Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-09-2024 02:42
Static task
static1
Behavioral task
behavioral1
Sample
ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe
Resource
win10v2004-20240802-en
General
-
Target
ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe
-
Size
1.1MB
-
MD5
311148c65ef0cadb803bccc2cf922fee
-
SHA1
d70c32206a52470e3b622984e7fb6ab7668c5919
-
SHA256
ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87
-
SHA512
8a998d9e89a53b65ef1d5a996f5540d0c0ba7f964af274ef5991dac3c4fd6c3eb4b89f5bc54449b797ffede1f57bd8d4604f4df3cd46fadb6dc94391713208cc
-
SSDEEP
24576:W4rAZ6dcBjZFsPgl8bIDnOjkO4/JHuNPzb2IFA:W4MwMwbIKkOIJHIPw
Malware Config
Extracted
remcos
RemoteHost
hiddenrmcnew.duckdns.org:7839
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-PW8G0U
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2644 powershell.exe 2836 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2732 set thread context of 264 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 36 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2584 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 2836 powershell.exe 2644 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe Token: SeDebugPrivilege 2644 powershell.exe Token: SeDebugPrivilege 2836 powershell.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2836 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 30 PID 2732 wrote to memory of 2836 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 30 PID 2732 wrote to memory of 2836 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 30 PID 2732 wrote to memory of 2836 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 30 PID 2732 wrote to memory of 2644 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 32 PID 2732 wrote to memory of 2644 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 32 PID 2732 wrote to memory of 2644 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 32 PID 2732 wrote to memory of 2644 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 32 PID 2732 wrote to memory of 2584 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 33 PID 2732 wrote to memory of 2584 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 33 PID 2732 wrote to memory of 2584 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 33 PID 2732 wrote to memory of 2584 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 33 PID 2732 wrote to memory of 264 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 36 PID 2732 wrote to memory of 264 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 36 PID 2732 wrote to memory of 264 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 36 PID 2732 wrote to memory of 264 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 36 PID 2732 wrote to memory of 264 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 36 PID 2732 wrote to memory of 264 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 36 PID 2732 wrote to memory of 264 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 36 PID 2732 wrote to memory of 264 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 36 PID 2732 wrote to memory of 264 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 36 PID 2732 wrote to memory of 264 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 36 PID 2732 wrote to memory of 264 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 36 PID 2732 wrote to memory of 264 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 36 PID 2732 wrote to memory of 264 2732 ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe"C:\Users\Admin\AppData\Local\Temp\ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wUtVQHiucCbXP.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2644
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wUtVQHiucCbXP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp94D0.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2584
-
-
C:\Users\Admin\AppData\Local\Temp\ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe"C:\Users\Admin\AppData\Local\Temp\ff67f46cb0b8c93cc038c969376a92b04ab3809b0efd52f99bdfbbd9a991cc87.exe"2⤵
- System Location Discovery: System Language Discovery
PID:264
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50f10435d2b0618292ad9dd1b2ca9410f
SHA15b7df482c9c41d62848481a9ec67d23d41a5b5ca
SHA256e7e6000b0c150a954b1786a70518ba89915f25fecb2e0cba829e972c628bfc6c
SHA512d9f712793cc13138431c2ab37faf0a69ccecc24f9ff1f1c941e59133162fb6ed4f106f37bdcad0bfd454b36541f719b9af29631dde63e5eb31420dbfde496e3a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\J6XLNOCDSOVFWY3EKY2T.temp
Filesize7KB
MD5c2795c579a3ecbd456e434f174487c65
SHA1f95f87c30c56d1d03e0e1f878dd5c030cf7beec2
SHA25636be278320172bd54912339902d2b0d02bfb47f353ca15757ef97a6f3deb11c6
SHA512755edaf590687379e656601eafdcec15a36c178c8b8168c185fc77d1012f52b6533448d0b9412e8668d0a7174e7e971a0f800843349f97bd5b348f443653dbbc