Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 14:11
Static task
static1
Behavioral task
behavioral1
Sample
00004563LIST.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
00004563LIST.exe
Resource
win10v2004-20241007-en
General
-
Target
00004563LIST.exe
-
Size
1.3MB
-
MD5
6bbe4822f897346e2ebe3f9460a7e73d
-
SHA1
13c631218b516eb28a14f320438a5485b138a16c
-
SHA256
67fbe8329d7361d63e1c26af5207daeb0f1c0750bac56526c0c43a3492b9f71d
-
SHA512
5751bc015ab3669ea6da9c5010673738554b6fae5c3a9942b71c6915e3195d94a54c0a3ba7d864ba3af64bcf0686114724611b73709574088b7b07094c513943
-
SSDEEP
24576:jqDEvCTbMWu7rQYlBQcBiT6rprG8aIwnGQY8ScSrdc/BCkeGZrbgXNbox:jTvC/MTQYxsWR7aIIY7cSrLkeQMXK
Malware Config
Extracted
remcos
RemoteHost
192.3.64.152:2559
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-ZFXG9Y
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\anaboly.vbs anaboly.exe -
Executes dropped EXE 1 IoCs
pid Process 2412 anaboly.exe -
Loads dropped DLL 1 IoCs
pid Process 2092 00004563LIST.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0007000000015da7-8.dat autoit_exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2412 set thread context of 2812 2412 anaboly.exe 31 PID 2812 set thread context of 2240 2812 svchost.exe 32 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 00004563LIST.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language anaboly.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2812 svchost.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2412 anaboly.exe 2812 svchost.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 2092 00004563LIST.exe 2092 00004563LIST.exe 2092 00004563LIST.exe 2412 anaboly.exe 2412 anaboly.exe -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 2092 00004563LIST.exe 2092 00004563LIST.exe 2092 00004563LIST.exe 2412 anaboly.exe 2412 anaboly.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2092 wrote to memory of 2412 2092 00004563LIST.exe 30 PID 2092 wrote to memory of 2412 2092 00004563LIST.exe 30 PID 2092 wrote to memory of 2412 2092 00004563LIST.exe 30 PID 2092 wrote to memory of 2412 2092 00004563LIST.exe 30 PID 2412 wrote to memory of 2812 2412 anaboly.exe 31 PID 2412 wrote to memory of 2812 2412 anaboly.exe 31 PID 2412 wrote to memory of 2812 2412 anaboly.exe 31 PID 2412 wrote to memory of 2812 2412 anaboly.exe 31 PID 2412 wrote to memory of 2812 2412 anaboly.exe 31 PID 2812 wrote to memory of 2240 2812 svchost.exe 32 PID 2812 wrote to memory of 2240 2812 svchost.exe 32 PID 2812 wrote to memory of 2240 2812 svchost.exe 32 PID 2812 wrote to memory of 2240 2812 svchost.exe 32 PID 2812 wrote to memory of 2240 2812 svchost.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\00004563LIST.exe"C:\Users\Admin\AppData\Local\Temp\00004563LIST.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\exhilaratingly\anaboly.exe"C:\Users\Admin\AppData\Local\Temp\00004563LIST.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\00004563LIST.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\System32\svchost.exe4⤵PID:2240
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD56bbe4822f897346e2ebe3f9460a7e73d
SHA113c631218b516eb28a14f320438a5485b138a16c
SHA25667fbe8329d7361d63e1c26af5207daeb0f1c0750bac56526c0c43a3492b9f71d
SHA5125751bc015ab3669ea6da9c5010673738554b6fae5c3a9942b71c6915e3195d94a54c0a3ba7d864ba3af64bcf0686114724611b73709574088b7b07094c513943