Analysis

  • max time kernel
    115s
  • max time network
    116s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/10/2024, 16:47 UTC

General

  • Target

    e02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe

  • Size

    483KB

  • MD5

    4407e9b5c2822d8df76aeaebe6cc8510

  • SHA1

    688fc138a465035489078457c60b982c2814dced

  • SHA256

    e02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306

  • SHA512

    5d1b8d2c71906d73425a22b6edc5e9db7d862109f568ca23d43751ca4e0582c673c58d6f5ced0e444bc81655c66d1fbb7a30bb8a5608a8a776530e3304abf531

  • SSDEEP

    6144:rXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZ5AXIcN35Gv:rX7tPMK8ctGe4Dzl4h2QnuPs/Z5qcv

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe
    "C:\Users\Admin\AppData\Local\Temp\e02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\qhqejvxgzmng.vbs"
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:808

Network

  • flag-us
    DNS
    comandoespecial2023.duckdns.org
    e02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe
    Remote address:
    8.8.8.8:53
    Request
    comandoespecial2023.duckdns.org
    IN A
    Response
    comandoespecial2023.duckdns.org
    IN A
    173.208.241.155
  • flag-us
    DNS
    comandoespecial2023.duckdns.org
    e02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe
    Remote address:
    8.8.8.8:53
    Request
    comandoespecial2023.duckdns.org
    IN A
    Response
    comandoespecial2023.duckdns.org
    IN A
    173.208.241.155
  • flag-us
    DNS
    geoplugin.net
    e02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe
    Remote address:
    8.8.8.8:53
    Request
    geoplugin.net
    IN A
    Response
    geoplugin.net
    IN A
    178.237.33.50
  • flag-nl
    GET
    http://geoplugin.net/json.gp
    e02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe
    Remote address:
    178.237.33.50:80
    Request
    GET /json.gp HTTP/1.1
    Host: geoplugin.net
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    date: Sat, 05 Oct 2024 16:47:20 GMT
    server: Apache
    content-length: 955
    content-type: application/json; charset=utf-8
    cache-control: public, max-age=300
    access-control-allow-origin: *
  • 173.208.241.155:8888
    comandoespecial2023.duckdns.org
    tls
    e02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe
    3.4kB
    1.6kB
    13
    16
  • 178.237.33.50:80
    http://geoplugin.net/json.gp
    http
    e02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe
    347 B
    1.3kB
    6
    3

    HTTP Request

    GET http://geoplugin.net/json.gp

    HTTP Response

    200
  • 173.208.241.155:8888
    comandoespecial2023.duckdns.org
    tls
    e02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe
    1.2kB
    981 B
    8
    8
  • 173.208.241.155:8888
    comandoespecial2023.duckdns.org
    tls
    e02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe
    65.0kB
    1.9kB
    57
    29
  • 8.8.8.8:53
    comandoespecial2023.duckdns.org
    dns
    e02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe
    154 B
    186 B
    2
    2

    DNS Request

    comandoespecial2023.duckdns.org

    DNS Request

    comandoespecial2023.duckdns.org

    DNS Response

    173.208.241.155

    DNS Response

    173.208.241.155

  • 8.8.8.8:53
    geoplugin.net
    dns
    e02ed5061cdec08c9e33981f0d75819fc74caba852a830679e6e96e913ca8306N.exe
    59 B
    75 B
    1
    1

    DNS Request

    geoplugin.net

    DNS Response

    178.237.33.50

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\remcos\registros.dat

    Filesize

    144B

    MD5

    6d6dc6f817346a597baa504c54636c71

    SHA1

    bf455f3f63a65a721c7cf428ec42a55a4a17eb8f

    SHA256

    f4e336ba6c70ba98baf36011cf670bd6aa0a3d274e796206c5a68687b6296db4

    SHA512

    c007d81817040695802687bba67102a4d248a990cbf6f0b649810b18d378f76af9297764d8ed15d5cec86c7bca4899187cd441b44c32fecf0cb56d6363e9fda4

  • C:\Users\Admin\AppData\Local\Temp\qhqejvxgzmng.vbs

    Filesize

    732B

    MD5

    e37ca967a6c6fd157b186dc90f7352b1

    SHA1

    47f5341389e7b4e15bfa7540f7a9846d81fea0bd

    SHA256

    ab8df3c1c054b81de732d70791fddc8220811004bdbf022734480d03aa4d54c5

    SHA512

    87df7bf8fb14b2d74bf0d3501d83b38f66e56616e776e605e744de3ba29ae1f6610edcefcf3840cf811fbfab8cc345944168b41a62a48ae895ded34d58578551

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.