Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
12-08-2024 23:01
Behavioral task
behavioral1
Sample
ImageLogger.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
ImageLogger.exe
Resource
win10v2004-20240802-en
General
-
Target
ImageLogger.exe
-
Size
483KB
-
MD5
f5955b4d18efb1325dcc8ad9778076fe
-
SHA1
b42b488f84d6d39430655f7bbb67f35b48e7e5b8
-
SHA256
5f0e4772e7b804ea1fc60ebff11d9539c60398f968114c73d47de0b14b075f50
-
SHA512
b4886d0e3fde068e47ae02f242423e86c91b70df3896c6d4935992e6dbc4a1034360369c279bec37fb605b25e6fb89d2c06722d48081009722784bef9a1395d5
-
SSDEEP
6144:oTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZBAXccrdT4:oTlrYw1RUh3NFn+N5WfIQIjbs/ZB+T4
Malware Config
Extracted
remcos
RemoteHost
software-julia.gl.at.ply.gg:17106
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
Windows.exe
-
copy_folder
Windows
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-E22CTC
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Processes:
reg.exereg.exereg.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Executes dropped EXE 1 IoCs
Processes:
Windows.exepid Process 2296 Windows.exe -
Loads dropped DLL 2 IoCs
Processes:
ImageLogger.exepid Process 1440 ImageLogger.exe 1440 ImageLogger.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
Windows.exeiexplore.exeImageLogger.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-E22CTC = "\"C:\\ProgramData\\Windows\\Windows.exe\"" Windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-E22CTC = "\"C:\\ProgramData\\Windows\\Windows.exe\"" Windows.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-E22CTC = "\"C:\\ProgramData\\Windows\\Windows.exe\"" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-E22CTC = "\"C:\\ProgramData\\Windows\\Windows.exe\"" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-E22CTC = "\"C:\\ProgramData\\Windows\\Windows.exe\"" ImageLogger.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-E22CTC = "\"C:\\ProgramData\\Windows\\Windows.exe\"" ImageLogger.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Windows.exeiexplore.exedescription pid Process procid_target PID 2296 set thread context of 2964 2296 Windows.exe 36 PID 2964 set thread context of 2724 2964 iexplore.exe 41 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
reg.exereg.exeWindows.execmd.exereg.exeiexplore.execmd.exeImageLogger.execmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Windows.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ImageLogger.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 3 IoCs
Processes:
reg.exereg.exereg.exepid Process 2084 reg.exe 2980 reg.exe 2240 reg.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Windows.exepid Process 2296 Windows.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid Process 2964 iexplore.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Windows.exeiexplore.exepid Process 2296 Windows.exe 2964 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid Process 2964 iexplore.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
ImageLogger.execmd.exeWindows.execmd.exeiexplore.execmd.exedescription pid Process procid_target PID 1440 wrote to memory of 1996 1440 ImageLogger.exe 31 PID 1440 wrote to memory of 1996 1440 ImageLogger.exe 31 PID 1440 wrote to memory of 1996 1440 ImageLogger.exe 31 PID 1440 wrote to memory of 1996 1440 ImageLogger.exe 31 PID 1996 wrote to memory of 2084 1996 cmd.exe 33 PID 1996 wrote to memory of 2084 1996 cmd.exe 33 PID 1996 wrote to memory of 2084 1996 cmd.exe 33 PID 1996 wrote to memory of 2084 1996 cmd.exe 33 PID 1440 wrote to memory of 2296 1440 ImageLogger.exe 34 PID 1440 wrote to memory of 2296 1440 ImageLogger.exe 34 PID 1440 wrote to memory of 2296 1440 ImageLogger.exe 34 PID 1440 wrote to memory of 2296 1440 ImageLogger.exe 34 PID 2296 wrote to memory of 2656 2296 Windows.exe 35 PID 2296 wrote to memory of 2656 2296 Windows.exe 35 PID 2296 wrote to memory of 2656 2296 Windows.exe 35 PID 2296 wrote to memory of 2656 2296 Windows.exe 35 PID 2296 wrote to memory of 2964 2296 Windows.exe 36 PID 2296 wrote to memory of 2964 2296 Windows.exe 36 PID 2296 wrote to memory of 2964 2296 Windows.exe 36 PID 2296 wrote to memory of 2964 2296 Windows.exe 36 PID 2296 wrote to memory of 2964 2296 Windows.exe 36 PID 2656 wrote to memory of 2240 2656 cmd.exe 38 PID 2656 wrote to memory of 2240 2656 cmd.exe 38 PID 2656 wrote to memory of 2240 2656 cmd.exe 38 PID 2656 wrote to memory of 2240 2656 cmd.exe 38 PID 2964 wrote to memory of 1852 2964 iexplore.exe 39 PID 2964 wrote to memory of 1852 2964 iexplore.exe 39 PID 2964 wrote to memory of 1852 2964 iexplore.exe 39 PID 2964 wrote to memory of 1852 2964 iexplore.exe 39 PID 2964 wrote to memory of 2724 2964 iexplore.exe 41 PID 2964 wrote to memory of 2724 2964 iexplore.exe 41 PID 2964 wrote to memory of 2724 2964 iexplore.exe 41 PID 2964 wrote to memory of 2724 2964 iexplore.exe 41 PID 1852 wrote to memory of 2980 1852 cmd.exe 42 PID 1852 wrote to memory of 2980 1852 cmd.exe 42 PID 1852 wrote to memory of 2980 1852 cmd.exe 42 PID 1852 wrote to memory of 2980 1852 cmd.exe 42 PID 2964 wrote to memory of 2724 2964 iexplore.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\ImageLogger.exe"C:\Users\Admin\AppData\Local\Temp\ImageLogger.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2084
-
-
-
C:\ProgramData\Windows\Windows.exe"C:\ProgramData\Windows\Windows.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2240
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"3⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f5⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2980
-
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe4⤵PID:2724
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
483KB
MD5f5955b4d18efb1325dcc8ad9778076fe
SHA1b42b488f84d6d39430655f7bbb67f35b48e7e5b8
SHA2565f0e4772e7b804ea1fc60ebff11d9539c60398f968114c73d47de0b14b075f50
SHA512b4886d0e3fde068e47ae02f242423e86c91b70df3896c6d4935992e6dbc4a1034360369c279bec37fb605b25e6fb89d2c06722d48081009722784bef9a1395d5
-
Filesize
230B
MD56e67fdb9bacad9cb616cb99a020986da
SHA17baa8bb66e163dc657d1bca9943ffc808dd599bb
SHA256732976738008edaf6996a6d9f87d22f03e98df3dd0683b50dfb30a316880429a
SHA51232213a8837dd08197463847a6dbe329058d29244de2a4f3daa2102f226bebf1d0546d44ce3b1d33ca5051038418c919457f55bb84d756830986344ec2dab161e