Analysis
-
max time kernel
218s -
max time network
219s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
06-10-2024 03:19
General
-
Target
Latest Remcos + Crypter.zip
-
Size
31.9MB
-
MD5
0bda1e6247a58f3eca5eed3d111ffa88
-
SHA1
03102f5ebf71d2db33f5a869142ebce9b8f6ecf8
-
SHA256
13bef39270529e1df4aa7e4e9847921b142c24e2cba831e59ff3b7129dcf9755
-
SHA512
b475188892d952324416e33604eb0f57457075e74aeeb4975fa4275ca2a72a846cca604529fe053a02b0b04156c0cd3c862caaf4da35fd754ea5b09108951ece
-
SSDEEP
786432:0kr3y08vKrqKC+jvQWCvbTzR2xEVANyEWQD93MV:0wClGC+MWAbTcSA8EWQR3W
Malware Config
Extracted
njrat
0.7d
HacKed
dllsys.duckdns.org:3202
3b570ffeeb3d34249b9a5ce0ee58a328
-
reg_key
3b570ffeeb3d34249b9a5ce0ee58a328
-
splitter
svchost
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Executes dropped EXE 6 IoCs
-
Loads dropped DLL 3 IoCs
-
VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 36 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Suspicious use of WriteProcessMemory 45 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Latest Remcos + Crypter.zip"2⤵
-
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Latest Remcos + Crypter.zip"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\Desktop\Latest Remcos + Crypter\Remcos 2022 Edition\Remcos 2022.exe"C:\Users\Admin\Desktop\Latest Remcos + Crypter\Remcos 2022 Edition\Remcos 2022.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222.exe"C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222.exe"3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/Desktop/Latest Remcos + Crypter/Remcos 2022 Edition/Remcos 2022.exe" "%temp%\Profile Remcos\Update_Lock_Remcos.exe" /Y3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\Profile Remcos\Update_Lock_Remcos.exe.lnk" /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Profile Remcos\Update_Lock_Remcos.exe.lnk" /f4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\Profile Remcos\Update_Lock_Remcos.exe:Zone.Identifier3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\taskhost.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\taskhost.exe" "taskhost.exe" ENABLE4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\Desktop\Latest Remcos + Crypter\Remcos 2021 Edition\Remcos Loader.exe"C:\Users\Admin\Desktop\Latest Remcos + Crypter\Remcos 2021 Edition\Remcos Loader.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\Latest Remcos + Crypter\Remcos 2021 Edition\remcos.exe"C:\Users\Admin\Desktop\Latest Remcos + Crypter\Remcos 2021 Edition\remcos.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
-
-
C:\Users\Admin\Desktop\Latest Remcos + Crypter\Crypter For Remcos\Acordx.exe"C:\Users\Admin\Desktop\Latest Remcos + Crypter\Crypter For Remcos\Acordx.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rotjreyv\rotjreyv.cmdline"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rips0cdv\rips0cdv.cmdline"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xetcrbm5\xetcrbm5.cmdline"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17.4MB
MD5c3c21fa4c2186deb641455482ab0d3aa
SHA12f4b49e8383e073ccb965943ce970de403412567
SHA2564ea203509d0fdff3e31f976413c546ca3d36133bc708e9a1301860961cc3a8d9
SHA51231db2963f1bd49f7b4a6ee38e54940d20120d6c05ef7bf34ec97eb93051bee6d5428e9e1271e4ae8f5544b824188ac7278315e2e2c27be302a312eebbf8c3fb7
-
Filesize
256KB
MD5d10a3cfcc08aae3a7234498f213cf89e
SHA1ccae4469a3a05fcb6e7af33019ca5357e5406dda
SHA2560da56bd07a486818b7735761001cc1d3ca5af645f369a3c206bcb6719fefff06
SHA51290a4a68b45113360d732ccac7698c74aa550c05d9883d287b808982800fce1a24abf69cf06b0f017babd647cafd3ca10aa894c59e6dab8ba1ff34c639bdf6427
-
Filesize
1.2MB
MD57a9202505d38a8230c163d700327cd6a
SHA14e91c173f2d30519c9de67022cc1f066b4c343a9
SHA256a8eabc62975c12e675af49535fa43e574048b05fded046c327ad2e7642b8f9b5
SHA5126d1da1101d157b4f453741a191af293c86c738c2c9aa9e4ac3f30e9983d24a668db3df1d65c16315093e7c88ab67da425db0de3957b08f88c39aed67886d80dc
-
Filesize
1.1MB
MD58673eae95d67e5eb19f0eca3111408e8
SHA1ad3e1ce93782537ffd3cd9e0bb9d30ae22d40ddb
SHA256576d2de2c9ef5bc1ea9bdd73ae8f408004260037c3b72227eed27e995166276d
SHA51265c4eadf448a643f45fa9a0d91497bb25af404c41a3a32686d9e99ba4f4e50783d73f5b13d5df505cc62c465be300746d84a2eaa8000531893cd0b19d6436239
-
Filesize
1.3MB
MD5da1e93a422532cd049b5196506e1e781
SHA177cb395da3ea4aa00e47b2ee7a5c909c13e2830e
SHA2560bb714a4138668fe4b729cfec8b412e64eeff3565e84395c04eeba513350a10a
SHA512b660e2cf34271b203f4c3871887c1c913770a15596c17de121752930ff49727f36b3012d7fe1655099117d5f20e5bb0c82d7bae8f705c8fd8fea79d38930a4aa
-
Filesize
1.2MB
MD5a329f92ad3b9311af3130dbde81155ce
SHA136f3ae74eb18049e37868f1e42b7e66a294d9494
SHA256d695a2ee6fcae64f4d8c4387a0a4c4aae05d08ce44a52598984673b890d02f27
SHA512a82f51c112c610e90252d41d108f178e1f8fb6ee98f391e354d871966e9a61637b063fdb1e5934f1af70f055effebc4325151aa256137c63a40b70affd850438
-
Filesize
1.8MB
MD575792b5b38edd028d13eef62c0d828e6
SHA19a84ec696d0bd14d1ceb16fd68d48bab9a42351e
SHA256b7f82678830c34db745a16d5551386f15ff28fda563f10c6903f6471a58e243e
SHA5122665982e2e7ccf1d86d523aafa66aa9c48e4c17377f59bcd77472bc9cde2bcb9b85fccd54eff79aeae33ef9683bc05d0fb2d9e2f01759bd3e51c8875ebef4c21
-
Filesize
32B
MD5902927c48d191e30067d84a53158e2ba
SHA195dd6d3508790b98d1a576f0b2057bdcc2099247
SHA256b408602c7d2107d819b18d47cbc196a307ab6435bbc819173f300e76573e616c
SHA512328af5e697278b2c8150534162c330b11e9cc3024ee676cf9321a248701d99322cc1341694904d0ca5c6898e74e39419cd36765499d6992934075b08276c8eeb
-
Filesize
641B
MD5c801886614e4e29c7bd67e8cbaece748
SHA144736122b5a44f0618a6d7db742dd1b493e9a4f4
SHA256f5d7be50ad347e304379192adf41c88b6b96321d0a65c76efb1cd09e076195d2
SHA512b6713656340d55a3c821f8b11d4395cf18d3d6d1a6189c22068b0ffd137d3d7437f96655218269619b424f466f4a4f38c715d892356f673bb68031bb996cbf33
-
Filesize
9.9MB
MD5ed1e424ea6f625968a334377e8ac629f
SHA1ad00cc58a59a3d5b78d6603a1d09378e5dbd1647
SHA2561e5375b400f68c422804703390489b2cf3968c2a8bccb0b5b3c55fe1d2e3c991
SHA5125119b6ac8c1becda5b59a4802fc96828d338ba2d2767e5521bc226bf04b6637c1925b0cc1b0cf560540b1399730f695c55de23665e59d0683eb07d32939b8094
-
Filesize
17.7MB
MD5efc159c7cf75545997f8c6af52d3e802
SHA1b85bd368c91a13db1c5de2326deb25ad666c24c1
SHA256898ac001d0f6c52c1001c640d9860287fdf30a648d580e9f5dd15e2ef84ab18e
SHA512d06a432233dceb731defd53238971699fef201d0f9144ee50e5dd7d6620dfdd6c298d52618bf2c9feb0519574f4565fb0177b00fd8292768fbd8b85dd11e650d
-
Filesize
881B
MD5a3468935e33e361cf94f4721ed4cb66d
SHA1c3b19ca8382534b2179940cabede8c6c952a9c06
SHA256b374af58c24b6085f64f979dab434643da39d0267a27975f396473327dc98c7d
SHA512c1caa0b9637a46187d54b2952db204182fad5a5324574949ce4db13bdb17624ccd8b3228eb9b2bcfe5851add2c5d2f586945e7264b1d1cd02d91acf1fd81583a
-
Filesize
471B
MD5fc0123957188c6972c62b61c80eda2f6
SHA196d1c9b15d958c38570ce3e340b6c9b69ef66dfb
SHA2562617e733239a36a217fde169018c0cf95c6716d05ef275dff5d4c16020aa3911
SHA51266493ed3ecf52a6a540ecf4728a9142b5065f0dd577ef143645e7c361f6057d6557d69a39fc5f1251cd9b7fd33f9271f9c0a8e137efd0422b86ddd5502f90450
-
Filesize
970B
MD547bd5edc806dc3a829350339432b864d
SHA1f8077c241387230b90b88d49433a14eccbc0d972
SHA256a69e0e1f5a2b3111c1441a634ecb938f463a1b4d619fdccd72867bbf75bcac8f
SHA5124858407777df696b69f51c7bc52be8bbee3f56f14a0cc24483b4eccf09162db4de17949f4ca7ca65a9083d953bb8189ab78e2ba16e9e9f4537172e74347860d5
-
Filesize
471B
MD53ef838fbce89107c5560ad62a536a638
SHA12c1df780433aed2ddb259162ac69030b4d95aa21
SHA256ce63fa5e58ae9dd39a0e72aa553d5666b5c796851bd66a073a3d3d8637884bac
SHA5125c3e966cb601c3b87388a1ac11a0f4347e676dde770ad5a92c0a3ef6311862b42b33d6032e39676cd640e8c62b562c586111e70b760af453cb22220a53f1ab8a
-
Filesize
471B
MD5f1e012579bd2df17f56f1278d42e9bee
SHA18954f29ed81cabaaa0c58bbf5fa3e8816759f9d9
SHA25668db0a534ed43bc3f94b9c30379d39da39acdbc5ac2f441f79638bc0f8c5cbb9
SHA512c037ff274e613c35ddb5cda9b647e268fee07fd683507f3e7d4998742f3e86672893562c99fd9da31731b97afee1065588ac135b49e6bcdeb34d488b5d9c5c2f
-
Filesize
4KB
-
Filesize
37.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
40KB
-
Filesize
22.7MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
2.3MB
-
Filesize
1.7MB
-
Filesize
496KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
17.5MB
-
Filesize
624KB
-
Filesize
17.7MB
-
Filesize
5.6MB
-
Filesize
56KB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
92KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.6MB
-
Filesize
4KB
-
Filesize
24KB
-
Filesize
1.1MB
-
Filesize
408KB
-
Filesize
744KB
-
Filesize
408KB
-
Filesize
24KB
-
Filesize
2.0MB
-
Filesize
1.3MB