Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/09/2024, 06:43
Static task
static1
Behavioral task
behavioral1
Sample
049ccb277f6c9e2816347b2d51df7ba0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
049ccb277f6c9e2816347b2d51df7ba0N.exe
Resource
win10v2004-20240802-en
General
-
Target
049ccb277f6c9e2816347b2d51df7ba0N.exe
-
Size
4.3MB
-
MD5
049ccb277f6c9e2816347b2d51df7ba0
-
SHA1
b78da518b845bacca6ecd4595f751a8e6c41c4d6
-
SHA256
dbd90ffa51b2ec9e716642d651d5740f2a9e376db28b217dbc31ab89b5362409
-
SHA512
4250cf0ca6815f97265eb7924095c84a8fe41e463bcf172802e72ba5c045f999f23411a994a21d73cab270fe22287e44b33d5314f5b120ab5fad79c53e8a4559
-
SSDEEP
98304:gC11IMjItWMFAetMtXjxhmZrC11IMjItWMFAetMtXjxhmZY4T:ghSMFjO7mZrhSMFjO7mZY
Malware Config
Extracted
remcos
MISTERY-PC
nzobaku.ddns.net:8081
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-59N2NZ
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2892 powershell.exe 1936 powershell.exe -
Executes dropped EXE 7 IoCs
pid Process 2708 ._cache_049ccb277f6c9e2816347b2d51df7ba0N.exe 2640 Synaptics.exe 696 Synaptics.exe 2900 Synaptics.exe 2676 Synaptics.exe 2288 Synaptics.exe 2080 Synaptics.exe -
Loads dropped DLL 3 IoCs
pid Process 2484 049ccb277f6c9e2816347b2d51df7ba0N.exe 2484 049ccb277f6c9e2816347b2d51df7ba0N.exe 2484 049ccb277f6c9e2816347b2d51df7ba0N.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe" 049ccb277f6c9e2816347b2d51df7ba0N.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1856 set thread context of 2484 1856 049ccb277f6c9e2816347b2d51df7ba0N.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Synaptics.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ._cache_049ccb277f6c9e2816347b2d51df7ba0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 049ccb277f6c9e2816347b2d51df7ba0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 049ccb277f6c9e2816347b2d51df7ba0N.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 1856 049ccb277f6c9e2816347b2d51df7ba0N.exe 1856 049ccb277f6c9e2816347b2d51df7ba0N.exe 1856 049ccb277f6c9e2816347b2d51df7ba0N.exe 1856 049ccb277f6c9e2816347b2d51df7ba0N.exe 1856 049ccb277f6c9e2816347b2d51df7ba0N.exe 1856 049ccb277f6c9e2816347b2d51df7ba0N.exe 1856 049ccb277f6c9e2816347b2d51df7ba0N.exe 2892 powershell.exe 2640 Synaptics.exe 2640 Synaptics.exe 2640 Synaptics.exe 2640 Synaptics.exe 2640 Synaptics.exe 2640 Synaptics.exe 2640 Synaptics.exe 2640 Synaptics.exe 2640 Synaptics.exe 2640 Synaptics.exe 2640 Synaptics.exe 2640 Synaptics.exe 2640 Synaptics.exe 2640 Synaptics.exe 2640 Synaptics.exe 2640 Synaptics.exe 1936 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1856 049ccb277f6c9e2816347b2d51df7ba0N.exe Token: SeDebugPrivilege 2892 powershell.exe Token: SeDebugPrivilege 2640 Synaptics.exe Token: SeDebugPrivilege 1936 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2708 ._cache_049ccb277f6c9e2816347b2d51df7ba0N.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 1856 wrote to memory of 2892 1856 049ccb277f6c9e2816347b2d51df7ba0N.exe 31 PID 1856 wrote to memory of 2892 1856 049ccb277f6c9e2816347b2d51df7ba0N.exe 31 PID 1856 wrote to memory of 2892 1856 049ccb277f6c9e2816347b2d51df7ba0N.exe 31 PID 1856 wrote to memory of 2892 1856 049ccb277f6c9e2816347b2d51df7ba0N.exe 31 PID 1856 wrote to memory of 2484 1856 049ccb277f6c9e2816347b2d51df7ba0N.exe 33 PID 1856 wrote to memory of 2484 1856 049ccb277f6c9e2816347b2d51df7ba0N.exe 33 PID 1856 wrote to memory of 2484 1856 049ccb277f6c9e2816347b2d51df7ba0N.exe 33 PID 1856 wrote to memory of 2484 1856 049ccb277f6c9e2816347b2d51df7ba0N.exe 33 PID 1856 wrote to memory of 2484 1856 049ccb277f6c9e2816347b2d51df7ba0N.exe 33 PID 1856 wrote to memory of 2484 1856 049ccb277f6c9e2816347b2d51df7ba0N.exe 33 PID 1856 wrote to memory of 2484 1856 049ccb277f6c9e2816347b2d51df7ba0N.exe 33 PID 1856 wrote to memory of 2484 1856 049ccb277f6c9e2816347b2d51df7ba0N.exe 33 PID 1856 wrote to memory of 2484 1856 049ccb277f6c9e2816347b2d51df7ba0N.exe 33 PID 1856 wrote to memory of 2484 1856 049ccb277f6c9e2816347b2d51df7ba0N.exe 33 PID 1856 wrote to memory of 2484 1856 049ccb277f6c9e2816347b2d51df7ba0N.exe 33 PID 1856 wrote to memory of 2484 1856 049ccb277f6c9e2816347b2d51df7ba0N.exe 33 PID 2484 wrote to memory of 2708 2484 049ccb277f6c9e2816347b2d51df7ba0N.exe 34 PID 2484 wrote to memory of 2708 2484 049ccb277f6c9e2816347b2d51df7ba0N.exe 34 PID 2484 wrote to memory of 2708 2484 049ccb277f6c9e2816347b2d51df7ba0N.exe 34 PID 2484 wrote to memory of 2708 2484 049ccb277f6c9e2816347b2d51df7ba0N.exe 34 PID 2484 wrote to memory of 2640 2484 049ccb277f6c9e2816347b2d51df7ba0N.exe 35 PID 2484 wrote to memory of 2640 2484 049ccb277f6c9e2816347b2d51df7ba0N.exe 35 PID 2484 wrote to memory of 2640 2484 049ccb277f6c9e2816347b2d51df7ba0N.exe 35 PID 2484 wrote to memory of 2640 2484 049ccb277f6c9e2816347b2d51df7ba0N.exe 35 PID 2640 wrote to memory of 1936 2640 Synaptics.exe 37 PID 2640 wrote to memory of 1936 2640 Synaptics.exe 37 PID 2640 wrote to memory of 1936 2640 Synaptics.exe 37 PID 2640 wrote to memory of 1936 2640 Synaptics.exe 37 PID 2640 wrote to memory of 696 2640 Synaptics.exe 39 PID 2640 wrote to memory of 696 2640 Synaptics.exe 39 PID 2640 wrote to memory of 696 2640 Synaptics.exe 39 PID 2640 wrote to memory of 696 2640 Synaptics.exe 39 PID 2640 wrote to memory of 2676 2640 Synaptics.exe 40 PID 2640 wrote to memory of 2676 2640 Synaptics.exe 40 PID 2640 wrote to memory of 2676 2640 Synaptics.exe 40 PID 2640 wrote to memory of 2676 2640 Synaptics.exe 40 PID 2640 wrote to memory of 2900 2640 Synaptics.exe 41 PID 2640 wrote to memory of 2900 2640 Synaptics.exe 41 PID 2640 wrote to memory of 2900 2640 Synaptics.exe 41 PID 2640 wrote to memory of 2900 2640 Synaptics.exe 41 PID 2640 wrote to memory of 2080 2640 Synaptics.exe 42 PID 2640 wrote to memory of 2080 2640 Synaptics.exe 42 PID 2640 wrote to memory of 2080 2640 Synaptics.exe 42 PID 2640 wrote to memory of 2080 2640 Synaptics.exe 42 PID 2640 wrote to memory of 2288 2640 Synaptics.exe 43 PID 2640 wrote to memory of 2288 2640 Synaptics.exe 43 PID 2640 wrote to memory of 2288 2640 Synaptics.exe 43 PID 2640 wrote to memory of 2288 2640 Synaptics.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\049ccb277f6c9e2816347b2d51df7ba0N.exe"C:\Users\Admin\AppData\Local\Temp\049ccb277f6c9e2816347b2d51df7ba0N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\049ccb277f6c9e2816347b2d51df7ba0N.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
C:\Users\Admin\AppData\Local\Temp\049ccb277f6c9e2816347b2d51df7ba0N.exe"C:\Users\Admin\AppData\Local\Temp\049ccb277f6c9e2816347b2d51df7ba0N.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\._cache_049ccb277f6c9e2816347b2d51df7ba0N.exe"C:\Users\Admin\AppData\Local\Temp\._cache_049ccb277f6c9e2816347b2d51df7ba0N.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2708
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1936
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Executes dropped EXE
PID:696
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Executes dropped EXE
PID:2676
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Executes dropped EXE
PID:2900
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Executes dropped EXE
PID:2080
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe"4⤵
- Executes dropped EXE
PID:2288
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD5049ccb277f6c9e2816347b2d51df7ba0
SHA1b78da518b845bacca6ecd4595f751a8e6c41c4d6
SHA256dbd90ffa51b2ec9e716642d651d5740f2a9e376db28b217dbc31ab89b5362409
SHA5124250cf0ca6815f97265eb7924095c84a8fe41e463bcf172802e72ba5c045f999f23411a994a21d73cab270fe22287e44b33d5314f5b120ab5fad79c53e8a4559
-
Filesize
144B
MD5cd5ee104b3875b4d5554e8a528a71d4e
SHA1bed8717d5da0cb9883434202e0e2e4927961b321
SHA256e78456b8b39b64d38a7b675cbc846a5384d77a6b360fabff3c7c0150dfa3c546
SHA5120d87d9b5d311b0d55cab2dc3c1810ab5bd0ec738c34a502d1782f2db3d98594da79b5ec862a260e86313f818621e484235d7061f851b1fef302efc55771d0fcc
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5b5486d242f51dc9817ab2a3d46803f35
SHA163dd150bcbfb7aa1165953adf712e492dc967d3a
SHA256c3d379d2235727d7aca088c914a2602ee5a6486701b0ad0b7e257e4239727d51
SHA512e75f78ac7478a0e24ba4230d9bd4e04124fc79f42899a01a0eaa05bccbec861398add613196dd41fc749ad819c9055ae384aa7ff36f1d7994afe05edf572d8a8
-
Filesize
483KB
MD587705ce8d428c8701a1efa3669cb5135
SHA13d2022f4950b549bf238bf285aa6ac0dc0c075e3
SHA256543001345cedb9f6962494aafd531be8c1427876b07f339365fd7b20c18fcdce
SHA512374bd7e76c0341ad3cba5b1f4d949b246b584f227c8c6461cc4798781fe6b8e8e6b64556d3c6bf94cac2aa4b06ccf10bc0b373a7594bbf117a50b5113f75c9d4