Analysis
-
max time kernel
147s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
18-08-2024 13:28
Static task
static1
Behavioral task
behavioral1
Sample
QNB_Group_Payment_Notice_Slip.pdf.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
QNB_Group_Payment_Notice_Slip.pdf.exe
Resource
win10v2004-20240802-en
General
-
Target
QNB_Group_Payment_Notice_Slip.pdf.exe
-
Size
982KB
-
MD5
8eca6c00555ac8e91091901a16166ba9
-
SHA1
f595f6b9274887d03020d6cf9ddc508237f40207
-
SHA256
36a6d99fa6a4d415693ac28a5eb2bdeb425bfbbe4b4e9ea2e51be2feac3fab17
-
SHA512
5936c3b66cbb9db67a742ecc5715b14140a2c98ad23e5aabd5214c62ff88f5a16bd26b415e4257e27b82b5e5f894e78435079c5ffc2ae9940c36eafe33441dd3
-
SSDEEP
24576:NAr0vrlp9niTFJbhAd3oQIS4TelTmGg/Pf70:N1zz9niPNg0S4TeRm3D0
Malware Config
Extracted
remcos
RemoteHost
212.162.149.42:7118
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-WYBPPO
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2720 powershell.exe 2900 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2220 set thread context of 2612 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 35 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QNB_Group_Payment_Notice_Slip.pdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QNB_Group_Payment_Notice_Slip.pdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2840 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 2720 powershell.exe 2900 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2220 QNB_Group_Payment_Notice_Slip.pdf.exe Token: SeDebugPrivilege 2900 powershell.exe Token: SeDebugPrivilege 2720 powershell.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2720 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 29 PID 2220 wrote to memory of 2720 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 29 PID 2220 wrote to memory of 2720 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 29 PID 2220 wrote to memory of 2720 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 29 PID 2220 wrote to memory of 2900 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 31 PID 2220 wrote to memory of 2900 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 31 PID 2220 wrote to memory of 2900 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 31 PID 2220 wrote to memory of 2900 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 31 PID 2220 wrote to memory of 2840 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 32 PID 2220 wrote to memory of 2840 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 32 PID 2220 wrote to memory of 2840 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 32 PID 2220 wrote to memory of 2840 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 32 PID 2220 wrote to memory of 2612 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 35 PID 2220 wrote to memory of 2612 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 35 PID 2220 wrote to memory of 2612 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 35 PID 2220 wrote to memory of 2612 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 35 PID 2220 wrote to memory of 2612 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 35 PID 2220 wrote to memory of 2612 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 35 PID 2220 wrote to memory of 2612 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 35 PID 2220 wrote to memory of 2612 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 35 PID 2220 wrote to memory of 2612 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 35 PID 2220 wrote to memory of 2612 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 35 PID 2220 wrote to memory of 2612 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 35 PID 2220 wrote to memory of 2612 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 35 PID 2220 wrote to memory of 2612 2220 QNB_Group_Payment_Notice_Slip.pdf.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\QNB_Group_Payment_Notice_Slip.pdf.exe"C:\Users\Admin\AppData\Local\Temp\QNB_Group_Payment_Notice_Slip.pdf.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\QNB_Group_Payment_Notice_Slip.pdf.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GZPESEpoVmfRnL.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2900
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GZPESEpoVmfRnL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp99CF.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2840
-
-
C:\Users\Admin\AppData\Local\Temp\QNB_Group_Payment_Notice_Slip.pdf.exe"C:\Users\Admin\AppData\Local\Temp\QNB_Group_Payment_Notice_Slip.pdf.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2612
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD597e1c8876dd903856e03086acd59a564
SHA1c6df2be35209dc5f58696a9cc3cdec30e510b949
SHA256ae6583c220ed4617ac8d12030bcb15afb62c1e29b2c884e09d202176c7db8cf6
SHA51275297e6792e92d43757114fdb64cee0bf13722ca90f9ace2b0d4bd7fb4fbb7aa54127b17fe508e71ac8cf9b054b6d51d4db822a2a55f78a9af7e390ec52769ef
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\A9AFA0I3WJP7PT0V3KT2.temp
Filesize7KB
MD5ad0b477197b3df2724403686051b803e
SHA14138f50f84092c73dbf1adfc18029932b5af11d5
SHA25678df4f89a3f4fab75e23696e0109c63b3f06780049c8cfda1b2e6459ef85d9a8
SHA5122d8ddf885461eab8d39f0ccfa9e78be0592886ea0f94c8851f2285c3439b6c840b2445ac971335a2a2d7c9553a941519430d096092dd1df992957234ca304c04