5bbb41c785c4bdeb490eeb0e41a158c68f80e28d0625c8e85224e6a804e745a4

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2024, 22:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5bbb41c785c4bdeb490eeb0e41a158c68f80e28d0625c8e85224e6a804e745a4.exe
Size

483KB
MD5

d7c7beadff51b3318f1ce022b63c60d2
SHA1

4f4d885f2ea43ee2149ba49dc9466b39da91d6fb
SHA256

5bbb41c785c4bdeb490eeb0e41a158c68f80e28d0625c8e85224e6a804e745a4
SHA512

6d022de69282c80df4ab7dc599819f88ed33285157c7371a9cca01e86d3b9db787e97deecf3d1ac26a44d0804e1197db58a55dbe62f91702752c1e35449e5cba
SSDEEP

6144:QTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZXAXkcrzT4:QTlrYw1RUh3NFn+N5WfIQIjbs/ZXsT4

Score

10^/10

discovery evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5bbb41c785c4bdeb490eeb0e41a158c68f80e28d0625c8e85224e6a804e745a4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1932	reg.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4156	5bbb41c785c4bdeb490eeb0e41a158c68f80e28d0625c8e85224e6a804e745a4.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 3516	4156	5bbb41c785c4bdeb490eeb0e41a158c68f80e28d0625c8e85224e6a804e745a4.exe	86
PID 4156 wrote to memory of 3516	4156	5bbb41c785c4bdeb490eeb0e41a158c68f80e28d0625c8e85224e6a804e745a4.exe	86
PID 4156 wrote to memory of 3516	4156	5bbb41c785c4bdeb490eeb0e41a158c68f80e28d0625c8e85224e6a804e745a4.exe	86
PID 3516 wrote to memory of 1932	3516	cmd.exe	88
PID 3516 wrote to memory of 1932	3516	cmd.exe	88
PID 3516 wrote to memory of 1932	3516	cmd.exe	88

C:\Users\Admin\AppData\Local\Temp\5bbb41c785c4bdeb490eeb0e41a158c68f80e28d0625c8e85224e6a804e745a4.exe
"C:\Users\Admin\AppData\Local\Temp\5bbb41c785c4bdeb490eeb0e41a158c68f80e28d0625c8e85224e6a804e745a4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Windows\SysWOW64\cmd.exe
  /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
1a04a9fef9f0071f177f94399be3ba85

SHA1
00771577ebcba852d23f166bf44ba5ac897f2550

SHA256
63082a2b69ec1c3924739fcb8b216fb9c4fac6b91c5f8c78340c88bcd507c871

SHA512
6a92da6a296fb7428fb500685b6fda26ded099aa88315fc27625e1fe5ba1106e142539246712cb3267b45e271f9bc224beba906aafd0d465b2b373ebf77a672d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads