Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
30-09-2024 09:01
Static task
static1
Behavioral task
behavioral1
Sample
Quote.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Quote.exe
Resource
win10v2004-20240802-en
General
-
Target
Quote.exe
-
Size
878KB
-
MD5
80cfda135a7c57063e8eb5a38660ae07
-
SHA1
212fdff074e62dae3a52a771fc86fdf39d0c0104
-
SHA256
e18f7d1e4381c956556250ca9be9e97377b602ebd0ab96b1c092682596a90fbf
-
SHA512
e3132b360e6e56f6e1e87530c88cb5594052d29fc13fc3f7b2777b81bf02c0c22fbb8cf81cbd55aae1551d4a59ffb9c4e69ba31a79499211c1de8703757ab691
-
SSDEEP
24576:zcB82Da9a3eu75lyvIgVIus7NZ4dUpoC1n1:469aOu736Ig0N/F11
Malware Config
Extracted
remcos
RemoteHost
www.projectusf.com:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
gfh
-
mouse_option
false
-
mutex
Rmc-J91LMC
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 428 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation Quote.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3116 set thread context of 232 3116 Quote.exe 93 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Quote.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Quote.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1708 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 428 powershell.exe 428 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 428 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 232 Quote.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3116 wrote to memory of 428 3116 Quote.exe 89 PID 3116 wrote to memory of 428 3116 Quote.exe 89 PID 3116 wrote to memory of 428 3116 Quote.exe 89 PID 3116 wrote to memory of 1708 3116 Quote.exe 91 PID 3116 wrote to memory of 1708 3116 Quote.exe 91 PID 3116 wrote to memory of 1708 3116 Quote.exe 91 PID 3116 wrote to memory of 232 3116 Quote.exe 93 PID 3116 wrote to memory of 232 3116 Quote.exe 93 PID 3116 wrote to memory of 232 3116 Quote.exe 93 PID 3116 wrote to memory of 232 3116 Quote.exe 93 PID 3116 wrote to memory of 232 3116 Quote.exe 93 PID 3116 wrote to memory of 232 3116 Quote.exe 93 PID 3116 wrote to memory of 232 3116 Quote.exe 93 PID 3116 wrote to memory of 232 3116 Quote.exe 93 PID 3116 wrote to memory of 232 3116 Quote.exe 93 PID 3116 wrote to memory of 232 3116 Quote.exe 93 PID 3116 wrote to memory of 232 3116 Quote.exe 93 PID 3116 wrote to memory of 232 3116 Quote.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quote.exe"C:\Users\Admin\AppData\Local\Temp\Quote.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uEOzlLKIrzO.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:428
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uEOzlLKIrzO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA122.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1708
-
-
C:\Users\Admin\AppData\Local\Temp\Quote.exe"C:\Users\Admin\AppData\Local\Temp\Quote.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:232
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD54d7bcdd59e9d89f31179612cbf3e3b13
SHA17b5e5a4fadb8ef7c8e7e4259a33d43c37288258c
SHA256f486d1e58a9eb0762ca0ebce553bf33e01270ceb3af1beae0f5ed65b3ab03bcc
SHA5127422e5eb322da25227520b9699da3afc16874c2f9e9818a3b925486725664fb3c472da81770e7af7fb18d51eb8e68b9981d5bc62af8886d1c23e43505cf72149
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD563adcac1231a3a69cc2f788438e16e1b
SHA1051123f98e69b323b86e76bd5b29da9b3724981e
SHA256220a1a7e3ac7853a6d27727e5f5f06a7770305c8c3e0ac6f8bdf66772cd39207
SHA512e556712b01653a1b4a36ea81b02faca0c16967518e07e6b72d560836bd9ec0abe1f2394bf80d92eab827a5a42993486e16b6f1c7c1d3b9e9853ce4ff7f3eaf79