Malware Analysis Report

2024-12-07 03:24

Sample ID 241112-3w9lgssmfv
Target free spoofer.exe
SHA256 37d916a79c24f8146e6ee9d3cb888961035dc7b15077bca1a80f3fdbc013fd02
Tags
remcos free spoofer discovery evasion persistence rat upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

37d916a79c24f8146e6ee9d3cb888961035dc7b15077bca1a80f3fdbc013fd02

Threat Level: Known bad

The file free spoofer.exe was found to be: Known bad.

Malicious Activity Summary

remcos free spoofer discovery evasion persistence rat upx

Modifies visiblity of hidden/system files in Explorer

Remcos

Remcos family

Executes dropped EXE

Adds Run key to start application

Drops file in System32 directory

UPX packed file

Drops file in Windows directory

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-12 23:53

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-12 23:53

Reported

2024-11-12 23:54

Platform

win11-20241007-en

Max time kernel

91s

Max time network

92s

Command Line

"C:\Users\Admin\AppData\Local\Temp\free spoofer.exe"

Signatures

Modifies visiblity of hidden/system files in Explorer

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" \??\c:\windows\resources\svchost.exe N/A

Remcos

rat remcos

Remcos family

remcos

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" \??\c:\windows\resources\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" \??\c:\windows\resources\themes\explorer.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification C:\Windows\SysWOW64\explorer.exe \??\c:\windows\resources\svchost.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\resources\themes\explorer.exe C:\Windows\Resources\Themes\icsys.icn.exe N/A
File opened for modification \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe N/A
File opened for modification C:\Windows\Resources\tjud.exe \??\c:\windows\resources\themes\explorer.exe N/A
File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe C:\Users\Admin\Desktop\free spoofer.exe N/A
File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Resources\Themes\icsys.icn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\users\admin\desktop\free spoofer.exe  N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\themes\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\spoolsv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\spoolsv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\Desktop\free spoofer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Resources\Themes\icsys.icn.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\resources\themes\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\users\admin\appdata\local\temp\free spoofer.exe  N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A
N/A N/A C:\Windows\Resources\Themes\icsys.icn.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A \??\c:\windows\resources\svchost.exe N/A
N/A N/A \??\c:\windows\resources\themes\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A \??\c:\users\admin\appdata\local\temp\free spoofer.exe  N/A
N/A N/A \??\c:\users\admin\desktop\free spoofer.exe  N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A \??\c:\users\admin\appdata\local\temp\free spoofer.exe  N/A
N/A N/A \??\c:\users\admin\desktop\free spoofer.exe  N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1136 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe \??\c:\users\admin\appdata\local\temp\free spoofer.exe 
PID 1136 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe \??\c:\users\admin\appdata\local\temp\free spoofer.exe 
PID 1136 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe \??\c:\users\admin\appdata\local\temp\free spoofer.exe 
PID 1136 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 1136 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 1136 wrote to memory of 908 N/A C:\Users\Admin\AppData\Local\Temp\free spoofer.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 908 wrote to memory of 4308 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 908 wrote to memory of 4308 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 908 wrote to memory of 4308 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 4308 wrote to memory of 4824 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 4308 wrote to memory of 4824 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 4308 wrote to memory of 4824 N/A \??\c:\windows\resources\themes\explorer.exe \??\c:\windows\resources\spoolsv.exe
PID 4824 wrote to memory of 1100 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 4824 wrote to memory of 1100 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 4824 wrote to memory of 1100 N/A \??\c:\windows\resources\spoolsv.exe \??\c:\windows\resources\svchost.exe
PID 1100 wrote to memory of 2336 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 1100 wrote to memory of 2336 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 1100 wrote to memory of 2336 N/A \??\c:\windows\resources\svchost.exe \??\c:\windows\resources\spoolsv.exe
PID 912 wrote to memory of 2276 N/A C:\Users\Admin\Desktop\free spoofer.exe \??\c:\users\admin\desktop\free spoofer.exe 
PID 912 wrote to memory of 2276 N/A C:\Users\Admin\Desktop\free spoofer.exe \??\c:\users\admin\desktop\free spoofer.exe 
PID 912 wrote to memory of 2276 N/A C:\Users\Admin\Desktop\free spoofer.exe \??\c:\users\admin\desktop\free spoofer.exe 
PID 912 wrote to memory of 1220 N/A C:\Users\Admin\Desktop\free spoofer.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 912 wrote to memory of 1220 N/A C:\Users\Admin\Desktop\free spoofer.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 912 wrote to memory of 1220 N/A C:\Users\Admin\Desktop\free spoofer.exe C:\Windows\Resources\Themes\icsys.icn.exe
PID 1220 wrote to memory of 1948 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 1220 wrote to memory of 1948 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe
PID 1220 wrote to memory of 1948 N/A C:\Windows\Resources\Themes\icsys.icn.exe \??\c:\windows\resources\themes\explorer.exe

Processes

C:\Users\Admin\AppData\Local\Temp\free spoofer.exe

"C:\Users\Admin\AppData\Local\Temp\free spoofer.exe"

\??\c:\users\admin\appdata\local\temp\free spoofer.exe 

"c:\users\admin\appdata\local\temp\free spoofer.exe "

C:\Windows\Resources\Themes\icsys.icn.exe

C:\Windows\Resources\Themes\icsys.icn.exe

\??\c:\windows\resources\themes\explorer.exe

c:\windows\resources\themes\explorer.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe SE

\??\c:\windows\resources\svchost.exe

c:\windows\resources\svchost.exe

\??\c:\windows\resources\spoolsv.exe

c:\windows\resources\spoolsv.exe PR

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Desktop\free spoofer.exe

"C:\Users\Admin\Desktop\free spoofer.exe"

\??\c:\users\admin\desktop\free spoofer.exe 

"c:\users\admin\desktop\free spoofer.exe "

C:\Windows\Resources\Themes\icsys.icn.exe

C:\Windows\Resources\Themes\icsys.icn.exe

\??\c:\windows\resources\themes\explorer.exe

c:\windows\resources\themes\explorer.exe

Network

Country Destination Domain Proto
N/A 127.0.0.1:2404 tcp
N/A 127.0.0.1:2404 tcp
N/A 127.0.0.1:2404 tcp
N/A 127.0.0.1:2404 tcp
N/A 127.0.0.1:2404 tcp
N/A 127.0.0.1:2404 tcp
N/A 127.0.0.1:2404 tcp
N/A 127.0.0.1:2404 tcp
N/A 127.0.0.1:2404 tcp
N/A 127.0.0.1:2404 tcp
N/A 127.0.0.1:2404 tcp
N/A 127.0.0.1:2404 tcp

Files

memory/1136-0-0x0000000000400000-0x000000000041F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\free spoofer.exe 

MD5 c84c4c9119a106ef8b03f518ac2fd77f
SHA1 f5ec736878b7350476f67fcbf83c1e9b1091f8ed
SHA256 1c9e341e908b43c20f24dfe5cb449502f659dabfc9c697750ade95e1535f295b
SHA512 5ec872842a7a432271ec2b053f638d5eaf54f97be4e4ea98af34a2c927d4f7dfcfe5d98ea3fdc1405383bdffee9bf47b0b22a7b20d95df06a46dc1cee6c51ccd

memory/3344-9-0x0000000000400000-0x000000000047D000-memory.dmp

C:\Windows\Resources\Themes\icsys.icn.exe

MD5 f00d658a3974a79f14e9102602bf09f9
SHA1 c4328ee2d0d6c4fd77fc40ff991209663439870a
SHA256 f67a66914baca9ed1af8661252ec4fee45c10fcdfa3482197916d51bd3dfc1bd
SHA512 71c69718620da6d37de7f42cb808724f26130a10ce2526efb508364587e7d294bbf1280763fbf7656d00e33077096fecf33b96cc859631c218b406eb0be38943

C:\Windows\Resources\Themes\explorer.exe

MD5 1ecca1479d3eb1447595d5245cf1ed05
SHA1 beb6de4c390817b59a9213e68db83ca471ab2a1b
SHA256 37761aefa554a85ae8b6629dbc4ed46a5c274c3edac2554e954e8522483d6cbb
SHA512 904b508c4866f5e2bae691dd4e7fc81b9be3ca0dcc82f4c65129aa01923356ed5d718d0019dd62e9ed76435523286987bea1361e0cf7fe6fa6962276c6668421

C:\Windows\Resources\spoolsv.exe

MD5 a4f34265ecea48cf9ee3122cbe4fab1e
SHA1 d8577cdf2a1847f7f7e710ba92cf0f763b185ba1
SHA256 945746a62e4930a9d6e81c14d3d3568f3fde41fab5763698c79fcb1fe8c0861e
SHA512 fb393853bde464bd0bee730792bea925844694fe3437c7e84d6836db041cabf27d54e24a6de4df2c10fb7ea9c5aa8d1a22aa2b98df02786236d6fddaba9f45cf

C:\Windows\Resources\svchost.exe

MD5 646b1395e561613dca878dd0739cb11c
SHA1 6718a54a13cb38e9b1dce1729cebca4831b83356
SHA256 efe67e0b61adbf8c31e6b2714c16d0be6244a052d5e361c0129a360f7e381f55
SHA512 2c031974c5d86d2d0df77763c466d401f2a90b263eced302855207e55f4627b16faa073b36cdb3025fe922e8a9e361fc04b7a300cca1d25f320ec075f461b1f0

memory/2336-44-0x0000000000400000-0x000000000041F000-memory.dmp

memory/4824-45-0x0000000000400000-0x000000000041F000-memory.dmp

memory/908-46-0x0000000000400000-0x000000000041F000-memory.dmp

memory/1136-47-0x0000000000400000-0x000000000041F000-memory.dmp

memory/3344-48-0x0000000000400000-0x000000000047D000-memory.dmp

memory/3344-49-0x0000000000400000-0x000000000047D000-memory.dmp

memory/3344-50-0x0000000000400000-0x000000000047D000-memory.dmp

memory/3344-51-0x0000000000400000-0x000000000047D000-memory.dmp

memory/4308-52-0x0000000000400000-0x000000000041F000-memory.dmp

memory/1100-53-0x0000000000400000-0x000000000041F000-memory.dmp

memory/1948-69-0x0000000000400000-0x000000000041F000-memory.dmp

memory/1948-74-0x0000000000400000-0x000000000041F000-memory.dmp

memory/912-73-0x0000000000400000-0x000000000041F000-memory.dmp

memory/1220-75-0x0000000000400000-0x000000000041F000-memory.dmp

memory/2276-76-0x0000000000400000-0x000000000047D000-memory.dmp

memory/2276-77-0x0000000000400000-0x000000000047D000-memory.dmp