Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14-08-2024 06:07
Static task
static1
Behavioral task
behavioral1
Sample
1099.pdf
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
1099.pdf
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
TAXORGANIZERpdf.exe
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
TAXORGANIZERpdf.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
msimg32.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
msimg32.dll
Resource
win10v2004-20240802-en
General
-
Target
msimg32.dll
-
Size
2.0MB
-
MD5
0053dea750b34089a1de8d10d18a9528
-
SHA1
e47bae9334a3cbeb1491756bb117e75882507bb6
-
SHA256
b670e59f539f07cfa6e43d69a9792f1fa38cf6dbdd92bca0db08511727e9308d
-
SHA512
cc1c2c8181a9604b93cafe7c255a1002454e90fa8c9bf5eb07be5868e331412895314c1e9ba970f8abf0f338aeb14b4211dbd18653e0e880dc9518a35da68c28
-
SSDEEP
49152:Mp1wTHyQhBCMsvEq0eBiDw0uJDHufr4/6B7uvRKtIe3/D92K6xZG5f+WFFynVsuf:01wTHF5svP7YDw0kwk2q
Malware Config
Extracted
remcos
RemoteHost
privmerkt.com:6042
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-LKQWZ1
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid Process 22 2316 rundll32.exe 28 2316 rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*ChromeUpdate = "rundll32.exe C:\\Users\\Admin\\Documents\\FirefoxData.dll,EntryPoint" reg.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
rundll32.exepid Process 2112 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.exereg.exerundll32.exerundll32.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
rundll32.exerundll32.execmd.exedescription pid Process procid_target PID 3100 wrote to memory of 2112 3100 rundll32.exe 86 PID 3100 wrote to memory of 2112 3100 rundll32.exe 86 PID 3100 wrote to memory of 2112 3100 rundll32.exe 86 PID 2112 wrote to memory of 2316 2112 rundll32.exe 93 PID 2112 wrote to memory of 2316 2112 rundll32.exe 93 PID 2112 wrote to memory of 2316 2112 rundll32.exe 93 PID 2112 wrote to memory of 2316 2112 rundll32.exe 93 PID 2112 wrote to memory of 2316 2112 rundll32.exe 93 PID 2112 wrote to memory of 2316 2112 rundll32.exe 93 PID 2112 wrote to memory of 3448 2112 rundll32.exe 95 PID 2112 wrote to memory of 3448 2112 rundll32.exe 95 PID 2112 wrote to memory of 3448 2112 rundll32.exe 95 PID 3448 wrote to memory of 3780 3448 cmd.exe 97 PID 3448 wrote to memory of 3780 3448 cmd.exe 97 PID 3448 wrote to memory of 3780 3448 cmd.exe 97
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\msimg32.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\msimg32.dll,#12⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"3⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2316
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\FirefoxData.dll",EntryPoint /f & exit3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\FirefoxData.dll",EntryPoint /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3780
-
-
-