Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13-08-2024 03:05
Static task
static1
Behavioral task
behavioral1
Sample
15c127b849650f0c43f5681f8399a090N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
15c127b849650f0c43f5681f8399a090N.exe
Resource
win10v2004-20240802-en
General
-
Target
15c127b849650f0c43f5681f8399a090N.exe
-
Size
932KB
-
MD5
15c127b849650f0c43f5681f8399a090
-
SHA1
efe8542f6e4612a1bddd0f3e29c99f4b70cbc9b3
-
SHA256
d3ab0c4ddfbdbce6b1f200436de1c9d1f94567b06a420dc453d02460452cebca
-
SHA512
b3df32ed3caad831ae02bb7ed72d34747f1e76ec505d3a49a2dceef0207acbcd08c5aea4241ec777035b1896c80df084b85807a51a9fa1dbb6750bc547000bf0
-
SSDEEP
24576:nxv7AOUeJ5BWiJ5K1xKtk4mPbUc39ZDhzq39A:xv7cmWOU1Sk46bUUZDQ
Malware Config
Extracted
remcos
RemoteHost
104.250.180.178:7902
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
Adobe.exe
-
copy_folder
Adobe
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Adobe-OTOIRK
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
15c127b849650f0c43f5681f8399a090N.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation 15c127b849650f0c43f5681f8399a090N.exe -
Executes dropped EXE 2 IoCs
Processes:
Adobe.exeAdobe.exepid Process 1432 Adobe.exe 4524 Adobe.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
15c127b849650f0c43f5681f8399a090N.exeAdobe.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe-OTOIRK = "\"C:\\ProgramData\\Adobe\\Adobe.exe\"" 15c127b849650f0c43f5681f8399a090N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe-OTOIRK = "\"C:\\ProgramData\\Adobe\\Adobe.exe\"" 15c127b849650f0c43f5681f8399a090N.exe Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe-OTOIRK = "\"C:\\ProgramData\\Adobe\\Adobe.exe\"" Adobe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe-OTOIRK = "\"C:\\ProgramData\\Adobe\\Adobe.exe\"" Adobe.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
15c127b849650f0c43f5681f8399a090N.exeAdobe.exedescription pid Process procid_target PID 4536 set thread context of 376 4536 15c127b849650f0c43f5681f8399a090N.exe 94 PID 1432 set thread context of 4524 1432 Adobe.exe 97 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
15c127b849650f0c43f5681f8399a090N.exe15c127b849650f0c43f5681f8399a090N.exeAdobe.exeAdobe.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15c127b849650f0c43f5681f8399a090N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15c127b849650f0c43f5681f8399a090N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Adobe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Adobe.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
15c127b849650f0c43f5681f8399a090N.exe15c127b849650f0c43f5681f8399a090N.exeAdobe.exedescription pid Process procid_target PID 4536 wrote to memory of 376 4536 15c127b849650f0c43f5681f8399a090N.exe 94 PID 4536 wrote to memory of 376 4536 15c127b849650f0c43f5681f8399a090N.exe 94 PID 4536 wrote to memory of 376 4536 15c127b849650f0c43f5681f8399a090N.exe 94 PID 4536 wrote to memory of 376 4536 15c127b849650f0c43f5681f8399a090N.exe 94 PID 4536 wrote to memory of 376 4536 15c127b849650f0c43f5681f8399a090N.exe 94 PID 4536 wrote to memory of 376 4536 15c127b849650f0c43f5681f8399a090N.exe 94 PID 4536 wrote to memory of 376 4536 15c127b849650f0c43f5681f8399a090N.exe 94 PID 4536 wrote to memory of 376 4536 15c127b849650f0c43f5681f8399a090N.exe 94 PID 4536 wrote to memory of 376 4536 15c127b849650f0c43f5681f8399a090N.exe 94 PID 4536 wrote to memory of 376 4536 15c127b849650f0c43f5681f8399a090N.exe 94 PID 4536 wrote to memory of 376 4536 15c127b849650f0c43f5681f8399a090N.exe 94 PID 4536 wrote to memory of 376 4536 15c127b849650f0c43f5681f8399a090N.exe 94 PID 376 wrote to memory of 1432 376 15c127b849650f0c43f5681f8399a090N.exe 95 PID 376 wrote to memory of 1432 376 15c127b849650f0c43f5681f8399a090N.exe 95 PID 376 wrote to memory of 1432 376 15c127b849650f0c43f5681f8399a090N.exe 95 PID 1432 wrote to memory of 4524 1432 Adobe.exe 97 PID 1432 wrote to memory of 4524 1432 Adobe.exe 97 PID 1432 wrote to memory of 4524 1432 Adobe.exe 97 PID 1432 wrote to memory of 4524 1432 Adobe.exe 97 PID 1432 wrote to memory of 4524 1432 Adobe.exe 97 PID 1432 wrote to memory of 4524 1432 Adobe.exe 97 PID 1432 wrote to memory of 4524 1432 Adobe.exe 97 PID 1432 wrote to memory of 4524 1432 Adobe.exe 97 PID 1432 wrote to memory of 4524 1432 Adobe.exe 97 PID 1432 wrote to memory of 4524 1432 Adobe.exe 97 PID 1432 wrote to memory of 4524 1432 Adobe.exe 97 PID 1432 wrote to memory of 4524 1432 Adobe.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\15c127b849650f0c43f5681f8399a090N.exe"C:\Users\Admin\AppData\Local\Temp\15c127b849650f0c43f5681f8399a090N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\15c127b849650f0c43f5681f8399a090N.exe"C:\Users\Admin\AppData\Local\Temp\15c127b849650f0c43f5681f8399a090N.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:376 -
C:\ProgramData\Adobe\Adobe.exe"C:\ProgramData\Adobe\Adobe.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\ProgramData\Adobe\Adobe.exe"C:\ProgramData\Adobe\Adobe.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4524
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
932KB
MD515c127b849650f0c43f5681f8399a090
SHA1efe8542f6e4612a1bddd0f3e29c99f4b70cbc9b3
SHA256d3ab0c4ddfbdbce6b1f200436de1c9d1f94567b06a420dc453d02460452cebca
SHA512b3df32ed3caad831ae02bb7ed72d34747f1e76ec505d3a49a2dceef0207acbcd08c5aea4241ec777035b1896c80df084b85807a51a9fa1dbb6750bc547000bf0