Analysis
-
max time kernel
148s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12-08-2024 05:59
Behavioral task
behavioral1
Sample
de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe
Resource
win7-20240704-en
General
-
Target
de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe
-
Size
483KB
-
MD5
a71c2ec29d24f8abfc5686b136f71f22
-
SHA1
01929dffa443b3d17d2c9f32e2efa31759aec136
-
SHA256
de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9
-
SHA512
10de0945c8640a495b8c2617f55d2de75cd05b87f99a6e201bb2d12a9f522dc0536e161d64c5be5ea13672bc4492d3effa9f2b25540834e09e001d826b4dd565
-
SSDEEP
6144:wTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZBAXccriT4:wTlrYw1RUh3NFn+N5WfIQIjbs/ZBFT4
Malware Config
Extracted
remcos
RemoteHost
192.168.1.252:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-39LPSU
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Processes:
reg.exereg.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exeiexplore.exedescription pid Process procid_target PID 2208 set thread context of 3048 2208 de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe 31 PID 3048 set thread context of 2716 3048 iexplore.exe 35 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.execmd.exereg.exereg.exede06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exeiexplore.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe -
Modifies registry key 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exepid Process 2208 de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exeiexplore.exepid Process 2208 de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe 3048 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid Process 3048 iexplore.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exeiexplore.execmd.execmd.exedescription pid Process procid_target PID 2208 wrote to memory of 2812 2208 de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe 30 PID 2208 wrote to memory of 2812 2208 de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe 30 PID 2208 wrote to memory of 2812 2208 de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe 30 PID 2208 wrote to memory of 2812 2208 de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe 30 PID 2208 wrote to memory of 3048 2208 de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe 31 PID 2208 wrote to memory of 3048 2208 de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe 31 PID 2208 wrote to memory of 3048 2208 de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe 31 PID 2208 wrote to memory of 3048 2208 de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe 31 PID 2208 wrote to memory of 3048 2208 de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe 31 PID 3048 wrote to memory of 1992 3048 iexplore.exe 33 PID 3048 wrote to memory of 1992 3048 iexplore.exe 33 PID 3048 wrote to memory of 1992 3048 iexplore.exe 33 PID 3048 wrote to memory of 1992 3048 iexplore.exe 33 PID 3048 wrote to memory of 2716 3048 iexplore.exe 35 PID 3048 wrote to memory of 2716 3048 iexplore.exe 35 PID 3048 wrote to memory of 2716 3048 iexplore.exe 35 PID 3048 wrote to memory of 2716 3048 iexplore.exe 35 PID 3048 wrote to memory of 2716 3048 iexplore.exe 35 PID 1992 wrote to memory of 2596 1992 cmd.exe 36 PID 1992 wrote to memory of 2596 1992 cmd.exe 36 PID 1992 wrote to memory of 2596 1992 cmd.exe 36 PID 1992 wrote to memory of 2596 1992 cmd.exe 36 PID 2812 wrote to memory of 2900 2812 cmd.exe 37 PID 2812 wrote to memory of 2900 2812 cmd.exe 37 PID 2812 wrote to memory of 2900 2812 cmd.exe 37 PID 2812 wrote to memory of 2900 2812 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe"C:\Users\Admin\AppData\Local\Temp\de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2900
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2596
-
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:2716
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5217fba757f2fa02a22b31b6518d3d236
SHA1202708714296dad278c3647bb539b77930dd095a
SHA25615dd6d4dcbd3c6455765efaa262ddcb2da6f1f998f67b512c1e24dcc70c7b88f
SHA5123189f059b647407fb59dff3da01bf5fec50905c4b99d04e6e2d7efbf16e115c78ae2d458cc016e3cc8e592de82906eb19a890b3120eba92da628fe42e0045538