Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/10/2024, 01:53
Static task
static1
Behavioral task
behavioral1
Sample
81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe
Resource
win10v2004-20241007-en
General
-
Target
81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe
-
Size
2.1MB
-
MD5
a09c63aeaef0ae03625de194dcd24580
-
SHA1
eb35af7b226368b5aa94fd0cef7108b4a4f9cf4f
-
SHA256
81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0e
-
SHA512
e9a909fae732e802fd7e1b7f9a3f54ea703234093752ad09cc77368170555807e9fb7da669be8cd8ecc5bb6682053e76e396a4141e6d7b2fddc81334a84fc004
-
SSDEEP
24576:hD39v74lfGQrFUspugRNJI2DJ53J/J/L5dJPj8/j7otSm/EVjlw3v:hp7E+QrFUBgq2pqw3v
Malware Config
Extracted
remcos
Host
213.183.58.19:4000
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
read.dat
-
keylog_flag
false
-
keylog_folder
CastC
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_sccafsoidz
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Executes dropped EXE 2 IoCs
pid Process 2724 sbietrcl.exe 1528 sbietrcl.exe -
Loads dropped DLL 1 IoCs
pid Process 2660 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\sbietrcl.exe" 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2724 set thread context of 1528 2724 sbietrcl.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sbietrcl.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2660 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe 2660 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe 2660 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe 2660 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe 2660 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe 2660 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe 2724 sbietrcl.exe 2724 sbietrcl.exe 2724 sbietrcl.exe 2724 sbietrcl.exe 2724 sbietrcl.exe 2724 sbietrcl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2660 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe Token: SeDebugPrivilege 2724 sbietrcl.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2660 wrote to memory of 2724 2660 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe 30 PID 2660 wrote to memory of 2724 2660 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe 30 PID 2660 wrote to memory of 2724 2660 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe 30 PID 2660 wrote to memory of 2724 2660 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe 30 PID 2724 wrote to memory of 1528 2724 sbietrcl.exe 31 PID 2724 wrote to memory of 1528 2724 sbietrcl.exe 31 PID 2724 wrote to memory of 1528 2724 sbietrcl.exe 31 PID 2724 wrote to memory of 1528 2724 sbietrcl.exe 31 PID 2724 wrote to memory of 1528 2724 sbietrcl.exe 31 PID 2724 wrote to memory of 1528 2724 sbietrcl.exe 31 PID 2724 wrote to memory of 1528 2724 sbietrcl.exe 31 PID 2724 wrote to memory of 1528 2724 sbietrcl.exe 31 PID 2724 wrote to memory of 1528 2724 sbietrcl.exe 31 PID 2724 wrote to memory of 1528 2724 sbietrcl.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe"C:\Users\Admin\AppData\Local\Temp\81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"3⤵
- Executes dropped EXE
PID:1528
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c01e2beaf749cb3adf82fdc48f03a6ea
SHA155e7eccaeb91c3fd6fe11dada7b908fab873e908
SHA256fd23f5aa5d36e9b4f682f5e235adf3216994f449b6f813060319757f819586c4
SHA51218c587f0da748089ebdfe0dbadf28b5e01e1d9e49f7cec698bfba00a07bb5710bc8a5ef85c09e251bb9829e6d52cc468f9c8c456b95076ae090e5880671b30d5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
2.1MB
MD5b34dbb6ed63233fe7ea5c0146a2b5c23
SHA131b625ea0c4c97145607dd8122645e8321071857
SHA256febbd77a8822294f32112f2ae1fa0043453922de0317a531489bccc9047f3c10
SHA512158da7d247fc9d181578f2df385b8f8e9d6ae63fdc9e648f89ebea898892e8739f6264d36f5e210ed24963d4e37fcce0fa70fed51a7e4bcb790952a64325fa69