Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-12-2024 15:47
Static task
static1
Behavioral task
behavioral1
Sample
812e1927550e39501b2477df2479dc239b428d11bbae81e719c220769ccd7b34.dll
Resource
win7-20240903-en
General
-
Target
812e1927550e39501b2477df2479dc239b428d11bbae81e719c220769ccd7b34.dll
-
Size
5.0MB
-
MD5
c1e4443c640d1dc0b408356a0ef216be
-
SHA1
9ca2853691bf347e12e620dadcf6ea1cceb817fe
-
SHA256
812e1927550e39501b2477df2479dc239b428d11bbae81e719c220769ccd7b34
-
SHA512
2d47e620c46634519a861b68ac779e22a910b1f3495d5fb8a3fbad43601bc430a13e538d571192c6aaae83fda2d0c1607901aa7a360bea18da732d1bf81b86c3
-
SSDEEP
98304:3yhaH4iFZp4lHd4iQfJuI5Tf4rYfthIfsuspcZpccVHu2S5nneBOc7uZ:3dH4i6l2wWFhnbi/HuveB
Malware Config
Extracted
remcos
GUS
mastergusta.kozow.com:5151
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-6Q2P7E
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Executes dropped EXE 1 IoCs
pid Process 2560 svchost.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2164 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe 3544 rundll32.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 668 Process not Found 668 Process not Found -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3544 wrote to memory of 3044 3544 rundll32.exe 84 PID 3544 wrote to memory of 3044 3544 rundll32.exe 84 PID 3044 wrote to memory of 2164 3044 cmd.exe 86 PID 3044 wrote to memory of 2164 3044 cmd.exe 86 PID 3544 wrote to memory of 2560 3544 rundll32.exe 87 PID 3544 wrote to memory of 2560 3544 rundll32.exe 87 PID 3544 wrote to memory of 2560 3544 rundll32.exe 87 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\812e1927550e39501b2477df2479dc239b428d11bbae81e719c220769ccd7b34.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "8M2nd3VkhBIAnPBDO" /tr "C:\Users\Admin\AppData\Roaming\rundll32.exe" /sc onlogon /rl highest /f2⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\system32\schtasks.exeschtasks /create /tn "8M2nd3VkhBIAnPBDO" /tr "C:\Users\Admin\AppData\Roaming\rundll32.exe" /sc onlogon /rl highest /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2164
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2560
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
481KB
MD51b092f1dca5c6155e160c454446926cf
SHA1e27464092f4ae4b9116fcccd00e43eb631719e85
SHA25647d0885bbcbb363ded1b6cf13099e201e53e2cd8ab877692ff2df93c3a320b96
SHA512272b0db029f8aac92695491254307db0bb3d1f950496d3ee968a9e177b04d151c8acb95be8b942ead6624935a46091c948ce04592fe6b12dfe12fd4104d25682