Analysis
-
max time kernel
179s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 14:46
Static task
static1
Behavioral task
behavioral1
Sample
REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe
Resource
win10v2004-20241007-en
General
-
Target
REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe
-
Size
4.2MB
-
MD5
92d332649b2988f19343cc654634813a
-
SHA1
35633a70e00bb9ddad433276c0d4c85ecd6e3974
-
SHA256
1cb11f58b364c6049d87ce1064472d9e0f6c47455e0b42454cfc9d48c24493dd
-
SHA512
9e59623193253b212af34fa84b69f237d8de84221706ebcab0a6af195c2ec2b7bc4ee4a2f287fdb67e1d51bbbe7ce813cdb1f36d93216ca875b1b5c2081c4e51
-
SSDEEP
49152:LR28UtN5sFpdJE2dNzk6YUiKYCuOpHoG4HLL0ibq59dXuzLvo4wA83W7JSfaTIF6:3o0A2fDl2hOpHoxrYibq9I
Malware Config
Extracted
remcos
DNS
LUNAPETRO.chickenkiller.com:1991
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-QPU8J1
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HandyBackupEditorDesigner = "C:\\Users\\Admin\\Music\\HandyBackupDesignUpdater\\HandyBackupVideo.exe" REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 836 REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4384 wrote to memory of 836 4384 REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe 96 PID 4384 wrote to memory of 836 4384 REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe 96 PID 4384 wrote to memory of 836 4384 REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe 96 PID 4384 wrote to memory of 836 4384 REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe 96 PID 4384 wrote to memory of 836 4384 REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe"C:\Users\Admin\AppData\Local\Temp\REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe"C:\Users\Admin\AppData\Local\Temp\REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:836
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD517318de5ccd4fbca70d421cc3d4e5585
SHA14d89dd2ce8d05930f649dc69f5ef1153e45a4375
SHA256ce3ef7353cc1c9541e026ab8b13f589199b5f0cb9b1841e30ba0460782574cc5
SHA5120ffd6c758501f90c4c17646833c484cfc4634138a5602b45a8c469eeb2870df8c972feca2d1c9c0698be3245f3cfacba2d2ce3c958321cecca8dbd23200d0d44