Analysis
-
max time kernel
132s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2024 16:33
Behavioral task
behavioral1
Sample
Backdoor.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Backdoor.exe
Resource
win10v2004-20240802-en
General
-
Target
Backdoor.exe
-
Size
92KB
-
MD5
4af287a83510d3a36ee2e591801aae74
-
SHA1
bdc1a2e9594f7650bcc47711e71f41f1cf0d6bf6
-
SHA256
40d8e8b88f224bc5b0686b0154ccec7173ea1251244aff66ecdf1788dc4879cd
-
SHA512
f7c47f734e231206dae6e2b55b8cbaaa7ba01b7c09c15a7f080e7f9a65b8a9c0b7bdaa3c4d66ed34b101af03b98e8d6ede6d022450907024bd6de88eaef25a3d
-
SSDEEP
1536:AhhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6NrT:GhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+a
Malware Config
Extracted
remcos
1.7 Pro
Host
74.215.232.65:6060
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_axwfyanmhaeeahv
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation Backdoor.exe -
Executes dropped EXE 1 IoCs
pid Process 4724 remcos.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Backdoor.exe Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" remcos.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4724 set thread context of 1788 4724 remcos.exe 86 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Backdoor.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4072 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4072 PING.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4820 wrote to memory of 5036 4820 Backdoor.exe 82 PID 4820 wrote to memory of 5036 4820 Backdoor.exe 82 PID 4820 wrote to memory of 5036 4820 Backdoor.exe 82 PID 5036 wrote to memory of 4072 5036 cmd.exe 84 PID 5036 wrote to memory of 4072 5036 cmd.exe 84 PID 5036 wrote to memory of 4072 5036 cmd.exe 84 PID 5036 wrote to memory of 4724 5036 cmd.exe 85 PID 5036 wrote to memory of 4724 5036 cmd.exe 85 PID 5036 wrote to memory of 4724 5036 cmd.exe 85 PID 4724 wrote to memory of 1788 4724 remcos.exe 86 PID 4724 wrote to memory of 1788 4724 remcos.exe 86 PID 4724 wrote to memory of 1788 4724 remcos.exe 86 PID 4724 wrote to memory of 1788 4724 remcos.exe 86 PID 4724 wrote to memory of 1788 4724 remcos.exe 86 PID 4724 wrote to memory of 1788 4724 remcos.exe 86 PID 4724 wrote to memory of 1788 4724 remcos.exe 86 PID 4724 wrote to memory of 1788 4724 remcos.exe 86 PID 4724 wrote to memory of 1788 4724 remcos.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\Backdoor.exe"C:\Users\Admin\AppData\Local\Temp\Backdoor.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\PING.EXEPING 127.0.0.1 -n 23⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4072
-
-
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
- System Location Discovery: System Language Discovery
PID:1788
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99B
MD576c1687d97dfdbcea62ef1490bec5001
SHA15f4d1aeafa7d840cde67b76f97416dd68efd1bed
SHA25679f04ea049979ffd2232c459fdd57fae97a5255aea9b4a2c7dce7ead856f37a4
SHA512da250f0628632a644f159d818a82a8b9cca8224e46843bddbe0f6f9c32a2d04f7736a620af49ab6d77616317ca7d68285e60043965fe86c03d940835bd30a925
-
Filesize
92KB
MD54af287a83510d3a36ee2e591801aae74
SHA1bdc1a2e9594f7650bcc47711e71f41f1cf0d6bf6
SHA25640d8e8b88f224bc5b0686b0154ccec7173ea1251244aff66ecdf1788dc4879cd
SHA512f7c47f734e231206dae6e2b55b8cbaaa7ba01b7c09c15a7f080e7f9a65b8a9c0b7bdaa3c4d66ed34b101af03b98e8d6ede6d022450907024bd6de88eaef25a3d