData\\Windows\\Windows.exe\"" Windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-H2REJ9 = "\"C:\\ProgramData\\Windows\\Windows.exe\"" Windows.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-H2REJ9 = "\"C:\\ProgramData\\Windows\\Windows.exe\"" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-H2REJ9 = "\"C:\\ProgramData\\Windows\\Windows.exe\"" iexplore.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Windows.exeiexplore.exedescription pid Process procid_target PID 324 set thread context of 4084 324 Windows.exe 91 PID 4084 set thread context of 2472 4084 iexplore.exe 95 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.exereg.exeImageLogger.execmd.exeWindows.exeiexplore.execmd.exereg.exereg.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ImageLogger.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Windows.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry class 1 IoCs
Processes:
ImageLogger.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ ImageLogger.exe -
Modifies registry key 1 TTPs 3 IoCs
Processes:
reg.exereg.exereg.exepid Process 556 reg.exe 3376 reg.exe 4496 reg.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Windows.exepid Process 324 Windows.exe 324 Windows.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Windows.exeiexplore.exepid Process 324 Windows.exe 4084 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid Process 4084 iexplore.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
ImageLogger.execmd.exeWindows.exeiexplore.execmd.execmd.exedescription pid Process procid_target PID 1004 wrote to memory of 968 1004 ImageLogger.exe 83 PID 1004 wrote to memory of 968 1004 ImageLogger.exe 83 PID 1004 wrote to memory of 968 1004 ImageLogger.exe 83 PID 968 wrote to memory of 556 968 cmd.exe 85 PID 968 wrote to memory of 556 968 cmd.exe 85 PID 968 wrote to memory of 556 968 cmd.exe 85 PID 1004 wrote to memory of 324 1004 ImageLogger.exe 89 PID 1004 wrote to memory of 324 1004 ImageLogger.exe 89 PID 1004 wrote to memory of 324 1004 ImageLogger.exe 89 PID 324 wrote to memory of 1680 324 Windows.exe 90 PID 324 wrote to memory of 1680 324 Windows.exe 90 PID 324 wrote to memory of 1680 324 Windows.exe 90 PID 324 wrote to memory of 4084 324 Windows.exe 91 PID 324 wrote to memory of 4084 324 Windows.exe 91 PID 324 wrote to memory of 4084 324 Windows.exe 91 PID 324 wrote to memory of 4084 324 Windows.exe 91 PID 4084 wrote to memory of 3208 4084 iexplore.exe 93 PID 4084 wrote to memory of 3208 4084 iexplore.exe 93 PID 4084 wrote to memory of 3208 4084 iexplore.exe 93 PID 4084 wrote to memory of 2472 4084 iexplore.exe 95 PID 4084 wrote to memory of 2472 4084 iexplore.exe 95 PID 4084 wrote to memory of 2472 4084 iexplore.exe 95 PID 4084 wrote to memory of 2472 4084 iexplore.exe 95 PID 1680 wrote to memory of 4496 1680 cmd.exe 96 PID 1680 wrote to memory of 4496 1680 cmd.exe 96 PID 1680 wrote to memory of 4496 1680 cmd.exe 96 PID 3208 wrote to memory of 3376 3208 cmd.exe 97 PID 3208 wrote to memory of 3376 3208 cmd.exe 97 PID 3208 wrote to memory of 3376 3208 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\ImageLogger.exe"C:\Users\Admin\AppData\Local\Temp\ImageLogger.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:556
-
-
-
C:\ProgramData\Windows\Windows.exe"C:\ProgramData\Windows\Windows.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4496
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"3⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f5⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3376
-
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe4⤵PID:2472
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
483KB
MD53bb489034bbe5a50f866a3b4257d8efc
SHA1ac7b71c48cb0bcd81db38afb5f88eb196fc55c6d
SHA256b722366efcf9c6f32c697164a821dbdbcb7abdab41e2685e16944d659ee5dc4c
SHA512827f669d0bee715bf49ef0e50bc7689eb1e78408df60d79ed720bb0e8444daca89bd4f0396202394a5b01e2efa8511838d7aad1af70609c47b859ff8d688f566
-
Filesize
144B
MD5e9f0d455bd1e14118d2460df8d437858
SHA1866d8888e04802dfbfac67243f1172053ae15dce
SHA256fbd5ad941ab06c9d511b85702cb604c37ca4539af1acbfaa9cb4fc52bfd943a5
SHA51203fd72ec2602c95d7d754f3df9c7a51d2988981cfe3b299a40289ac99d6f6860a2509558206eeb159bf4d171adb6a9fcf8dbfaf5385bfa670ab7614b09712ac7