Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-11-2024 01:15
Static task
static1
Behavioral task
behavioral1
Sample
39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe
Resource
win10v2004-20241007-en
General
-
Target
39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe
-
Size
1.3MB
-
MD5
5c44a72a49fe4fbc94f1c1aa8cbf0ab6
-
SHA1
d0d0903f73b4aa11ee580fb6fd8d80775e6e88de
-
SHA256
39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129
-
SHA512
d92503e2ebbaa4e8728098cf6d0079de711a4f92663ad9db8583d848721818e4ecf3790a65253a0cd850c23eed8a46f98049a11f77b9f106344e501d124fbb97
-
SSDEEP
24576:ctcKivRdWnSyEHyfE75BP/+mgWdm/bTLLK6:LKmXWSy6r2mgxv
Malware Config
Extracted
remcos
SLAVES
windowslavesclient.duckdns.org:1604
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-J3MJAP
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Executes dropped EXE 1 IoCs
Processes:
Images.exepid process 2112 Images.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Videoss = "C:\\Users\\Admin\\AppData\\Roaming\\Images.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Images.exedescription pid process target process PID 2112 set thread context of 4644 2112 Images.exe AddInProcess32.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exePING.EXEreg.exeImages.exeAddInProcess32.execmd.exePING.EXEcmd.exePING.EXEdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Images.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AddInProcess32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs
Adversaries may check for Internet connectivity on compromised systems.
Processes:
PING.EXEcmd.exePING.EXEPING.EXEcmd.exepid process 736 PING.EXE 2748 cmd.exe 4776 PING.EXE 2844 PING.EXE 4944 cmd.exe -
Runs ping.exe 1 TTPs 3 IoCs
Processes:
PING.EXEPING.EXEPING.EXEpid process 2844 PING.EXE 736 PING.EXE 4776 PING.EXE -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exeImages.exepid process 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe 2112 Images.exe 2112 Images.exe 2112 Images.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exeImages.exedescription pid process Token: SeDebugPrivilege 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe Token: SeDebugPrivilege 2112 Images.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.execmd.execmd.exeImages.exedescription pid process target process PID 1060 wrote to memory of 4944 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe cmd.exe PID 1060 wrote to memory of 4944 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe cmd.exe PID 1060 wrote to memory of 4944 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe cmd.exe PID 4944 wrote to memory of 736 4944 cmd.exe PING.EXE PID 4944 wrote to memory of 736 4944 cmd.exe PING.EXE PID 4944 wrote to memory of 736 4944 cmd.exe PING.EXE PID 1060 wrote to memory of 2748 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe cmd.exe PID 1060 wrote to memory of 2748 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe cmd.exe PID 1060 wrote to memory of 2748 1060 39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe cmd.exe PID 2748 wrote to memory of 4776 2748 cmd.exe PING.EXE PID 2748 wrote to memory of 4776 2748 cmd.exe PING.EXE PID 2748 wrote to memory of 4776 2748 cmd.exe PING.EXE PID 4944 wrote to memory of 1580 4944 cmd.exe reg.exe PID 4944 wrote to memory of 1580 4944 cmd.exe reg.exe PID 4944 wrote to memory of 1580 4944 cmd.exe reg.exe PID 2748 wrote to memory of 2844 2748 cmd.exe PING.EXE PID 2748 wrote to memory of 2844 2748 cmd.exe PING.EXE PID 2748 wrote to memory of 2844 2748 cmd.exe PING.EXE PID 2748 wrote to memory of 2112 2748 cmd.exe Images.exe PID 2748 wrote to memory of 2112 2748 cmd.exe Images.exe PID 2748 wrote to memory of 2112 2748 cmd.exe Images.exe PID 2112 wrote to memory of 4644 2112 Images.exe AddInProcess32.exe PID 2112 wrote to memory of 4644 2112 Images.exe AddInProcess32.exe PID 2112 wrote to memory of 4644 2112 Images.exe AddInProcess32.exe PID 2112 wrote to memory of 4644 2112 Images.exe AddInProcess32.exe PID 2112 wrote to memory of 4644 2112 Images.exe AddInProcess32.exe PID 2112 wrote to memory of 4644 2112 Images.exe AddInProcess32.exe PID 2112 wrote to memory of 4644 2112 Images.exe AddInProcess32.exe PID 2112 wrote to memory of 4644 2112 Images.exe AddInProcess32.exe PID 2112 wrote to memory of 4644 2112 Images.exe AddInProcess32.exe PID 2112 wrote to memory of 4644 2112 Images.exe AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe"C:\Users\Admin\AppData\Local\Temp\39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 18 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Videoss" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Images.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 183⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:736
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Videoss" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Images.exe"3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1580
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 24 > nul && copy "C:\Users\Admin\AppData\Local\Temp\39fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129.exe" "C:\Users\Admin\AppData\Roaming\Images.exe" && ping 127.0.0.1 -n 24 > nul && "C:\Users\Admin\AppData\Roaming\Images.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 243⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4776
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 243⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2844
-
-
C:\Users\Admin\AppData\Roaming\Images.exe"C:\Users\Admin\AppData\Roaming\Images.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"4⤵
- System Location Discovery: System Language Discovery
PID:4644
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD55c44a72a49fe4fbc94f1c1aa8cbf0ab6
SHA1d0d0903f73b4aa11ee580fb6fd8d80775e6e88de
SHA25639fe045b17ab2fcdb512758a431845409c29ca9341090ac81878658423c39129
SHA512d92503e2ebbaa4e8728098cf6d0079de711a4f92663ad9db8583d848721818e4ecf3790a65253a0cd850c23eed8a46f98049a11f77b9f106344e501d124fbb97