Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2024 16:55
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20241007-en
General
-
Target
file.exe
-
Size
896KB
-
MD5
21d13f2f3c4db8f083b672d81831fa5e
-
SHA1
b93f931a10a8a4b6f155b6b2ad9c5f9fbb3d71d0
-
SHA256
17bb66d25ec39d1818cc01e067ea7139eef15dcb24bce24840666eede661a3c3
-
SHA512
005658047ae5bd43d2c709c640ffd60b17a3e551657502804dbfd288193b340834e74b6a007731f401d4fc62b76cbafde40e5a30b08f9fb00f9506b6438c470d
-
SSDEEP
12288:ZWBoBYd39letTbwm3Undsb+gfrEJLzDQ2bALSKLmDt8N90il5HyV/e4:ZeR9ItXwdnWbLrEJJrta5Hah
Malware Config
Extracted
remcos
2.0.4 Pro
RemoteHost
154.16.63.197:3360
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-XVE2ON
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
pony
http://admino.ml/eme/gate.php
-
payload_url
http://admino.ml/eme/kachistub.exe
Signatures
-
Pony family
-
Remcos family
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation file.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation SGS.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\file.exe file.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\file.exe file.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SGS.exe SGS.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SGS.exe SGS.exe -
Executes dropped EXE 2 IoCs
pid Process 4732 SGS.exe 4764 SGS.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts SGS.exe -
Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook SGS.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1880 set thread context of 4144 1880 file.exe 100 PID 4732 set thread context of 4764 4732 SGS.exe 103 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SGS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SGS.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeImpersonatePrivilege 4764 SGS.exe Token: SeTcbPrivilege 4764 SGS.exe Token: SeChangeNotifyPrivilege 4764 SGS.exe Token: SeCreateTokenPrivilege 4764 SGS.exe Token: SeBackupPrivilege 4764 SGS.exe Token: SeRestorePrivilege 4764 SGS.exe Token: SeIncreaseQuotaPrivilege 4764 SGS.exe Token: SeAssignPrimaryTokenPrivilege 4764 SGS.exe Token: SeImpersonatePrivilege 4764 SGS.exe Token: SeTcbPrivilege 4764 SGS.exe Token: SeChangeNotifyPrivilege 4764 SGS.exe Token: SeCreateTokenPrivilege 4764 SGS.exe Token: SeBackupPrivilege 4764 SGS.exe Token: SeRestorePrivilege 4764 SGS.exe Token: SeIncreaseQuotaPrivilege 4764 SGS.exe Token: SeAssignPrimaryTokenPrivilege 4764 SGS.exe Token: SeImpersonatePrivilege 4764 SGS.exe Token: SeTcbPrivilege 4764 SGS.exe Token: SeChangeNotifyPrivilege 4764 SGS.exe Token: SeCreateTokenPrivilege 4764 SGS.exe Token: SeBackupPrivilege 4764 SGS.exe Token: SeRestorePrivilege 4764 SGS.exe Token: SeIncreaseQuotaPrivilege 4764 SGS.exe Token: SeAssignPrimaryTokenPrivilege 4764 SGS.exe Token: SeImpersonatePrivilege 4764 SGS.exe Token: SeTcbPrivilege 4764 SGS.exe Token: SeChangeNotifyPrivilege 4764 SGS.exe Token: SeCreateTokenPrivilege 4764 SGS.exe Token: SeBackupPrivilege 4764 SGS.exe Token: SeRestorePrivilege 4764 SGS.exe Token: SeIncreaseQuotaPrivilege 4764 SGS.exe Token: SeAssignPrimaryTokenPrivilege 4764 SGS.exe Token: SeImpersonatePrivilege 4764 SGS.exe Token: SeTcbPrivilege 4764 SGS.exe Token: SeChangeNotifyPrivilege 4764 SGS.exe Token: SeCreateTokenPrivilege 4764 SGS.exe Token: SeBackupPrivilege 4764 SGS.exe Token: SeRestorePrivilege 4764 SGS.exe Token: SeIncreaseQuotaPrivilege 4764 SGS.exe Token: SeAssignPrimaryTokenPrivilege 4764 SGS.exe Token: SeImpersonatePrivilege 4764 SGS.exe Token: SeTcbPrivilege 4764 SGS.exe Token: SeChangeNotifyPrivilege 4764 SGS.exe Token: SeCreateTokenPrivilege 4764 SGS.exe Token: SeBackupPrivilege 4764 SGS.exe Token: SeRestorePrivilege 4764 SGS.exe Token: SeIncreaseQuotaPrivilege 4764 SGS.exe Token: SeAssignPrimaryTokenPrivilege 4764 SGS.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4144 file.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4144 file.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4144 file.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1880 wrote to memory of 4732 1880 file.exe 99 PID 1880 wrote to memory of 4732 1880 file.exe 99 PID 1880 wrote to memory of 4732 1880 file.exe 99 PID 1880 wrote to memory of 4144 1880 file.exe 100 PID 1880 wrote to memory of 4144 1880 file.exe 100 PID 1880 wrote to memory of 4144 1880 file.exe 100 PID 1880 wrote to memory of 4144 1880 file.exe 100 PID 1880 wrote to memory of 4144 1880 file.exe 100 PID 1880 wrote to memory of 4144 1880 file.exe 100 PID 1880 wrote to memory of 4144 1880 file.exe 100 PID 1880 wrote to memory of 4144 1880 file.exe 100 PID 1880 wrote to memory of 4144 1880 file.exe 100 PID 4732 wrote to memory of 4764 4732 SGS.exe 103 PID 4732 wrote to memory of 4764 4732 SGS.exe 103 PID 4732 wrote to memory of 4764 4732 SGS.exe 103 PID 4732 wrote to memory of 4764 4732 SGS.exe 103 PID 4732 wrote to memory of 4764 4732 SGS.exe 103 PID 4732 wrote to memory of 4764 4732 SGS.exe 103 PID 4732 wrote to memory of 4764 4732 SGS.exe 103 PID 4732 wrote to memory of 4764 4732 SGS.exe 103 PID 4764 wrote to memory of 3408 4764 SGS.exe 106 PID 4764 wrote to memory of 3408 4764 SGS.exe 106 PID 4764 wrote to memory of 3408 4764 SGS.exe 106 -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook SGS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\SGS.exe"C:\Users\Admin\AppData\Local\Temp\SGS.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\SGS.exeC:\Users\Admin\AppData\Local\Temp\SGS.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_win_path
PID:4764 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\240687328.bat" "C:\Users\Admin\AppData\Local\Temp\SGS.exe" "4⤵
- System Location Discovery: System Language Discovery
PID:3408
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\file.exeC:\Users\Admin\AppData\Local\Temp\file.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4144
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94B
MD53880eeb1c736d853eb13b44898b718ab
SHA14eec9d50360cd815211e3c4e6bdd08271b6ec8e6
SHA256936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7
SHA5123eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b
-
Filesize
833KB
MD531b2f8c329a601b145e7e71a6d120a7b
SHA158487332c00cb299d67f14c288cbdf9aa9099e44
SHA256f06d03375b253842a56748e5e49206147ab986e73b109392a36be672616c6b5d
SHA51292021e862955ccec4ff72770cdd1a89d165f26c500a907dd078c4d665423b56736fa0a81cf5d50ab8da91807a18a762d2c307f3aa503187babb598674de3ac1c
-
Filesize
106B
MD56eef453d94300fd9b3ff86ebe0f23aff
SHA19c582ddddbbf7a1ab0a689c3f21f5871ba9fb5a9
SHA256dc0d0e9d4cd47ad206e66707558ccdb6b243f8b6ee007e2fa281d90d54f0d4cd
SHA5121ead34daafc8b3025c03d1a2064b35ab62b789dee1533c55c3795d6ff8ae1ff74709e0d25ae1621c91d6753922034d5c33c30ff73d08a9324e936fc392c57b45