Analysis
-
max time kernel
147s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14-08-2024 06:07
Static task
static1
Behavioral task
behavioral1
Sample
1099.pdf
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
1099.pdf
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
TAXORGANIZERpdf.exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
TAXORGANIZERpdf.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
msimg32.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
msimg32.dll
Resource
win10v2004-20240802-en
General
-
Target
TAXORGANIZERpdf.exe
-
Size
1.7MB
-
MD5
30307b319b2451b6bf61d3e6b232f1da
-
SHA1
6a512848872be1325761e7ca110e0a1ee91cb0ef
-
SHA256
a7dbbad8a1cd038e5ab5b3c6b1b312774d808e4b0a2254e8039036972ac8881a
-
SHA512
7833ecb30a75324af6852e3583a609a653652f3cda9037ace7a1098ce7e52ed4b994c5ff1a0a0b4db748a01b06e8d4b8a10a50ebb9c0d4fbc8aa12dd1168f0b7
-
SSDEEP
24576:17AMY27PG+4VWz3zYxQ2IQKbvavAyoVVxPuOcabAC9fH6lJUkwJYaTTgKmfa8+:Nwj+4VWnoqSkHNckbfH6lJ2XgKmf+
Malware Config
Extracted
remcos
RemoteHost
privmerkt.com:6042
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-LKQWZ1
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*ChromeUpdate = "rundll32.exe C:\\Users\\Admin\\Documents\\FirefoxData.dll,EntryPoint" reg.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
TAXORGANIZERpdf.exepid Process 3628 TAXORGANIZERpdf.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
reg.exeTAXORGANIZERpdf.exeTAXORGANIZERpdf.execmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TAXORGANIZERpdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TAXORGANIZERpdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
TAXORGANIZERpdf.execmd.exedescription pid Process procid_target PID 3628 wrote to memory of 4452 3628 TAXORGANIZERpdf.exe 91 PID 3628 wrote to memory of 4452 3628 TAXORGANIZERpdf.exe 91 PID 3628 wrote to memory of 4452 3628 TAXORGANIZERpdf.exe 91 PID 3628 wrote to memory of 4452 3628 TAXORGANIZERpdf.exe 91 PID 3628 wrote to memory of 4452 3628 TAXORGANIZERpdf.exe 91 PID 3628 wrote to memory of 4452 3628 TAXORGANIZERpdf.exe 91 PID 3628 wrote to memory of 4384 3628 TAXORGANIZERpdf.exe 93 PID 3628 wrote to memory of 4384 3628 TAXORGANIZERpdf.exe 93 PID 3628 wrote to memory of 4384 3628 TAXORGANIZERpdf.exe 93 PID 4384 wrote to memory of 3180 4384 cmd.exe 95 PID 4384 wrote to memory of 3180 4384 cmd.exe 95 PID 4384 wrote to memory of 3180 4384 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe"C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe"1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe"C:\Users\Admin\AppData\Local\Temp\TAXORGANIZERpdf.exe"2⤵
- System Location Discovery: System Language Discovery
PID:4452
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\FirefoxData.dll",EntryPoint /f & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\FirefoxData.dll",EntryPoint /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3180
-
-