Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
01/12/2024, 13:38
General
-
Target
loader1.exe
-
Size
19.6MB
-
MD5
fcfb2668c205cf6b25b256420ace004e
-
SHA1
b3b696adff3cc0fc12f027347b582aa9cd7d5f20
-
SHA256
4e3931657ed3103acf45c9356d5ef5648298cbfc5d11f8dd407b94e776c14fd5
-
SHA512
9c577770ca4de729fb55420936802a21f02a765404e7faffc17aaa25bfee45bdfe8e606e0255530f3d01276c3729d285df748790449531eca5e6a393f1440297
-
SSDEEP
393216:vNVL8SLSsbPpiZ8XtX64nYjRG3CA8d6i67sYppz6cvt2dL:1VLxTp2etX2Y3id45pz8L
Score
10/10
Malware Config
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 11 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\loader1.exe"C:\Users\Admin\AppData\Local\Temp\loader1.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33.7MB
-
Filesize
8KB
-
Filesize
33.7MB
-
Filesize
33.7MB
-
Filesize
33.7MB
-
Filesize
33.7MB
-
Filesize
33.7MB
-
Filesize
33.7MB
-
Filesize
33.7MB
-
Filesize
33.7MB
-
Filesize
33.7MB
-
Filesize
33.7MB