Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-11-2024 19:31
Behavioral task
behavioral1
Sample
Luna.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
Luna.exe
Resource
win10v2004-20241007-en
General
-
Target
Luna.exe
-
Size
469KB
-
MD5
0e1f18269f4d5830d1963b033de49c31
-
SHA1
d1b43487f7ed369e64109e40b43f9f9d7a582c2f
-
SHA256
bc74405d530b50d63eaa5fd282dd477cb2607b4935f603a34d0a22066ac667f3
-
SHA512
047dccca911644287422fe0ac2c65d02179b6ffacb9e4cceff89b5dd7350b9b270e2e82ca621c265937df02fc31f13c5d6bf0bc65750965999b012a9d4d8ec87
-
SSDEEP
12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSon9:uiLJbpI7I2WhQqZ7o9
Malware Config
Extracted
remcos
RemoteHost
items-jeffrey.gl.at.ply.gg:58427
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
system.exe
-
copy_folder
Remcos
-
delete_file
true
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%WinDir%\System32
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-W6XH0D
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation Luna.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation WScript.exe -
Deletes itself 1 IoCs
pid Process 1240 WScript.exe -
Executes dropped EXE 1 IoCs
pid Process 432 system.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Windows\\SysWOW64\\Remcos\\system.exe\"" system.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Windows\\SysWOW64\\Remcos\\system.exe\"" Luna.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Windows\\SysWOW64\\Remcos\\system.exe\"" Luna.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Windows\\SysWOW64\\Remcos\\system.exe\"" system.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\Remcos\system.exe Luna.exe File opened for modification C:\Windows\SysWOW64\Remcos\system.exe Luna.exe File opened for modification C:\Windows\SysWOW64\Remcos Luna.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 432 set thread context of 2020 432 system.exe 94 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Luna.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings Luna.exe -
Modifies registry key 1 TTPs 2 IoCs
pid Process 4480 reg.exe 4368 reg.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 432 system.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 4384 wrote to memory of 4072 4384 Luna.exe 83 PID 4384 wrote to memory of 4072 4384 Luna.exe 83 PID 4384 wrote to memory of 4072 4384 Luna.exe 83 PID 4072 wrote to memory of 4480 4072 cmd.exe 85 PID 4072 wrote to memory of 4480 4072 cmd.exe 85 PID 4072 wrote to memory of 4480 4072 cmd.exe 85 PID 4384 wrote to memory of 1240 4384 Luna.exe 87 PID 4384 wrote to memory of 1240 4384 Luna.exe 87 PID 4384 wrote to memory of 1240 4384 Luna.exe 87 PID 1240 wrote to memory of 3636 1240 WScript.exe 90 PID 1240 wrote to memory of 3636 1240 WScript.exe 90 PID 1240 wrote to memory of 3636 1240 WScript.exe 90 PID 3636 wrote to memory of 432 3636 cmd.exe 92 PID 3636 wrote to memory of 432 3636 cmd.exe 92 PID 3636 wrote to memory of 432 3636 cmd.exe 92 PID 432 wrote to memory of 4548 432 system.exe 93 PID 432 wrote to memory of 4548 432 system.exe 93 PID 432 wrote to memory of 4548 432 system.exe 93 PID 432 wrote to memory of 2020 432 system.exe 94 PID 432 wrote to memory of 2020 432 system.exe 94 PID 432 wrote to memory of 2020 432 system.exe 94 PID 432 wrote to memory of 2020 432 system.exe 94 PID 4548 wrote to memory of 4368 4548 cmd.exe 97 PID 4548 wrote to memory of 4368 4548 cmd.exe 97 PID 4548 wrote to memory of 4368 4548 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\Luna.exe"C:\Users\Admin\AppData\Local\Temp\Luna.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4480
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"2⤵
- Checks computer location settings
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Windows\SysWOW64\Remcos\system.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\SysWOW64\Remcos\system.exeC:\Windows\SysWOW64\Remcos\system.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f6⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4368
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"5⤵PID:2020
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
516B
MD511bfb67f928b0558ccd925e17199f1d0
SHA11a6f10caf0575dac048571356a6f253c8e4d5fab
SHA25694cdc47ae1407e5c1074cc6dd923d7f038a110b6d096e51e571224fb2e2a92f1
SHA5127b72f01ac2163508d539fdbc19e4b4726ea2c39aec328e0d52617bccd9e3743a7d4a1bee5fd77f66d55069f5689f33f69404d8631d148486673da16406debd29
-
Filesize
469KB
MD50e1f18269f4d5830d1963b033de49c31
SHA1d1b43487f7ed369e64109e40b43f9f9d7a582c2f
SHA256bc74405d530b50d63eaa5fd282dd477cb2607b4935f603a34d0a22066ac667f3
SHA512047dccca911644287422fe0ac2c65d02179b6ffacb9e4cceff89b5dd7350b9b270e2e82ca621c265937df02fc31f13c5d6bf0bc65750965999b012a9d4d8ec87