Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
18-12-2024 20:01
Behavioral task
behavioral1
Sample
WaveSourceInstaller.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
17 signatures
150 seconds
General
-
Target
WaveSourceInstaller.exe
-
Size
469KB
-
MD5
e468b718e67495ea73c85d8258059adf
-
SHA1
dcad70f5c39ab85f900ef1288067dbf51eaeb503
-
SHA256
fa9f629254a8bbe915bbd587c0c060de580a18992103858a1d16686de8bd717e
-
SHA512
b4eb6cc848b5ebfc6bab7e1cc033ec468bc8cf2fed72ea912f9fc60d6eaab75664f4627646960dccab2aceefeab9c5acbd2fe1b57d992c62358929b4d840dedb
-
SSDEEP
12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSJn9:uiLJbpI7I2WhQqZ7J9
Score
10/10
Malware Config
Extracted
Family
remcos
Botnet
WaveSourceLeaked
C2
204.10.194.175:4444
Attributes
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-46FS9Q
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation WaveSourceInstaller.exe Key value queried \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\Control Panel\International\Geo\Nation WScript.exe -
Executes dropped EXE 1 IoCs
pid Process 4420 remcos.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" WaveSourceInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" WaveSourceInstaller.exe Set value (str) \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" remcos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" remcos.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4420 set thread context of 2112 4420 remcos.exe 85 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaveSourceInstaller.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings WaveSourceInstaller.exe Key created \REGISTRY\USER\S-1-5-21-114766061-2901990051-2372745435-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4420 remcos.exe 4420 remcos.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3084 taskmgr.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4420 remcos.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3084 taskmgr.exe Token: SeSystemProfilePrivilege 3084 taskmgr.exe Token: SeCreateGlobalPrivilege 3084 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe 3084 taskmgr.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 3068 wrote to memory of 4688 3068 WaveSourceInstaller.exe 80 PID 3068 wrote to memory of 4688 3068 WaveSourceInstaller.exe 80 PID 3068 wrote to memory of 4688 3068 WaveSourceInstaller.exe 80 PID 4688 wrote to memory of 1912 4688 WScript.exe 82 PID 4688 wrote to memory of 1912 4688 WScript.exe 82 PID 4688 wrote to memory of 1912 4688 WScript.exe 82 PID 1912 wrote to memory of 4420 1912 cmd.exe 84 PID 1912 wrote to memory of 4420 1912 cmd.exe 84 PID 1912 wrote to memory of 4420 1912 cmd.exe 84 PID 4420 wrote to memory of 2112 4420 remcos.exe 85 PID 4420 wrote to memory of 2112 4420 remcos.exe 85 PID 4420 wrote to memory of 2112 4420 remcos.exe 85 PID 4420 wrote to memory of 2112 4420 remcos.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\WaveSourceInstaller.exe"C:\Users\Admin\AppData\Local\Temp\WaveSourceInstaller.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Remcos\remcos.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\ProgramData\Remcos\remcos.exeC:\ProgramData\Remcos\remcos.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"5⤵PID:2112
-
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3084
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4704
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
469KB
MD5e468b718e67495ea73c85d8258059adf
SHA1dcad70f5c39ab85f900ef1288067dbf51eaeb503
SHA256fa9f629254a8bbe915bbd587c0c060de580a18992103858a1d16686de8bd717e
SHA512b4eb6cc848b5ebfc6bab7e1cc033ec468bc8cf2fed72ea912f9fc60d6eaab75664f4627646960dccab2aceefeab9c5acbd2fe1b57d992c62358929b4d840dedb
-
Filesize
386B
MD51ec6289c6fd4c2ded6b2836ed28cbeb5
SHA1c4e08195e6c640eb8860acc03fda1d649b4fe070
SHA2566efdc40f9eb217f879607614e928b65bff759e424f3efb31faceb2a043c32dc2
SHA51220bc46f4dee22f75f15c402c7c2eaee60fff7dd92548050585571dcbefd59485cc249c06bc3f1aac7a138e5ae67c0c3918b46ffa24c8b0f1b092e2f6b6e21288