Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14-11-2024 04:52
Static task
static1
Behavioral task
behavioral1
Sample
LPO.exe
Resource
win7-20240903-en
General
-
Target
LPO.exe
-
Size
1.8MB
-
MD5
c3bf525ab42ea2e0a37a55b290dd13bf
-
SHA1
665e8ac35e69dc4a1fa273bd35703a201f9b074d
-
SHA256
7a422ffa32fcdb0ca5698ef80ea3a7bed96b3fc42e008b0458256f4c680bd395
-
SHA512
d6f71d29a5e4b94d04181791edf55d22c3640e2c4115a1b17f4d6c14b79ea0b728a06acb0a0c3848ac4edae8535cf923585af13236fdeddf0051345d083fa9d8
-
SSDEEP
12288:qLXh08hSxuM4AUQC46V10t5hwv1xh14VGpxJz5W+EQpOIzkTJXY8I+6yi:QXNSNVt5+vPh14gxJzsQpOmkTJXY5
Malware Config
Extracted
remcos
GASPLANT
dotatech.de:30908
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
chrome-SYTYBI
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" LPO.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2688 powershell.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA LPO.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" LPO.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2216 set thread context of 2780 2216 LPO.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2688 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2688 powershell.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2688 2216 LPO.exe 30 PID 2216 wrote to memory of 2688 2216 LPO.exe 30 PID 2216 wrote to memory of 2688 2216 LPO.exe 30 PID 2216 wrote to memory of 2784 2216 LPO.exe 32 PID 2216 wrote to memory of 2784 2216 LPO.exe 32 PID 2216 wrote to memory of 2784 2216 LPO.exe 32 PID 2216 wrote to memory of 2784 2216 LPO.exe 32 PID 2216 wrote to memory of 2780 2216 LPO.exe 33 PID 2216 wrote to memory of 2780 2216 LPO.exe 33 PID 2216 wrote to memory of 2780 2216 LPO.exe 33 PID 2216 wrote to memory of 2780 2216 LPO.exe 33 PID 2216 wrote to memory of 2780 2216 LPO.exe 33 PID 2216 wrote to memory of 2780 2216 LPO.exe 33 PID 2216 wrote to memory of 2780 2216 LPO.exe 33 PID 2216 wrote to memory of 2780 2216 LPO.exe 33 PID 2216 wrote to memory of 2780 2216 LPO.exe 33 PID 2216 wrote to memory of 2780 2216 LPO.exe 33 PID 2216 wrote to memory of 2780 2216 LPO.exe 33 PID 2216 wrote to memory of 2824 2216 LPO.exe 34 PID 2216 wrote to memory of 2824 2216 LPO.exe 34 PID 2216 wrote to memory of 2824 2216 LPO.exe 34 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" LPO.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\LPO.exe"C:\Users\Admin\AppData\Local\Temp\LPO.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2216 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\LPO.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"2⤵PID:2784
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2780
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2216 -s 8002⤵PID:2824
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2