Analysis
-
max time kernel
95s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-es -
resource tags
arch:x64arch:x86image:win10v2004-20241007-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
20-12-2024 16:32
Static task
static1
Behavioral task
behavioral1
Sample
DEMANDA LABORAL JUDICIAL 16524515/CiscoSparkLauncher.dll
Resource
win10v2004-20241007-es
Behavioral task
behavioral2
Sample
DEMANDA LABORAL JUDICIAL 16524515/DEMANDA LABORAL JUDICIAL 2313154.exe
Resource
win10v2004-20241007-es
Behavioral task
behavioral3
Sample
DEMANDA LABORAL JUDICIAL 16524515/VERSION.dll
Resource
win10v2004-20241007-es
General
-
Target
DEMANDA LABORAL JUDICIAL 16524515/CiscoSparkLauncher.dll
-
Size
2.6MB
-
MD5
e2e01305e938ea378a88658d81c0917f
-
SHA1
6b3dc7e13347f6fadadc2dbac7d3a3927d9e2aa6
-
SHA256
29c3c48f4dc84e7179881bc3767546878b2db89d418372f687edbd4a72ef0989
-
SHA512
5620ea58d2a7da0fe5d352ea1fe82e76ed84c31b2ae97b28a3ab3b25268f21c0a8eef8ca7baa05ab0f2c80a8125fc7e2441065eda11259b1f636be7b3d6c202d
-
SSDEEP
49152:aGtlqOIU6iJVwASOcO81WPz3qjFr6t1Dt+w+PpmtsHcFhKgwzfQHdPWkpRs6:m+18rcDINHAhKQH8S
Malware Config
Extracted
remcos
RemoteHost
december02.kozow.com:5151
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-O92SE5
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 1500 svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings svchost.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1336 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 656 Process not Found 656 Process not Found -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1708 wrote to memory of 3824 1708 rundll32.exe 82 PID 1708 wrote to memory of 3824 1708 rundll32.exe 82 PID 3824 wrote to memory of 1336 3824 cmd.exe 84 PID 3824 wrote to memory of 1336 3824 cmd.exe 84 PID 1708 wrote to memory of 1500 1708 rundll32.exe 85 PID 1708 wrote to memory of 1500 1708 rundll32.exe 85 PID 1708 wrote to memory of 1500 1708 rundll32.exe 85 PID 1500 wrote to memory of 1100 1500 svchost.exe 93 PID 1500 wrote to memory of 1100 1500 svchost.exe 93 PID 1500 wrote to memory of 1100 1500 svchost.exe 93 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\DEMANDA LABORAL JUDICIAL 16524515\CiscoSparkLauncher.dll",#11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn "Yt4Bvc2G" /tr "C:\Users\Admin\AppData\Roaming\rundll32.exe" /sc onlogon /rl highest /f2⤵
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Windows\system32\schtasks.exeschtasks /create /tn "Yt4Bvc2G" /tr "C:\Users\Admin\AppData\Roaming\rundll32.exe" /sc onlogon /rl highest /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:1336
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\mgfuvrirlw.vbs"3⤵
- System Location Discovery: System Language Discovery
PID:1100
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
500B
MD5f1da013fa58295ac94372331e618f047
SHA1b52f602bca7d2b9a04a55be4a1a4de857c98cbdb
SHA25601df7d7ec8acb49f038a93cf1aeb9a79ddda138fa38992f477e6448689c09cd9
SHA512fc1cfb5f09b5d96958d9387f582629e6691e996890ea345466fc47e214be074c9c625f3fb7f4e86d7e5b9864edcfe0d40031e6a0d6c496c5427d21bcffba26a8
-
Filesize
481KB
MD534e7858467bd37a5fe1b75dcd73bdf19
SHA160677610b2c666cca1c212b66441231cea964434
SHA25611cdb65e5b007e249a51a7410da0653ec6c6b28f68b33e1de88ac3989dd745d6
SHA512bb6ea5a30f6060dd68ef51a3cfcff76a20337155eb3ac95a0fdd19240782d07d947046788833983483908728f7f119fc858930ba9d80b823f7e3582054824ac9