Analysis
-
max time kernel
597s -
max time network
601s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
23-11-2024 19:53
Behavioral task
behavioral1
Sample
test.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral2
Sample
test.exe
Resource
win11-20241007-en
General
-
Target
test.exe
-
Size
481KB
-
MD5
d9b9edd0788052df0c3c5767d6da2683
-
SHA1
e617350a65b2110f948d2a553498ed06bccbe385
-
SHA256
c24d9f1eea99dcbd0e97fef8e6c7b9c52ec641280880803e419a9ef953de66eb
-
SHA512
95e5146082fccd764f3090d8363c35c0d6b43b946e7c73a96ed1079fc964b36c6c5198fe329aaded35f637182e003d168513fd7abd82cdd24168f591a9fa75e9
-
SSDEEP
12288:buD09AUkNIGBYYv4eK13x13nZHSRVMf139F5wIB7+IwtHwBtVxbesvZDSI+DY:e09AfNIEYsunZvZ19Zbs
Malware Config
Extracted
remcos
RemoteHost
23.ip.gl.ply.gg:24321
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-YVR15V
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3232 set thread context of 1328 3232 test.exe 80 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language test.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3232 test.exe 3232 test.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3232 test.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3232 wrote to memory of 1328 3232 test.exe 80 PID 3232 wrote to memory of 1328 3232 test.exe 80 PID 3232 wrote to memory of 1328 3232 test.exe 80 PID 3232 wrote to memory of 1328 3232 test.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\test.exe"C:\Users\Admin\AppData\Local\Temp\test.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1328
-