Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-11-2024 05:53
Static task
static1
Behavioral task
behavioral1
Sample
Quotation - SQ_HYD_003861.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Quotation - SQ_HYD_003861.exe
Resource
win10v2004-20241007-en
General
-
Target
Quotation - SQ_HYD_003861.exe
-
Size
620KB
-
MD5
458244c986e32aaadd41d24c324927a0
-
SHA1
d49fd336aa758a128f5b801a115d8a44b25f06cf
-
SHA256
b44d0c9a344be2637aca53e7b556241d5611f8e807fc053f6f134dfe11ebbfc2
-
SHA512
2454f9e59589946faef2d38a93877552040233c06f9d257ac80e78133ad8a854e677655be28861f85f6f865e7222863b5989e85eeb9a39504d6ef8084d82b07c
-
SSDEEP
12288:M417/cAhnVxR24T93+suohEX7RGFO3dugtOh0:M417/ciXRQnoWXEg3dO
Malware Config
Extracted
remcos
RemoteHost
www.chileeclassproject.com:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
5451
-
mouse_option
false
-
mutex
Rmc-1FU53L
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1708 set thread context of 924 1708 Quotation - SQ_HYD_003861.exe 87 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Quotation - SQ_HYD_003861.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Quotation - SQ_HYD_003861.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1708 Quotation - SQ_HYD_003861.exe 1708 Quotation - SQ_HYD_003861.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1708 Quotation - SQ_HYD_003861.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 924 Quotation - SQ_HYD_003861.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1708 wrote to memory of 4984 1708 Quotation - SQ_HYD_003861.exe 86 PID 1708 wrote to memory of 4984 1708 Quotation - SQ_HYD_003861.exe 86 PID 1708 wrote to memory of 4984 1708 Quotation - SQ_HYD_003861.exe 86 PID 1708 wrote to memory of 924 1708 Quotation - SQ_HYD_003861.exe 87 PID 1708 wrote to memory of 924 1708 Quotation - SQ_HYD_003861.exe 87 PID 1708 wrote to memory of 924 1708 Quotation - SQ_HYD_003861.exe 87 PID 1708 wrote to memory of 924 1708 Quotation - SQ_HYD_003861.exe 87 PID 1708 wrote to memory of 924 1708 Quotation - SQ_HYD_003861.exe 87 PID 1708 wrote to memory of 924 1708 Quotation - SQ_HYD_003861.exe 87 PID 1708 wrote to memory of 924 1708 Quotation - SQ_HYD_003861.exe 87 PID 1708 wrote to memory of 924 1708 Quotation - SQ_HYD_003861.exe 87 PID 1708 wrote to memory of 924 1708 Quotation - SQ_HYD_003861.exe 87 PID 1708 wrote to memory of 924 1708 Quotation - SQ_HYD_003861.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation - SQ_HYD_003861.exe"C:\Users\Admin\AppData\Local\Temp\Quotation - SQ_HYD_003861.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\Quotation - SQ_HYD_003861.exe"C:\Users\Admin\AppData\Local\Temp\Quotation - SQ_HYD_003861.exe"2⤵PID:4984
-
-
C:\Users\Admin\AppData\Local\Temp\Quotation - SQ_HYD_003861.exe"C:\Users\Admin\AppData\Local\Temp\Quotation - SQ_HYD_003861.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:924
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5ca9188451c7c848296dd1f4db1a79bcf
SHA1808c71c0aba7231ab1e4639d2b23fd825bf0ee23
SHA2564dabcf954ebefc0f5c245b1ed7a64743c2677350d9edf0fa646794bd09944737
SHA512313437d2bf8462c4461de8c07ce7477e91f597888aa89f5a9d58cafcb70251b6ea4210875dbb92083816b58e867641b9deb1f2dba7b2ac9cb4a26d4116469302