Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13-08-2024 03:05
Static task
static1
Behavioral task
behavioral1
Sample
15c127b849650f0c43f5681f8399a090N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
15c127b849650f0c43f5681f8399a090N.exe
Resource
win10v2004-20240802-en
General
-
Target
15c127b849650f0c43f5681f8399a090N.exe
-
Size
932KB
-
MD5
15c127b849650f0c43f5681f8399a090
-
SHA1
efe8542f6e4612a1bddd0f3e29c99f4b70cbc9b3
-
SHA256
d3ab0c4ddfbdbce6b1f200436de1c9d1f94567b06a420dc453d02460452cebca
-
SHA512
b3df32ed3caad831ae02bb7ed72d34747f1e76ec505d3a49a2dceef0207acbcd08c5aea4241ec777035b1896c80df084b85807a51a9fa1dbb6750bc547000bf0
-
SSDEEP
24576:nxv7AOUeJ5BWiJ5K1xKtk4mPbUc39ZDhzq39A:xv7cmWOU1Sk46bUUZDQ
Malware Config
Extracted
remcos
RemoteHost
104.250.180.178:7902
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
Adobe.exe
-
copy_folder
Adobe
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Adobe-OTOIRK
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Adobe.exeAdobe.exepid Process 2760 Adobe.exe 2740 Adobe.exe -
Loads dropped DLL 1 IoCs
Processes:
15c127b849650f0c43f5681f8399a090N.exepid Process 2112 15c127b849650f0c43f5681f8399a090N.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
Adobe.exe15c127b849650f0c43f5681f8399a090N.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe-OTOIRK = "\"C:\\ProgramData\\Adobe\\Adobe.exe\"" Adobe.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe-OTOIRK = "\"C:\\ProgramData\\Adobe\\Adobe.exe\"" 15c127b849650f0c43f5681f8399a090N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe-OTOIRK = "\"C:\\ProgramData\\Adobe\\Adobe.exe\"" 15c127b849650f0c43f5681f8399a090N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe-OTOIRK = "\"C:\\ProgramData\\Adobe\\Adobe.exe\"" Adobe.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
15c127b849650f0c43f5681f8399a090N.exeAdobe.exedescription pid Process procid_target PID 2520 set thread context of 2112 2520 15c127b849650f0c43f5681f8399a090N.exe 31 PID 2760 set thread context of 2740 2760 Adobe.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Adobe.exeAdobe.exe15c127b849650f0c43f5681f8399a090N.exe15c127b849650f0c43f5681f8399a090N.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Adobe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Adobe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15c127b849650f0c43f5681f8399a090N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15c127b849650f0c43f5681f8399a090N.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
15c127b849650f0c43f5681f8399a090N.exe15c127b849650f0c43f5681f8399a090N.exeAdobe.exedescription pid Process procid_target PID 2520 wrote to memory of 2112 2520 15c127b849650f0c43f5681f8399a090N.exe 31 PID 2520 wrote to memory of 2112 2520 15c127b849650f0c43f5681f8399a090N.exe 31 PID 2520 wrote to memory of 2112 2520 15c127b849650f0c43f5681f8399a090N.exe 31 PID 2520 wrote to memory of 2112 2520 15c127b849650f0c43f5681f8399a090N.exe 31 PID 2520 wrote to memory of 2112 2520 15c127b849650f0c43f5681f8399a090N.exe 31 PID 2520 wrote to memory of 2112 2520 15c127b849650f0c43f5681f8399a090N.exe 31 PID 2520 wrote to memory of 2112 2520 15c127b849650f0c43f5681f8399a090N.exe 31 PID 2520 wrote to memory of 2112 2520 15c127b849650f0c43f5681f8399a090N.exe 31 PID 2520 wrote to memory of 2112 2520 15c127b849650f0c43f5681f8399a090N.exe 31 PID 2520 wrote to memory of 2112 2520 15c127b849650f0c43f5681f8399a090N.exe 31 PID 2520 wrote to memory of 2112 2520 15c127b849650f0c43f5681f8399a090N.exe 31 PID 2520 wrote to memory of 2112 2520 15c127b849650f0c43f5681f8399a090N.exe 31 PID 2520 wrote to memory of 2112 2520 15c127b849650f0c43f5681f8399a090N.exe 31 PID 2112 wrote to memory of 2760 2112 15c127b849650f0c43f5681f8399a090N.exe 32 PID 2112 wrote to memory of 2760 2112 15c127b849650f0c43f5681f8399a090N.exe 32 PID 2112 wrote to memory of 2760 2112 15c127b849650f0c43f5681f8399a090N.exe 32 PID 2112 wrote to memory of 2760 2112 15c127b849650f0c43f5681f8399a090N.exe 32 PID 2760 wrote to memory of 2740 2760 Adobe.exe 33 PID 2760 wrote to memory of 2740 2760 Adobe.exe 33 PID 2760 wrote to memory of 2740 2760 Adobe.exe 33 PID 2760 wrote to memory of 2740 2760 Adobe.exe 33 PID 2760 wrote to memory of 2740 2760 Adobe.exe 33 PID 2760 wrote to memory of 2740 2760 Adobe.exe 33 PID 2760 wrote to memory of 2740 2760 Adobe.exe 33 PID 2760 wrote to memory of 2740 2760 Adobe.exe 33 PID 2760 wrote to memory of 2740 2760 Adobe.exe 33 PID 2760 wrote to memory of 2740 2760 Adobe.exe 33 PID 2760 wrote to memory of 2740 2760 Adobe.exe 33 PID 2760 wrote to memory of 2740 2760 Adobe.exe 33 PID 2760 wrote to memory of 2740 2760 Adobe.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\15c127b849650f0c43f5681f8399a090N.exe"C:\Users\Admin\AppData\Local\Temp\15c127b849650f0c43f5681f8399a090N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\15c127b849650f0c43f5681f8399a090N.exe"C:\Users\Admin\AppData\Local\Temp\15c127b849650f0c43f5681f8399a090N.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\ProgramData\Adobe\Adobe.exe"C:\ProgramData\Adobe\Adobe.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\ProgramData\Adobe\Adobe.exe"C:\ProgramData\Adobe\Adobe.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2740
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
932KB
MD515c127b849650f0c43f5681f8399a090
SHA1efe8542f6e4612a1bddd0f3e29c99f4b70cbc9b3
SHA256d3ab0c4ddfbdbce6b1f200436de1c9d1f94567b06a420dc453d02460452cebca
SHA512b3df32ed3caad831ae02bb7ed72d34747f1e76ec505d3a49a2dceef0207acbcd08c5aea4241ec777035b1896c80df084b85807a51a9fa1dbb6750bc547000bf0