Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27-09-2024 01:26
Static task
static1
Behavioral task
behavioral1
Sample
Quote.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Quote.exe
Resource
win10v2004-20240802-en
General
-
Target
Quote.exe
-
Size
915KB
-
MD5
0b18de9b2b7f17fc93796eabee8d26dd
-
SHA1
0c0f08a2df8262960e6290900bff0684847cc0c8
-
SHA256
929167f47e1116759145eb457f86474a311374373b05b11438ea1222a9e2a8f0
-
SHA512
07a146051648b7bf1a7024bf1375b27b3ee6ea07c9c455ede24d3edce26d79e2f227a9b1a9ba0eb4f5e05c75e458169e48c3a8a1acaf731781a0f105ace37860
-
SSDEEP
12288:OdK2wPfKaoFsNyjcFg/Q5P4Uf1fTX5muSPflsEXywds31GHvMb7d+fLnnjnU+DL:FPfKaKsNEesQ5PxL5mjHiwOFEvMOPn3
Malware Config
Extracted
remcos
RemoteHost
www.projectusf.com:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
gfh
-
mouse_option
false
-
mutex
Rmc-J91LMC
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 5052 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation Quote.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4304 set thread context of 2888 4304 Quote.exe 92 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Quote.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Quote.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4816 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4304 Quote.exe 4304 Quote.exe 5052 powershell.exe 5052 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4304 Quote.exe Token: SeDebugPrivilege 5052 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2888 Quote.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4304 wrote to memory of 5052 4304 Quote.exe 87 PID 4304 wrote to memory of 5052 4304 Quote.exe 87 PID 4304 wrote to memory of 5052 4304 Quote.exe 87 PID 4304 wrote to memory of 4816 4304 Quote.exe 89 PID 4304 wrote to memory of 4816 4304 Quote.exe 89 PID 4304 wrote to memory of 4816 4304 Quote.exe 89 PID 4304 wrote to memory of 2248 4304 Quote.exe 91 PID 4304 wrote to memory of 2248 4304 Quote.exe 91 PID 4304 wrote to memory of 2248 4304 Quote.exe 91 PID 4304 wrote to memory of 2888 4304 Quote.exe 92 PID 4304 wrote to memory of 2888 4304 Quote.exe 92 PID 4304 wrote to memory of 2888 4304 Quote.exe 92 PID 4304 wrote to memory of 2888 4304 Quote.exe 92 PID 4304 wrote to memory of 2888 4304 Quote.exe 92 PID 4304 wrote to memory of 2888 4304 Quote.exe 92 PID 4304 wrote to memory of 2888 4304 Quote.exe 92 PID 4304 wrote to memory of 2888 4304 Quote.exe 92 PID 4304 wrote to memory of 2888 4304 Quote.exe 92 PID 4304 wrote to memory of 2888 4304 Quote.exe 92 PID 4304 wrote to memory of 2888 4304 Quote.exe 92 PID 4304 wrote to memory of 2888 4304 Quote.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quote.exe"C:\Users\Admin\AppData\Local\Temp\Quote.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OlhQyptevOgDP.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5052
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OlhQyptevOgDP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCFF2.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4816
-
-
C:\Users\Admin\AppData\Local\Temp\Quote.exe"C:\Users\Admin\AppData\Local\Temp\Quote.exe"2⤵PID:2248
-
-
C:\Users\Admin\AppData\Local\Temp\Quote.exe"C:\Users\Admin\AppData\Local\Temp\Quote.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2888
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5f2405b30b190c52540b4e8197b0d9511
SHA1a598d717b16e49967d312c30fdfc6deffe83175a
SHA256968d197424d77eaa231ca3cf1dea04b0b75bab604393081a5c5a4e60aa581a38
SHA5123637f2399c643aaf84ab6c24833c19c4957cf68304c4424d59a00140ebfd97e475a6eeb2c3621b730081aae99c3eae70d1335214dd318eec0320e10166c22856
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD59211c52e69d6991e7c93b7620b5673f9
SHA1c67b0e9301bd6c2a40bfe59fbf29fe790ac4a36a
SHA256313a14e0934d649d441af3066e09d61fe3ac056bb102dcf8cfcbf64d1f9e0951
SHA51212964f70a5d1e2c8838d1d73157baa136bbd917aba79de6c4f4e5380b4c40ac34f60a921db75169f995df157ed406fe659c1800aa4359dfb001cf850e153a809