ec2b9c75aae260aaa63c0f3d102b57de762895659d5e7339c5342dbe77f29878

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27-08-2024 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec2b9c75aae260aaa63c0f3d102b57de762895659d5e7339c5342dbe77f29878.exe
Size

483KB
MD5

ccb8ba2e5828a30d43113b6dc6c38dfa
SHA1

64fe5810a25d07fc8acad540c53aa84f4e029525
SHA256

ec2b9c75aae260aaa63c0f3d102b57de762895659d5e7339c5342dbe77f29878
SHA512

fff3656bf7f4cab451ce8bf296889c1d8b7edb1c7e7a261187c3b7442982f2433c728a411854fd63f89368ab214b04010bbe0ee935f212d3ae26135c47b39609
SSDEEP

6144:QXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZoAX0cND5Gv:QX7tPMK8ctGe4Dzl4h2QnuPs/Zoecv

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1808	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ec2b9c75aae260aaa63c0f3d102b57de762895659d5e7339c5342dbe77f29878.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2080	ec2b9c75aae260aaa63c0f3d102b57de762895659d5e7339c5342dbe77f29878.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1808	2080	ec2b9c75aae260aaa63c0f3d102b57de762895659d5e7339c5342dbe77f29878.exe	32
PID 2080 wrote to memory of 1808	2080	ec2b9c75aae260aaa63c0f3d102b57de762895659d5e7339c5342dbe77f29878.exe	32
PID 2080 wrote to memory of 1808	2080	ec2b9c75aae260aaa63c0f3d102b57de762895659d5e7339c5342dbe77f29878.exe	32
PID 2080 wrote to memory of 1808	2080	ec2b9c75aae260aaa63c0f3d102b57de762895659d5e7339c5342dbe77f29878.exe	32

C:\Users\Admin\AppData\Local\Temp\ec2b9c75aae260aaa63c0f3d102b57de762895659d5e7339c5342dbe77f29878.exe
"C:\Users\Admin\AppData\Local\Temp\ec2b9c75aae260aaa63c0f3d102b57de762895659d5e7339c5342dbe77f29878.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dcvgqzavcygq.vbs"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
e88d6b4077d319a4a8aad0738dca6ec3

SHA1
ecc753f2e5e38a95ac006f722b1cfd9d4cc43b0f

SHA256
1ffee82625eed2ab7aab076eb70d79e198bff16c0031df3c37238bddd2e07ac3

SHA512
8a4423f7b96e9219bfdfaec6ef001666d7dec1c506f8debfe994e4fc0d4ac223537858556359d6e1c7b060346541f163b1afc1b07a9d2d072effda5a58135b00

Download Submit
C:\Users\Admin\AppData\Local\Temp\dcvgqzavcygq.vbs

Filesize
728B

MD5
ddab09033665f15000c8721f4d90977e

SHA1
b50bcdcbfe0ce1e7bafa230639a2c364b12cec3d

SHA256
34ff7fe9028cd0819df5874d8d54758d928885f837d95cb46072b8978f3cb585

SHA512
47946110c00ea7782b7d44dce5ee98df46a59bed7c1905569e2af226cbdc8c055566ffd3f3b7bf4c6acce129fe69433ef8a92609461b3396059541dd0597d5ea

Download Submit