Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12-08-2024 05:59
Behavioral task
behavioral1
Sample
de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe
Resource
win7-20240704-en
General
-
Target
de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe
-
Size
483KB
-
MD5
a71c2ec29d24f8abfc5686b136f71f22
-
SHA1
01929dffa443b3d17d2c9f32e2efa31759aec136
-
SHA256
de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9
-
SHA512
10de0945c8640a495b8c2617f55d2de75cd05b87f99a6e201bb2d12a9f522dc0536e161d64c5be5ea13672bc4492d3effa9f2b25540834e09e001d826b4dd565
-
SSDEEP
6144:wTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZBAXccriT4:wTlrYw1RUh3NFn+N5WfIQIjbs/ZBFT4
Malware Config
Extracted
remcos
RemoteHost
192.168.1.252:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-39LPSU
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Processes:
reg.exereg.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exeiexplore.exedescription pid Process procid_target PID 2560 set thread context of 2284 2560 de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe 87 PID 2284 set thread context of 2204 2284 iexplore.exe 91 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.exereg.exereg.exede06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exeiexplore.execmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exepid Process 2560 de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe 2560 de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exeiexplore.exepid Process 2560 de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe 2284 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid Process 2284 iexplore.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exeiexplore.execmd.execmd.exedescription pid Process procid_target PID 2560 wrote to memory of 3272 2560 de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe 86 PID 2560 wrote to memory of 3272 2560 de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe 86 PID 2560 wrote to memory of 3272 2560 de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe 86 PID 2560 wrote to memory of 2284 2560 de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe 87 PID 2560 wrote to memory of 2284 2560 de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe 87 PID 2560 wrote to memory of 2284 2560 de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe 87 PID 2560 wrote to memory of 2284 2560 de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe 87 PID 2284 wrote to memory of 1936 2284 iexplore.exe 89 PID 2284 wrote to memory of 1936 2284 iexplore.exe 89 PID 2284 wrote to memory of 1936 2284 iexplore.exe 89 PID 2284 wrote to memory of 2204 2284 iexplore.exe 91 PID 2284 wrote to memory of 2204 2284 iexplore.exe 91 PID 2284 wrote to memory of 2204 2284 iexplore.exe 91 PID 2284 wrote to memory of 2204 2284 iexplore.exe 91 PID 3272 wrote to memory of 4980 3272 cmd.exe 92 PID 3272 wrote to memory of 4980 3272 cmd.exe 92 PID 3272 wrote to memory of 4980 3272 cmd.exe 92 PID 1936 wrote to memory of 5088 1936 cmd.exe 93 PID 1936 wrote to memory of 5088 1936 cmd.exe 93 PID 1936 wrote to memory of 5088 1936 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe"C:\Users\Admin\AppData\Local\Temp\de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4980
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:5088
-
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:2204
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5be8b5c3e8ad7421d6c648863d777a618
SHA14def03839dd0eb8ce6fe702af89049e199bcb137
SHA256673db162f7da9aa5f25cb899e2f377a9d4c293b0a8959a4442e650be94b1c25e
SHA5122ea1b8cde5a44bb1dae49f103b39a1b13e23c03344a00935744374241f74d668662d7890ed9dfa4c3ee8fc2546c7ee50ce04fe9303025f1727f67e1451ba1290