Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-12-2024 21:03
Static task
static1
Behavioral task
behavioral1
Sample
2c956dbbe6148be036c83f263c1dca1ccdfa889a493b924a53186eb0d72ed195.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2c956dbbe6148be036c83f263c1dca1ccdfa889a493b924a53186eb0d72ed195.exe
Resource
win10v2004-20241007-en
General
-
Target
2c956dbbe6148be036c83f263c1dca1ccdfa889a493b924a53186eb0d72ed195.exe
-
Size
133KB
-
MD5
d6fbe07dc4479b81cf3fcca659ecf7b5
-
SHA1
e4265d86d805795984b9bb8af92d19ec55dfbc21
-
SHA256
2c956dbbe6148be036c83f263c1dca1ccdfa889a493b924a53186eb0d72ed195
-
SHA512
719cf92bede2b306d6f8c4d31512428f68cf9178840a80322890f4761fae4c5d32a6453d9cf8274515e4c8622de5a906d8f7158e701df1e9ea8a1b4a44b02f43
-
SSDEEP
1536:ITHiPBX4nDzMyRXGHrc9YRHqbTypgpmb5Q+ZReSdhk/J+YLgD3mrxb53cSuYQjKX:xPd4n/M+WLcilrpgGH/GwY87mVmIXaW
Malware Config
Extracted
remcos
1.7 Pro
Host
systemcontrol.ddns.net:45000
systemcontrol2.ddns.net:45000
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
OfficeUpgrade.exe
-
copy_folder
OfficeUpgrade
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
Upgrader.dat
-
keylog_flag
false
-
keylog_folder
Upgrader
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
req_khauflaoyr
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
OfficeUpgrade
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Executes dropped EXE 2 IoCs
pid Process 2728 wn2ra4ohzdr.exe 2640 wn2ra4ohzdr.exe -
Loads dropped DLL 1 IoCs
pid Process 3020 2c956dbbe6148be036c83f263c1dca1ccdfa889a493b924a53186eb0d72ed195.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\raj4dkhhiap = "C:\\Users\\Admin\\AppData\\Roaming\\raj4dkhhiap\\wn2ra4ohzdr.exe" 2c956dbbe6148be036c83f263c1dca1ccdfa889a493b924a53186eb0d72ed195.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2728 set thread context of 2640 2728 wn2ra4ohzdr.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2c956dbbe6148be036c83f263c1dca1ccdfa889a493b924a53186eb0d72ed195.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wn2ra4ohzdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wn2ra4ohzdr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2640 wn2ra4ohzdr.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3020 wrote to memory of 2728 3020 2c956dbbe6148be036c83f263c1dca1ccdfa889a493b924a53186eb0d72ed195.exe 30 PID 3020 wrote to memory of 2728 3020 2c956dbbe6148be036c83f263c1dca1ccdfa889a493b924a53186eb0d72ed195.exe 30 PID 3020 wrote to memory of 2728 3020 2c956dbbe6148be036c83f263c1dca1ccdfa889a493b924a53186eb0d72ed195.exe 30 PID 3020 wrote to memory of 2728 3020 2c956dbbe6148be036c83f263c1dca1ccdfa889a493b924a53186eb0d72ed195.exe 30 PID 2728 wrote to memory of 2640 2728 wn2ra4ohzdr.exe 31 PID 2728 wrote to memory of 2640 2728 wn2ra4ohzdr.exe 31 PID 2728 wrote to memory of 2640 2728 wn2ra4ohzdr.exe 31 PID 2728 wrote to memory of 2640 2728 wn2ra4ohzdr.exe 31 PID 2728 wrote to memory of 2640 2728 wn2ra4ohzdr.exe 31 PID 2728 wrote to memory of 2640 2728 wn2ra4ohzdr.exe 31 PID 2728 wrote to memory of 2640 2728 wn2ra4ohzdr.exe 31 PID 2728 wrote to memory of 2640 2728 wn2ra4ohzdr.exe 31 PID 2728 wrote to memory of 2640 2728 wn2ra4ohzdr.exe 31 PID 2728 wrote to memory of 2640 2728 wn2ra4ohzdr.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c956dbbe6148be036c83f263c1dca1ccdfa889a493b924a53186eb0d72ed195.exe"C:\Users\Admin\AppData\Local\Temp\2c956dbbe6148be036c83f263c1dca1ccdfa889a493b924a53186eb0d72ed195.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2640
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD5646a2d5719f3322a13b0e08d7fefda26
SHA10404398429d278e9c3172fbc2f0ceb1f1db6dbdc
SHA2562c6d087cb57ec4dad1ed9b0dbb7ad27e4e2ec9232e7b10238ccf3eaf8c41c38e
SHA512ca2e3e0ce0336abe68681a63a142df530b90b2aac0ff957c9f280262b6f1cfdf1106fb20a435585b380ec03ec69d6a78891a6eafa3806889cb1122b3c1c1a211