Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-11-2024 05:53
Static task
static1
Behavioral task
behavioral1
Sample
Quotation - SQ_HYD_003861.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Quotation - SQ_HYD_003861.exe
Resource
win10v2004-20241007-en
General
-
Target
Quotation - SQ_HYD_003861.exe
-
Size
620KB
-
MD5
458244c986e32aaadd41d24c324927a0
-
SHA1
d49fd336aa758a128f5b801a115d8a44b25f06cf
-
SHA256
b44d0c9a344be2637aca53e7b556241d5611f8e807fc053f6f134dfe11ebbfc2
-
SHA512
2454f9e59589946faef2d38a93877552040233c06f9d257ac80e78133ad8a854e677655be28861f85f6f865e7222863b5989e85eeb9a39504d6ef8084d82b07c
-
SSDEEP
12288:M417/cAhnVxR24T93+suohEX7RGFO3dugtOh0:M417/ciXRQnoWXEg3dO
Malware Config
Extracted
remcos
RemoteHost
www.chileeclassproject.com:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
5451
-
mouse_option
false
-
mutex
Rmc-1FU53L
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1652 set thread context of 2324 1652 Quotation - SQ_HYD_003861.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Quotation - SQ_HYD_003861.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Quotation - SQ_HYD_003861.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1652 Quotation - SQ_HYD_003861.exe 1652 Quotation - SQ_HYD_003861.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1652 Quotation - SQ_HYD_003861.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2324 Quotation - SQ_HYD_003861.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1652 wrote to memory of 2308 1652 Quotation - SQ_HYD_003861.exe 30 PID 1652 wrote to memory of 2308 1652 Quotation - SQ_HYD_003861.exe 30 PID 1652 wrote to memory of 2308 1652 Quotation - SQ_HYD_003861.exe 30 PID 1652 wrote to memory of 2308 1652 Quotation - SQ_HYD_003861.exe 30 PID 1652 wrote to memory of 2324 1652 Quotation - SQ_HYD_003861.exe 31 PID 1652 wrote to memory of 2324 1652 Quotation - SQ_HYD_003861.exe 31 PID 1652 wrote to memory of 2324 1652 Quotation - SQ_HYD_003861.exe 31 PID 1652 wrote to memory of 2324 1652 Quotation - SQ_HYD_003861.exe 31 PID 1652 wrote to memory of 2324 1652 Quotation - SQ_HYD_003861.exe 31 PID 1652 wrote to memory of 2324 1652 Quotation - SQ_HYD_003861.exe 31 PID 1652 wrote to memory of 2324 1652 Quotation - SQ_HYD_003861.exe 31 PID 1652 wrote to memory of 2324 1652 Quotation - SQ_HYD_003861.exe 31 PID 1652 wrote to memory of 2324 1652 Quotation - SQ_HYD_003861.exe 31 PID 1652 wrote to memory of 2324 1652 Quotation - SQ_HYD_003861.exe 31 PID 1652 wrote to memory of 2324 1652 Quotation - SQ_HYD_003861.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation - SQ_HYD_003861.exe"C:\Users\Admin\AppData\Local\Temp\Quotation - SQ_HYD_003861.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\Quotation - SQ_HYD_003861.exe"C:\Users\Admin\AppData\Local\Temp\Quotation - SQ_HYD_003861.exe"2⤵PID:2308
-
-
C:\Users\Admin\AppData\Local\Temp\Quotation - SQ_HYD_003861.exe"C:\Users\Admin\AppData\Local\Temp\Quotation - SQ_HYD_003861.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2324
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5a2a61b84a5911d979cd1597e952a324b
SHA136340f1e1e36b01f090f51e9a0419561933c3227
SHA2561a8b4cb7a6c6aadaf3877ad20da74bb95d846dd8463f1e852fd050d275513cc7
SHA5127fe4910558f895423f256363262d2a1f8c2244a3ad78e4ce0732dfd2e946926f17c0cf4c98eb7a5dbf65db423a48ebfa0ef1408ac7f105d5eeb9448689731720