Overview
overview
10Static
static
1010.exe
windows10-2004-x64
1011.exe
windows10-2004-x64
1012.exe
windows10-2004-x64
1013.exe
windows10-2004-x64
1014.exe
windows10-2004-x64
1015.exe
windows10-2004-x64
1016.exe
windows10-2004-x64
1017.exe
windows10-2004-x64
1018.exe
windows10-2004-x64
1019.exe
windows10-2004-x64
1020.exe
windows10-2004-x64
1021.exe
windows10-2004-x64
1022.exe
windows10-2004-x64
1023.exe
windows10-2004-x64
1024.exe
windows10-2004-x64
1025.exe
windows10-2004-x64
1026.exe
windows10-2004-x64
1027.exe
windows10-2004-x64
1028.exe
windows10-2004-x64
1029.exe
windows10-2004-x64
1030.exe
windows10-2004-x64
1031.exe
windows10-2004-x64
1032.exe
windows10-2004-x64
1033.exe
windows10-2004-x64
106.exe
windows10-2004-x64
107.exe
windows10-2004-x64
108.exe
windows10-2004-x64
109.exe
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/10/2024, 08:59
Behavioral task
behavioral1
Sample
10.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
11.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
12.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
13.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
14.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral6
Sample
15.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
16.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
17.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
18.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
19.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
20.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral12
Sample
21.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
22.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
23.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
24.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
25.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
26.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
27.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
28.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral20
Sample
29.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
30.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral22
Sample
31.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
32.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral24
Sample
33.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
6.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral26
Sample
7.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
8.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral28
Sample
9.exe
Resource
win10v2004-20241007-en
General
-
Target
22.exe
-
Size
469KB
-
MD5
ea99efb202c5625280d0d4140c2cdeee
-
SHA1
5cf3bb2872c7c46725e9e236f8bead59a8786a55
-
SHA256
6823bc23bae3dcceee8b122d5ab49c71adc32f5f8cbfaddd0f6e361dd5be17f3
-
SHA512
bde3e441ff858872069d236a292313883ca3698e49b821af2a805b82e1e861ac9af5235d61db795fe47b5b97e11a687ef5fa8cdd8dc709ba63f6e595cf265537
-
SSDEEP
12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSKn9:uiLJbpI7I2WhQqZ7K9
Malware Config
Extracted
remcos
RemoteHost
core-hook.gl.at.ply.gg:7242
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
scvhost.exe
-
copy_folder
files
-
delete_file
true
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-W50V3W
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
scvhost
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\scvhost = "\"C:\\ProgramData\\files\\scvhost.exe\"" 22.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\scvhost = "\"C:\\ProgramData\\files\\scvhost.exe\"" scvhost.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 22.exe Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation WScript.exe -
Deletes itself 1 IoCs
pid Process 1436 WScript.exe -
Executes dropped EXE 1 IoCs
pid Process 3624 scvhost.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\scvhost = "\"C:\\ProgramData\\files\\scvhost.exe\"" 22.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scvhost = "\"C:\\ProgramData\\files\\scvhost.exe\"" 22.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\scvhost = "\"C:\\ProgramData\\files\\scvhost.exe\"" scvhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\scvhost = "\"C:\\ProgramData\\files\\scvhost.exe\"" scvhost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3624 set thread context of 800 3624 scvhost.exe 97 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scvhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 22.exe -
Modifies registry key 1 TTPs 2 IoCs
pid Process 4128 reg.exe 3432 reg.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3624 scvhost.exe 3624 scvhost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3624 scvhost.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 4076 wrote to memory of 4900 4076 22.exe 86 PID 4076 wrote to memory of 4900 4076 22.exe 86 PID 4076 wrote to memory of 4900 4076 22.exe 86 PID 4900 wrote to memory of 4128 4900 cmd.exe 88 PID 4900 wrote to memory of 4128 4900 cmd.exe 88 PID 4900 wrote to memory of 4128 4900 cmd.exe 88 PID 4076 wrote to memory of 1436 4076 22.exe 89 PID 4076 wrote to memory of 1436 4076 22.exe 89 PID 4076 wrote to memory of 1436 4076 22.exe 89 PID 1436 wrote to memory of 384 1436 WScript.exe 93 PID 1436 wrote to memory of 384 1436 WScript.exe 93 PID 1436 wrote to memory of 384 1436 WScript.exe 93 PID 384 wrote to memory of 3624 384 cmd.exe 95 PID 384 wrote to memory of 3624 384 cmd.exe 95 PID 384 wrote to memory of 3624 384 cmd.exe 95 PID 3624 wrote to memory of 2948 3624 scvhost.exe 96 PID 3624 wrote to memory of 2948 3624 scvhost.exe 96 PID 3624 wrote to memory of 2948 3624 scvhost.exe 96 PID 3624 wrote to memory of 800 3624 scvhost.exe 97 PID 3624 wrote to memory of 800 3624 scvhost.exe 97 PID 3624 wrote to memory of 800 3624 scvhost.exe 97 PID 3624 wrote to memory of 800 3624 scvhost.exe 97 PID 2948 wrote to memory of 3432 2948 cmd.exe 99 PID 2948 wrote to memory of 3432 2948 cmd.exe 99 PID 2948 wrote to memory of 3432 2948 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\22.exe"C:\Users\Admin\AppData\Local\Temp\22.exe"1⤵
- Adds policy Run key to start application
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4128
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"2⤵
- Checks computer location settings
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\ProgramData\files\scvhost.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:384 -
C:\ProgramData\files\scvhost.exeC:\ProgramData\files\scvhost.exe4⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f6⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3432
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"5⤵PID:800
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
469KB
MD5ea99efb202c5625280d0d4140c2cdeee
SHA15cf3bb2872c7c46725e9e236f8bead59a8786a55
SHA2566823bc23bae3dcceee8b122d5ab49c71adc32f5f8cbfaddd0f6e361dd5be17f3
SHA512bde3e441ff858872069d236a292313883ca3698e49b821af2a805b82e1e861ac9af5235d61db795fe47b5b97e11a687ef5fa8cdd8dc709ba63f6e595cf265537
-
Filesize
502B
MD57e40e446594854230c1ddecf4ffc8826
SHA162c2a9a1dbc83ec42cf4e77ab62f9e01f40a4a44
SHA2565a7340d452f337b7a86f3f4469c0249a2c2ed0de0b919bc913fe814452b6170d
SHA512afeca4ed80c8f6e16867eface7c250d1c5effadf06007a49ac35e435f16dcdfbda307f3bff88f796f571abca198546db3dea37613defe51ebe0cd5463fd7be74