Overview
overview
10Static
static
3Ryzen DRAM...cy.exe
windows7-x64
1Ryzen DRAM...cy.exe
windows10-2004-x64
1Ryzen DRAM...er.dll
windows7-x64
1Ryzen DRAM...er.dll
windows10-2004-x64
1Ryzen DRAM...cy.exe
windows7-x64
1Ryzen DRAM...cy.exe
windows10-2004-x64
1Ryzen DRAM...ed.exe
windows7-x64
1Ryzen DRAM...ed.exe
windows10-2004-x64
1Ryzen DRAM...rk.dll
windows7-x64
1Ryzen DRAM...rk.dll
windows10-2004-x64
1Ryzen DRAM...cy.exe
windows7-x64
1Ryzen DRAM...cy.exe
windows10-2004-x64
1Ryzen DRAM....3.exe
windows7-x64
10Ryzen DRAM....3.exe
windows10-2004-x64
10Ryzen DRAM...g0.dll
windows7-x64
3Ryzen DRAM...g0.dll
windows10-2004-x64
3Ryzen DRAM...g0.sys
windows7-x64
1Ryzen DRAM...g0.sys
windows10-2004-x64
1Ryzen DRAM...64.dll
windows7-x64
1Ryzen DRAM...64.dll
windows10-2004-x64
1Ryzen DRAM...64.sys
windows7-x64
1Ryzen DRAM...64.sys
windows10-2004-x64
1Ryzen DRAM...st.exe
windows7-x64
3Ryzen DRAM...st.exe
windows10-2004-x64
3Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 16:29
Static task
static1
Behavioral task
behavioral1
Sample
Ryzen DRAM Calculator 1.7.3/CCXLatency.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Ryzen DRAM Calculator 1.7.3/CCXLatency.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Ryzen DRAM Calculator 1.7.3/HCIMemTestController.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Ryzen DRAM Calculator 1.7.3/HCIMemTestController.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Ryzen DRAM Calculator 1.7.3/LineLatency.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Ryzen DRAM Calculator 1.7.3/LineLatency.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Ryzen DRAM Calculator 1.7.3/MemSpeed.exe
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
Ryzen DRAM Calculator 1.7.3/MemSpeed.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Ryzen DRAM Calculator 1.7.3/MetroFramework.dll
Resource
win7-20241023-en
Behavioral task
behavioral10
Sample
Ryzen DRAM Calculator 1.7.3/MetroFramework.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Ryzen DRAM Calculator 1.7.3/RandomLatency.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Ryzen DRAM Calculator 1.7.3/RandomLatency.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Ryzen DRAM Calculator 1.7.3/Ryzen DRAM Calculator 1.7.3.exe
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
Ryzen DRAM Calculator 1.7.3/Ryzen DRAM Calculator 1.7.3.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Ryzen DRAM Calculator 1.7.3/WinRing0.dll
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
Ryzen DRAM Calculator 1.7.3/WinRing0.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Ryzen DRAM Calculator 1.7.3/WinRing0.sys
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Ryzen DRAM Calculator 1.7.3/WinRing0.sys
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Ryzen DRAM Calculator 1.7.3/WinRing0x64.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Ryzen DRAM Calculator 1.7.3/WinRing0x64.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Ryzen DRAM Calculator 1.7.3/WinRing0x64.sys
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Ryzen DRAM Calculator 1.7.3/WinRing0x64.sys
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Ryzen DRAM Calculator 1.7.3/memtest.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Ryzen DRAM Calculator 1.7.3/memtest.exe
Resource
win10v2004-20241007-en
General
-
Target
Ryzen DRAM Calculator 1.7.3/Ryzen DRAM Calculator 1.7.3.exe
-
Size
3.0MB
-
MD5
9d88a0aa3f2b647fd6ced2f6cc7bf95e
-
SHA1
03ee53577b16217f045832d6f4c346600df29915
-
SHA256
0661814be3524d220818a4342f3949ae94ef8b005da3e10605ab9486c94170b3
-
SHA512
e8df6641bd830529a29b45e5030eb5e0cbe870254c16e2ccf0dd3b3af32f3234c80cbe8b403d2d32fb0a01218ff2011a0fa5157eb92bfda3d2bc307a362d8fff
-
SSDEEP
49152:ZEA9P+bz2cHPcUb6HSb4SOEMkBeH7nQckO6bAGx7jXTVd3338u:t92bz2Eb6pd7B6bAGx7n333J
Malware Config
Extracted
remcos
New
95.217.148.142:9004
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
SSS1ooosSAweewwe-X6B4E4
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation Ryzen DRAM Calculator 1.7.3.exe -
Executes dropped EXE 3 IoCs
pid Process 4032 Ryzen DRAM Calculator 1.7.3.exe 1596 scr_previw.exe 4912 scr_previw.exe -
Loads dropped DLL 2 IoCs
pid Process 1596 scr_previw.exe 4912 scr_previw.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4912 set thread context of 2888 4912 scr_previw.exe 96 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scr_previw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language scr_previw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ryzen DRAM Calculator 1.7.3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ryzen DRAM Calculator 1.7.3.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 3016 Ryzen DRAM Calculator 1.7.3.exe 3016 Ryzen DRAM Calculator 1.7.3.exe 1596 scr_previw.exe 4912 scr_previw.exe 4912 scr_previw.exe 2888 cmd.exe 2888 cmd.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 4912 scr_previw.exe 2888 cmd.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3016 Ryzen DRAM Calculator 1.7.3.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2004 wrote to memory of 3016 2004 Ryzen DRAM Calculator 1.7.3.exe 86 PID 2004 wrote to memory of 3016 2004 Ryzen DRAM Calculator 1.7.3.exe 86 PID 2004 wrote to memory of 3016 2004 Ryzen DRAM Calculator 1.7.3.exe 86 PID 3016 wrote to memory of 4032 3016 Ryzen DRAM Calculator 1.7.3.exe 88 PID 3016 wrote to memory of 4032 3016 Ryzen DRAM Calculator 1.7.3.exe 88 PID 3016 wrote to memory of 1596 3016 Ryzen DRAM Calculator 1.7.3.exe 89 PID 3016 wrote to memory of 1596 3016 Ryzen DRAM Calculator 1.7.3.exe 89 PID 3016 wrote to memory of 1596 3016 Ryzen DRAM Calculator 1.7.3.exe 89 PID 1596 wrote to memory of 4912 1596 scr_previw.exe 93 PID 1596 wrote to memory of 4912 1596 scr_previw.exe 93 PID 1596 wrote to memory of 4912 1596 scr_previw.exe 93 PID 4912 wrote to memory of 2888 4912 scr_previw.exe 96 PID 4912 wrote to memory of 2888 4912 scr_previw.exe 96 PID 4912 wrote to memory of 2888 4912 scr_previw.exe 96 PID 4912 wrote to memory of 2888 4912 scr_previw.exe 96 PID 2888 wrote to memory of 2256 2888 cmd.exe 105 PID 2888 wrote to memory of 2256 2888 cmd.exe 105 PID 2888 wrote to memory of 2256 2888 cmd.exe 105 PID 2888 wrote to memory of 2256 2888 cmd.exe 105 PID 2888 wrote to memory of 2256 2888 cmd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ryzen DRAM Calculator 1.7.3\Ryzen DRAM Calculator 1.7.3.exe"C:\Users\Admin\AppData\Local\Temp\Ryzen DRAM Calculator 1.7.3\Ryzen DRAM Calculator 1.7.3.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\Ryzen DRAM Calculator 1.7.3\Ryzen DRAM Calculator 1.7.3.exe"C:\Users\Admin\AppData\Local\Temp\Ryzen DRAM Calculator 1.7.3\Ryzen DRAM Calculator 1.7.3.exe" /VERYSILENT2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Roaming\Ryzen DRAM Calculator 1.7.3\Ryzen DRAM Calculator 1.7.3.exe"C:\Users\Admin\AppData\Roaming\Ryzen DRAM Calculator 1.7.3\Ryzen DRAM Calculator 1.7.3.exe"3⤵
- Executes dropped EXE
PID:4032
-
-
C:\Users\Admin\AppData\Roaming\scr_previw.exe"C:\Users\Admin\AppData\Roaming\scr_previw.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Roaming\Browserload\scr_previw.exeC:\Users\Admin\AppData\Roaming\Browserload\scr_previw.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe6⤵
- System Location Discovery: System Language Discovery
PID:2256
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5004de08d55e829fac3a5d6ae022d9ad0
SHA1e725dfc2de9a042ab1cd4c71f3f0a82ae71e3c65
SHA2568382bb03733111c6804e4e9d02646273fd20be49f0a97cd5cb8f374e7edd9d29
SHA512a51952f0a0de2f3a62841109b3ed1e84fc9669acbf9580add6ae648b847c19b387f07b18bb0c4c87542a9864b7340dec7775eec1aa4a1fda5a6793a26d27ef64
-
Filesize
1.0MB
MD5782db962173b5a744fdadcbbed8a6730
SHA149ec2b0443801cad7b4664f3887654a010c53392
SHA25618d88f4214a2e62640719f1a5377c5f222721c97aa4ea2dec1526b09df211eeb
SHA5128cebe2557a8847ad2084a9466210e9f931a14a2e75f73c30424e4a69936c628cdc41ac7493799662d2765225645ddc2f3d685f3aca48227b746eb6178beb10cf
-
Filesize
947KB
MD5a727c368e3a6c273f28c80607f2df861
SHA1a31a2b4a4677d58bf9f7126da6dedaf4502eb283
SHA256bc5e2a7118a6e0a37b968dca2c110dd9db9a4359f6aea13f41ac04c663d066ca
SHA512b7a47943727fced7da83f89d8eac50a50308a8a7abacf57b7ffcc0b2c05349360a8af60f3ab81755ba456b956b022c99f21692d339d399a42a5b8d9860b9045d
-
Filesize
1.9MB
MD5e8ad346c114fda96fca288966eae8e92
SHA1fdfad7f2030b54f076b2a2e24ef1199abf2588e6
SHA2567e04681fdc438855e5b27a92c73b74ccb0a13338ee24a5054571b8efd8918ba0
SHA512d63e542de66eb09d6847ed99e173763b7c24335566f650bdb198d4279b0de6e14cb4a03f29c66b5d7d6c480a6f520f677fccf8cbf51dc5db3f8af6c5412d7549
-
Filesize
15KB
MD5162ba47ec20e7fb580672579a6fef9d2
SHA1a6b52b8f549ca44ffe821f65e846b869da544c28
SHA256227baa93552cc95a5d2142c23c27f2006e41093cfe24f89bea1b8fe8abbac159
SHA512135e057a779e5ed593f455ecc646dbf0f21b0bab909e0d8c3d83c7817e82e52115551cd6710b75dbfb9026393861e6f24f63ec59722d1e73553df97ac0e55cd4
-
Filesize
2.2MB
MD5d9530ecee42acccfd3871672a511bc9e
SHA189b4d2406f1294bd699ef231a4def5f495f12778
SHA25681e04f9a131534acc0e9de08718c062d3d74c80c7f168ec7e699cd4b2bd0f280
SHA512d5f048ea995affdf9893ec4c5ac5eb188b6714f5b6712e0b5a316702033421b145b8ee6a62d303eb4576bf8f57273ff35c5d675807563a31157136f79d8a9980