Analysis
-
max time kernel
180s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
13-11-2024 14:46
Static task
static1
Behavioral task
behavioral1
Sample
REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe
Resource
win10v2004-20241007-en
General
-
Target
REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe
-
Size
4.2MB
-
MD5
92d332649b2988f19343cc654634813a
-
SHA1
35633a70e00bb9ddad433276c0d4c85ecd6e3974
-
SHA256
1cb11f58b364c6049d87ce1064472d9e0f6c47455e0b42454cfc9d48c24493dd
-
SHA512
9e59623193253b212af34fa84b69f237d8de84221706ebcab0a6af195c2ec2b7bc4ee4a2f287fdb67e1d51bbbe7ce813cdb1f36d93216ca875b1b5c2081c4e51
-
SSDEEP
49152:LR28UtN5sFpdJE2dNzk6YUiKYCuOpHoG4HLL0ibq59dXuzLvo4wA83W7JSfaTIF6:3o0A2fDl2hOpHoxrYibq9I
Malware Config
Extracted
remcos
DNS
LUNAPETRO.chickenkiller.com:1991
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-QPU8J1
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\HandyBackupEditorDesigner = "C:\\Users\\Admin\\Music\\HandyBackupDesignUpdater\\HandyBackupVideo.exe" REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2816 REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1064 wrote to memory of 2816 1064 REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe 30 PID 1064 wrote to memory of 2816 1064 REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe 30 PID 1064 wrote to memory of 2816 1064 REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe 30 PID 1064 wrote to memory of 2816 1064 REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe 30 PID 1064 wrote to memory of 2816 1064 REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe 30 PID 1064 wrote to memory of 2816 1064 REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe"C:\Users\Admin\AppData\Local\Temp\REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe"C:\Users\Admin\AppData\Local\Temp\REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2816
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD540b1b29de336fe0a192630bc66251643
SHA1ce03185295528d9bce50fb492ce9f7f7e0670cce
SHA2563973a5322a39670db59724aa4975cbb678dc4cdcedb0a505b3ba0128b98303d0
SHA512f5d43bcf4021a2dab0cccf1140a439cf62aedebc1084a882688b7c498ea41ca9e0a814595e298b1441b576a2e690584b5781930f0bcf29e04678bb24d1b0556b