Analysis
-
max time kernel
177s -
max time network
174s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02-10-2024 14:26
Static task
static1
Behavioral task
behavioral1
Sample
9e5634a01e241113ddc1a5a03265cd3e.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9e5634a01e241113ddc1a5a03265cd3e.exe
Resource
win10v2004-20240802-en
General
-
Target
9e5634a01e241113ddc1a5a03265cd3e.exe
-
Size
2.4MB
-
MD5
9e5634a01e241113ddc1a5a03265cd3e
-
SHA1
17f3cba192f573754797b1fb6f644889f9abaaca
-
SHA256
a8c0001bf62a178870fe526395703f682143078ad37d9b20e50f230dd9059648
-
SHA512
3cea7ff14f48832b7ca955a5fa2c61115b1f2a5ec9f8df52e32692b07d9d34453fef29ef1d7c62ec666e0f38a4899a89db4a68f615602d267c0103d42fe52156
-
SSDEEP
49152:7lnKF46FKC9PgROSeQ146cDPM2vCVapdoqwicf1/y36sbwAE1JgZIESTcNYPMI3Y:7ld16SwwgZRbaEIo
Malware Config
Extracted
remcos
XIOAMORT
vcvfdjvodsuhvf.con-ip.com:1661
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-ALVZO2
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\GifCamVideoEditor = "C:\\Users\\Admin\\Music\\GifCamUpdater\\GifCamOculus.exe" 9e5634a01e241113ddc1a5a03265cd3e.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9e5634a01e241113ddc1a5a03265cd3e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9e5634a01e241113ddc1a5a03265cd3e.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2504 9e5634a01e241113ddc1a5a03265cd3e.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1928 wrote to memory of 2504 1928 9e5634a01e241113ddc1a5a03265cd3e.exe 31 PID 1928 wrote to memory of 2504 1928 9e5634a01e241113ddc1a5a03265cd3e.exe 31 PID 1928 wrote to memory of 2504 1928 9e5634a01e241113ddc1a5a03265cd3e.exe 31 PID 1928 wrote to memory of 2504 1928 9e5634a01e241113ddc1a5a03265cd3e.exe 31 PID 1928 wrote to memory of 2504 1928 9e5634a01e241113ddc1a5a03265cd3e.exe 31 PID 1928 wrote to memory of 2504 1928 9e5634a01e241113ddc1a5a03265cd3e.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e5634a01e241113ddc1a5a03265cd3e.exe"C:\Users\Admin\AppData\Local\Temp\9e5634a01e241113ddc1a5a03265cd3e.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\9e5634a01e241113ddc1a5a03265cd3e.exe"C:\Users\Admin\AppData\Local\Temp\9e5634a01e241113ddc1a5a03265cd3e.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2504
-
Network
-
Remote address:8.8.8.8:53Requestvcvfdjvodsuhvf.con-ip.comIN AResponsevcvfdjvodsuhvf.con-ip.comIN A181.131.216.100
-
Remote address:8.8.8.8:53Requestgeoplugin.netIN AResponsegeoplugin.netIN A178.237.33.50
-
Remote address:178.237.33.50:80RequestGET /json.gp HTTP/1.1
Host: geoplugin.net
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
server: Apache
content-length: 955
content-type: application/json; charset=utf-8
cache-control: public, max-age=300
access-control-allow-origin: *
-
4.3kB 1.7kB 19 18
-
669 B 2.5kB 13 4
HTTP Request
GET http://geoplugin.net/json.gpHTTP Response
200
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD56569f87fcc23aa286ae822c17cf45fd8
SHA1792f9ffba6ddd0b08eaf71f04fd7cff1728d2f15
SHA25693bd9834e051de52fd77c898c25383449d099849a31a4a27fb9a4f3deb1d5a92
SHA51228329fdd47e9384794704c21313ccbee31e7bb04b41b373c17ad14dfbbe5b4893cadbb7c9cf0990b04c0dc7ce5fcfb9da28fafa6019aa6931a188fd12f02f043