Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-11-2024 08:51
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe
Resource
win10v2004-20241007-en
General
-
Target
QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe
-
Size
1.3MB
-
MD5
b80d47598764ee94143290bb57428724
-
SHA1
bc2fe98a03d2196d02038c5c016f6e7a71529e9f
-
SHA256
ae7dd99d6214b35fe4d225dd782ca41714ffd0b637d8db40fbb887e00807d288
-
SHA512
5c47b98b18eb4bc00149f3189e18fb6f9d83e92821bc38d1def0f1ceb7ba55de0d8306280806b72d8880c6e150af0ce662229739b5cfcec799e35ab26633f7f2
-
SSDEEP
24576:FX+izx1yUYSr7tqMO/7KgyfE75BP/+mgWdm/bTFcLKV:9Jzx9r7g1r2mgxvF
Malware Config
Extracted
remcos
HOST
windowslavesclient.duckdns.org:1604
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-57SZW9
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Executes dropped EXE 1 IoCs
Processes:
Photoes.exepid process 3720 Photoes.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vsysems = "C:\\Users\\Admin\\AppData\\Roaming\\Photoes.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Photoes.exedescription pid process target process PID 3720 set thread context of 4888 3720 Photoes.exe AddInProcess32.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.exereg.exePING.EXEcmd.exePING.EXEPhotoes.exeAddInProcess32.exeQUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exePING.EXEdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Photoes.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs
Adversaries may check for Internet connectivity on compromised systems.
Processes:
cmd.exePING.EXEcmd.exePING.EXEPING.EXEpid process 4660 cmd.exe 3040 PING.EXE 4576 cmd.exe 4952 PING.EXE 1852 PING.EXE -
Runs ping.exe 1 TTPs 3 IoCs
Processes:
PING.EXEPING.EXEPING.EXEpid process 3040 PING.EXE 4952 PING.EXE 1852 PING.EXE -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exePhotoes.exepid process 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe 3720 Photoes.exe 3720 Photoes.exe 3720 Photoes.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exePhotoes.exedescription pid process Token: SeDebugPrivilege 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe Token: SeDebugPrivilege 3720 Photoes.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.execmd.execmd.exePhotoes.exedescription pid process target process PID 1000 wrote to memory of 4660 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe cmd.exe PID 1000 wrote to memory of 4660 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe cmd.exe PID 1000 wrote to memory of 4660 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe cmd.exe PID 4660 wrote to memory of 3040 4660 cmd.exe PING.EXE PID 4660 wrote to memory of 3040 4660 cmd.exe PING.EXE PID 4660 wrote to memory of 3040 4660 cmd.exe PING.EXE PID 1000 wrote to memory of 4576 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe cmd.exe PID 1000 wrote to memory of 4576 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe cmd.exe PID 1000 wrote to memory of 4576 1000 QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe cmd.exe PID 4576 wrote to memory of 4952 4576 cmd.exe PING.EXE PID 4576 wrote to memory of 4952 4576 cmd.exe PING.EXE PID 4576 wrote to memory of 4952 4576 cmd.exe PING.EXE PID 4660 wrote to memory of 2256 4660 cmd.exe reg.exe PID 4660 wrote to memory of 2256 4660 cmd.exe reg.exe PID 4660 wrote to memory of 2256 4660 cmd.exe reg.exe PID 4576 wrote to memory of 1852 4576 cmd.exe PING.EXE PID 4576 wrote to memory of 1852 4576 cmd.exe PING.EXE PID 4576 wrote to memory of 1852 4576 cmd.exe PING.EXE PID 4576 wrote to memory of 3720 4576 cmd.exe Photoes.exe PID 4576 wrote to memory of 3720 4576 cmd.exe Photoes.exe PID 4576 wrote to memory of 3720 4576 cmd.exe Photoes.exe PID 3720 wrote to memory of 4888 3720 Photoes.exe AddInProcess32.exe PID 3720 wrote to memory of 4888 3720 Photoes.exe AddInProcess32.exe PID 3720 wrote to memory of 4888 3720 Photoes.exe AddInProcess32.exe PID 3720 wrote to memory of 4888 3720 Photoes.exe AddInProcess32.exe PID 3720 wrote to memory of 4888 3720 Photoes.exe AddInProcess32.exe PID 3720 wrote to memory of 4888 3720 Photoes.exe AddInProcess32.exe PID 3720 wrote to memory of 4888 3720 Photoes.exe AddInProcess32.exe PID 3720 wrote to memory of 4888 3720 Photoes.exe AddInProcess32.exe PID 3720 wrote to memory of 4888 3720 Photoes.exe AddInProcess32.exe PID 3720 wrote to memory of 4888 3720 Photoes.exe AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 18 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "vsysems" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Photoes.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 183⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3040
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "vsysems" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Photoes.exe"3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2256
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 21 > nul && copy "C:\Users\Admin\AppData\Local\Temp\QUOTATION #46789RFQ_SUPLMS_NOV24_SALEH_CONSTRUCTIONS_LLC_PDF.exe" "C:\Users\Admin\AppData\Roaming\Photoes.exe" && ping 127.0.0.1 -n 21 > nul && "C:\Users\Admin\AppData\Roaming\Photoes.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 213⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4952
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 213⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1852
-
-
C:\Users\Admin\AppData\Roaming\Photoes.exe"C:\Users\Admin\AppData\Roaming\Photoes.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"4⤵
- System Location Discovery: System Language Discovery
PID:4888
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5b80d47598764ee94143290bb57428724
SHA1bc2fe98a03d2196d02038c5c016f6e7a71529e9f
SHA256ae7dd99d6214b35fe4d225dd782ca41714ffd0b637d8db40fbb887e00807d288
SHA5125c47b98b18eb4bc00149f3189e18fb6f9d83e92821bc38d1def0f1ceb7ba55de0d8306280806b72d8880c6e150af0ce662229739b5cfcec799e35ab26633f7f2