Analysis
-
max time kernel
107s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2024, 01:53
Static task
static1
Behavioral task
behavioral1
Sample
81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe
Resource
win10v2004-20241007-en
General
-
Target
81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe
-
Size
2.1MB
-
MD5
a09c63aeaef0ae03625de194dcd24580
-
SHA1
eb35af7b226368b5aa94fd0cef7108b4a4f9cf4f
-
SHA256
81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0e
-
SHA512
e9a909fae732e802fd7e1b7f9a3f54ea703234093752ad09cc77368170555807e9fb7da669be8cd8ecc5bb6682053e76e396a4141e6d7b2fddc81334a84fc004
-
SSDEEP
24576:hD39v74lfGQrFUspugRNJI2DJ53J/J/L5dJPj8/j7otSm/EVjlw3v:hp7E+QrFUBgq2pqw3v
Malware Config
Extracted
remcos
Host
213.183.58.19:4000
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
read.dat
-
keylog_flag
false
-
keylog_folder
CastC
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_sccafsoidz
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe -
Executes dropped EXE 2 IoCs
pid Process 2128 sbietrcl.exe 1308 sbietrcl.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\sbietrcl.exe" 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2128 set thread context of 1308 2128 sbietrcl.exe 94 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sbietrcl.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 468 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe 468 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe 468 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe 468 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe 468 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe 468 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe 2128 sbietrcl.exe 2128 sbietrcl.exe 2128 sbietrcl.exe 2128 sbietrcl.exe 2128 sbietrcl.exe 2128 sbietrcl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 468 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe Token: SeDebugPrivilege 2128 sbietrcl.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 468 wrote to memory of 2128 468 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe 93 PID 468 wrote to memory of 2128 468 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe 93 PID 468 wrote to memory of 2128 468 81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe 93 PID 2128 wrote to memory of 1308 2128 sbietrcl.exe 94 PID 2128 wrote to memory of 1308 2128 sbietrcl.exe 94 PID 2128 wrote to memory of 1308 2128 sbietrcl.exe 94 PID 2128 wrote to memory of 1308 2128 sbietrcl.exe 94 PID 2128 wrote to memory of 1308 2128 sbietrcl.exe 94 PID 2128 wrote to memory of 1308 2128 sbietrcl.exe 94 PID 2128 wrote to memory of 1308 2128 sbietrcl.exe 94 PID 2128 wrote to memory of 1308 2128 sbietrcl.exe 94 PID 2128 wrote to memory of 1308 2128 sbietrcl.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe"C:\Users\Admin\AppData\Local\Temp\81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"3⤵
- Executes dropped EXE
PID:1308
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5d179fc499f2a69c56bef590bc7d4cbfd
SHA1c8547d79da66e25ca291e71b8331764931f34083
SHA25693fd6290a6b69d69a9074f596cf2ae553e741e4be51adcec7733f4ca46249c2d
SHA512551ddf99f0e28a9f703a792bf83fa3a6b2c5c8840a75b5e4d85dec0bc8698569c1af5e84eb8d68131feb1bf0f801fb645f59222dbec14f1ae4b2fb03b8546d9d