9578acb21ffdcc062586c11a87aab114a07dd0dbc66b440cb69bbeafb5634cc9

Resubmissions

25-09-2024 15:53

240925-tbmfsateqq 10

24-09-2024 22:03

240924-1ynqpa1dle 10

Analysis

max time kernel
178s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-09-2024 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ea14a4bfc5e802e358f14b4b7d2ce8e.exe
Size

11.1MB
MD5

6ea14a4bfc5e802e358f14b4b7d2ce8e
SHA1

9bb2d7c7fda701f1481a843bb198c016e2486c4a
SHA256

9578acb21ffdcc062586c11a87aab114a07dd0dbc66b440cb69bbeafb5634cc9
SHA512

9a774bcbef9ed3bc050f5c3a1055a14dcc239ead07f40c7d8a21f632cd10439dad8d82f1b7ba0122ad11c6cca4f39ab7aaea329f3abae762438e2174c3f11e5a
SSDEEP

196608:uOK19iyfvQgN9prpo/mOIGqBGyC4gDEz+twaXbTPlrLwXJYRliwZ7M91vNgkfJdP:uZbfvBgmMqCyTOVZLBgrU

Score

10^/10

discovery persistence

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2296 created 3428	2296	6ea14a4bfc5e802e358f14b4b7d2ce8e.exe	56

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Npgpqfj = "C:\\Users\\Admin\\AppData\\Roaming\\Npgpqfj.exe"	6ea14a4bfc5e802e358f14b4b7d2ce8e.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	bitbucket.org
4	bitbucket.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2296 set thread context of 4644	2296	6ea14a4bfc5e802e358f14b4b7d2ce8e.exe	89

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6ea14a4bfc5e802e358f14b4b7d2ce8e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2296	6ea14a4bfc5e802e358f14b4b7d2ce8e.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2296	6ea14a4bfc5e802e358f14b4b7d2ce8e.exe
Token: SeDebugPrivilege	2296	6ea14a4bfc5e802e358f14b4b7d2ce8e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4644	AppLaunch.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 4644	2296	6ea14a4bfc5e802e358f14b4b7d2ce8e.exe	89
PID 2296 wrote to memory of 4644	2296	6ea14a4bfc5e802e358f14b4b7d2ce8e.exe	89
PID 2296 wrote to memory of 4644	2296	6ea14a4bfc5e802e358f14b4b7d2ce8e.exe	89
PID 2296 wrote to memory of 4644	2296	6ea14a4bfc5e802e358f14b4b7d2ce8e.exe	89
PID 2296 wrote to memory of 4644	2296	6ea14a4bfc5e802e358f14b4b7d2ce8e.exe	89
PID 2296 wrote to memory of 4644	2296	6ea14a4bfc5e802e358f14b4b7d2ce8e.exe	89
PID 2296 wrote to memory of 4644	2296	6ea14a4bfc5e802e358f14b4b7d2ce8e.exe	89
PID 2296 wrote to memory of 4644	2296	6ea14a4bfc5e802e358f14b4b7d2ce8e.exe	89
PID 2296 wrote to memory of 4644	2296	6ea14a4bfc5e802e358f14b4b7d2ce8e.exe	89
PID 2296 wrote to memory of 4644	2296	6ea14a4bfc5e802e358f14b4b7d2ce8e.exe	89
PID 2296 wrote to memory of 4644	2296	6ea14a4bfc5e802e358f14b4b7d2ce8e.exe	89
PID 2296 wrote to memory of 4644	2296	6ea14a4bfc5e802e358f14b4b7d2ce8e.exe	89

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3428
- C:\Users\Admin\AppData\Local\Temp\6ea14a4bfc5e802e358f14b4b7d2ce8e.exe
  "C:\Users\Admin\AppData\Local\Temp\6ea14a4bfc5e802e358f14b4b7d2ce8e.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2296
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
bd3e27dae8da6e97ef5eb556a2fbab47

SHA1
281294abc29af24ecf7c32aa875559adc6820fa2

SHA256
6db7b25c87bdc472a8199ed24db63e8c7b08abb4105c003f53f42a7fcfdbf43d

SHA512
6486c09c5e467f33982ac5f1494a8a5b6a193b0024b175b1fc3711da61978f57c43c4b1f4f2fa1d45234175f7275899eb806c908b500834abda20405caa55c87

Download Submit
memory/2296-23-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-1085-0x0000000075370000-0x0000000075B20000-memory.dmp

Filesize
7.7MB

Download
memory/2296-3-0x0000000006C90000-0x0000000006DAE000-memory.dmp

Filesize
1.1MB

Download
memory/2296-9-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-21-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-61-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-67-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-65-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-63-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-59-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-57-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-55-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-51-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-49-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-27-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-43-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-41-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-39-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-38-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-35-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-31-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-29-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-47-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-2-0x0000000075370000-0x0000000075B20000-memory.dmp

Filesize
7.7MB

Download
memory/2296-33-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-17-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-15-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-13-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-11-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-7-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-53-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-45-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-19-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-5-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-25-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-4-0x0000000006C90000-0x0000000006DA7000-memory.dmp

Filesize
1.1MB

Download
memory/2296-1078-0x0000000075370000-0x0000000075B20000-memory.dmp

Filesize
7.7MB

Download
memory/2296-1079-0x0000000007060000-0x00000000070F8000-memory.dmp

Filesize
608KB

Download
memory/2296-1080-0x0000000006FD0000-0x000000000701C000-memory.dmp

Filesize
304KB

Download
memory/2296-1083-0x0000000075370000-0x0000000075B20000-memory.dmp

Filesize
7.7MB

Download
memory/2296-1086-0x000000007537E000-0x000000007537F000-memory.dmp

Filesize
4KB

Download
memory/2296-1087-0x0000000075370000-0x0000000075B20000-memory.dmp

Filesize
7.7MB

Download
memory/2296-0-0x000000007537E000-0x000000007537F000-memory.dmp

Filesize
4KB

Download
memory/2296-1088-0x0000000075370000-0x0000000075B20000-memory.dmp

Filesize
7.7MB

Download
memory/2296-1089-0x0000000007880000-0x0000000007E24000-memory.dmp

Filesize
5.6MB

Download
memory/2296-1090-0x0000000007170000-0x00000000071C4000-memory.dmp

Filesize
336KB

Download
memory/2296-1108-0x0000000075370000-0x0000000075B20000-memory.dmp

Filesize
7.7MB

Download
memory/2296-1-0x0000000000B30000-0x000000000164A000-memory.dmp

Filesize
11.1MB

Download