Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12-08-2024 23:01
Behavioral task
behavioral1
Sample
ImageLogger.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
ImageLogger.exe
Resource
win10v2004-20240802-en
General
-
Target
ImageLogger.exe
-
Size
483KB
-
MD5
f5955b4d18efb1325dcc8ad9778076fe
-
SHA1
b42b488f84d6d39430655f7bbb67f35b48e7e5b8
-
SHA256
5f0e4772e7b804ea1fc60ebff11d9539c60398f968114c73d47de0b14b075f50
-
SHA512
b4886d0e3fde068e47ae02f242423e86c91b70df3896c6d4935992e6dbc4a1034360369c279bec37fb605b25e6fb89d2c06722d48081009722784bef9a1395d5
-
SSDEEP
6144:oTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZBAXccrdT4:oTlrYw1RUh3NFn+N5WfIQIjbs/ZB+T4
Malware Config
Extracted
remcos
RemoteHost
software-julia.gl.at.ply.gg:17106
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
Windows.exe
-
copy_folder
Windows
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-E22CTC
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Processes:
reg.exereg.exereg.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ImageLogger.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation ImageLogger.exe -
Executes dropped EXE 1 IoCs
Processes:
Windows.exepid Process 2312 Windows.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
ImageLogger.exeWindows.exeiexplore.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-E22CTC = "\"C:\\ProgramData\\Windows\\Windows.exe\"" ImageLogger.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-E22CTC = "\"C:\\ProgramData\\Windows\\Windows.exe\"" ImageLogger.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-E22CTC = "\"C:\\ProgramData\\Windows\\Windows.exe\"" Windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-E22CTC = "\"C:\\ProgramData\\Windows\\Windows.exe\"" Windows.exe Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-E22CTC = "\"C:\\ProgramData\\Windows\\Windows.exe\"" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-E22CTC = "\"C:\\ProgramData\\Windows\\Windows.exe\"" iexplore.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Windows.exeiexplore.exedescription pid Process procid_target PID 2312 set thread context of 3436 2312 Windows.exe 93 PID 3436 set thread context of 2328 3436 iexplore.exe 96 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Windows.exeiexplore.execmd.execmd.exereg.exeImageLogger.exereg.exereg.execmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Windows.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ImageLogger.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 1 IoCs
Processes:
ImageLogger.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ ImageLogger.exe -
Modifies registry key 1 TTPs 3 IoCs
Processes:
reg.exereg.exereg.exepid Process 4404 reg.exe 2772 reg.exe 3460 reg.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Windows.exepid Process 2312 Windows.exe 2312 Windows.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Windows.exeiexplore.exepid Process 2312 Windows.exe 3436 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid Process 3436 iexplore.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
ImageLogger.execmd.exeWindows.exeiexplore.execmd.execmd.exedescription pid Process procid_target PID 4492 wrote to memory of 1524 4492 ImageLogger.exe 84 PID 4492 wrote to memory of 1524 4492 ImageLogger.exe 84 PID 4492 wrote to memory of 1524 4492 ImageLogger.exe 84 PID 1524 wrote to memory of 2772 1524 cmd.exe 86 PID 1524 wrote to memory of 2772 1524 cmd.exe 86 PID 1524 wrote to memory of 2772 1524 cmd.exe 86 PID 4492 wrote to memory of 2312 4492 ImageLogger.exe 90 PID 4492 wrote to memory of 2312 4492 ImageLogger.exe 90 PID 4492 wrote to memory of 2312 4492 ImageLogger.exe 90 PID 2312 wrote to memory of 2716 2312 Windows.exe 91 PID 2312 wrote to memory of 2716 2312 Windows.exe 91 PID 2312 wrote to memory of 2716 2312 Windows.exe 91 PID 2312 wrote to memory of 3436 2312 Windows.exe 93 PID 2312 wrote to memory of 3436 2312 Windows.exe 93 PID 2312 wrote to memory of 3436 2312 Windows.exe 93 PID 2312 wrote to memory of 3436 2312 Windows.exe 93 PID 3436 wrote to memory of 3108 3436 iexplore.exe 94 PID 3436 wrote to memory of 3108 3436 iexplore.exe 94 PID 3436 wrote to memory of 3108 3436 iexplore.exe 94 PID 3436 wrote to memory of 2328 3436 iexplore.exe 96 PID 3436 wrote to memory of 2328 3436 iexplore.exe 96 PID 3436 wrote to memory of 2328 3436 iexplore.exe 96 PID 3436 wrote to memory of 2328 3436 iexplore.exe 96 PID 2716 wrote to memory of 4404 2716 cmd.exe 97 PID 2716 wrote to memory of 4404 2716 cmd.exe 97 PID 2716 wrote to memory of 4404 2716 cmd.exe 97 PID 3108 wrote to memory of 3460 3108 cmd.exe 98 PID 3108 wrote to memory of 3460 3108 cmd.exe 98 PID 3108 wrote to memory of 3460 3108 cmd.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\ImageLogger.exe"C:\Users\Admin\AppData\Local\Temp\ImageLogger.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2772
-
-
-
C:\ProgramData\Windows\Windows.exe"C:\ProgramData\Windows\Windows.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4404
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"3⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f5⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3460
-
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe4⤵PID:2328
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
483KB
MD5f5955b4d18efb1325dcc8ad9778076fe
SHA1b42b488f84d6d39430655f7bbb67f35b48e7e5b8
SHA2565f0e4772e7b804ea1fc60ebff11d9539c60398f968114c73d47de0b14b075f50
SHA512b4886d0e3fde068e47ae02f242423e86c91b70df3896c6d4935992e6dbc4a1034360369c279bec37fb605b25e6fb89d2c06722d48081009722784bef9a1395d5
-
Filesize
144B
MD5547f39fdac3556e848440c5f04b9a183
SHA11e846e2b344bf81269902f7a04565be227ec1890
SHA25693080afd0d643b4e2f2b07c5f169671c132075c19ad8e43089afd5ab86bf95f3
SHA5128699c55b16c70368851c7973603a263b3d1738139e488b9cb2019bf40bf84533ead68922e2633166238a3a93d84d65ec8393a7a3a32efe905d7b551b8609111e