Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 19:54
Static task
static1
Behavioral task
behavioral1
Sample
136ef22d5bfdda144756cd42f15a285b46af11a95f823bfe13f7993c72e23e94.exe
Resource
win7-20240903-en
General
-
Target
136ef22d5bfdda144756cd42f15a285b46af11a95f823bfe13f7993c72e23e94.exe
-
Size
1020KB
-
MD5
cf267581be8473ea55c73b833a6e0dad
-
SHA1
b1c43239677655b821f290dbbf1be560fbbeaca9
-
SHA256
136ef22d5bfdda144756cd42f15a285b46af11a95f823bfe13f7993c72e23e94
-
SHA512
3d65fb0a6536977dc30a545b018f02ebd6be27c3f4da34fac6ed55716ff83996e9f493f2497ce6f8b8e0a71a84c7b79dad3f4e3ca40e84b723bdda4592583938
-
SSDEEP
12288:1feDOa9rDeYSorINpj5XqkJD0QrOod7XxlW91RRep+rgRNyA55IxJ2DWzzY8:ED39v74lfGQrFUspugRNJI2DWzz9
Malware Config
Extracted
remcos
Host
213.183.58.19:4000
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
read.dat
-
keylog_flag
false
-
keylog_folder
CastC
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_sccafsoidz
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Executes dropped EXE 2 IoCs
pid Process 2724 sbietrcl.exe 532 sbietrcl.exe -
Loads dropped DLL 1 IoCs
pid Process 2668 136ef22d5bfdda144756cd42f15a285b46af11a95f823bfe13f7993c72e23e94.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\sbietrcl.exe" 136ef22d5bfdda144756cd42f15a285b46af11a95f823bfe13f7993c72e23e94.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2724 set thread context of 532 2724 sbietrcl.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 136ef22d5bfdda144756cd42f15a285b46af11a95f823bfe13f7993c72e23e94.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sbietrcl.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2668 136ef22d5bfdda144756cd42f15a285b46af11a95f823bfe13f7993c72e23e94.exe 2668 136ef22d5bfdda144756cd42f15a285b46af11a95f823bfe13f7993c72e23e94.exe 2668 136ef22d5bfdda144756cd42f15a285b46af11a95f823bfe13f7993c72e23e94.exe 2668 136ef22d5bfdda144756cd42f15a285b46af11a95f823bfe13f7993c72e23e94.exe 2668 136ef22d5bfdda144756cd42f15a285b46af11a95f823bfe13f7993c72e23e94.exe 2668 136ef22d5bfdda144756cd42f15a285b46af11a95f823bfe13f7993c72e23e94.exe 2724 sbietrcl.exe 2724 sbietrcl.exe 2724 sbietrcl.exe 2724 sbietrcl.exe 2724 sbietrcl.exe 2724 sbietrcl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2668 136ef22d5bfdda144756cd42f15a285b46af11a95f823bfe13f7993c72e23e94.exe Token: SeDebugPrivilege 2724 sbietrcl.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2668 wrote to memory of 2724 2668 136ef22d5bfdda144756cd42f15a285b46af11a95f823bfe13f7993c72e23e94.exe 30 PID 2668 wrote to memory of 2724 2668 136ef22d5bfdda144756cd42f15a285b46af11a95f823bfe13f7993c72e23e94.exe 30 PID 2668 wrote to memory of 2724 2668 136ef22d5bfdda144756cd42f15a285b46af11a95f823bfe13f7993c72e23e94.exe 30 PID 2668 wrote to memory of 2724 2668 136ef22d5bfdda144756cd42f15a285b46af11a95f823bfe13f7993c72e23e94.exe 30 PID 2724 wrote to memory of 532 2724 sbietrcl.exe 31 PID 2724 wrote to memory of 532 2724 sbietrcl.exe 31 PID 2724 wrote to memory of 532 2724 sbietrcl.exe 31 PID 2724 wrote to memory of 532 2724 sbietrcl.exe 31 PID 2724 wrote to memory of 532 2724 sbietrcl.exe 31 PID 2724 wrote to memory of 532 2724 sbietrcl.exe 31 PID 2724 wrote to memory of 532 2724 sbietrcl.exe 31 PID 2724 wrote to memory of 532 2724 sbietrcl.exe 31 PID 2724 wrote to memory of 532 2724 sbietrcl.exe 31 PID 2724 wrote to memory of 532 2724 sbietrcl.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\136ef22d5bfdda144756cd42f15a285b46af11a95f823bfe13f7993c72e23e94.exe"C:\Users\Admin\AppData\Local\Temp\136ef22d5bfdda144756cd42f15a285b46af11a95f823bfe13f7993c72e23e94.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"3⤵
- Executes dropped EXE
PID:532
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cf894a4765ee019d8838bf59b50d4948
SHA1ec0144d629196cfac95014fcaeaaf6fb655b333e
SHA2562f91ab0e44abf303c638614e3e16660d772405676f22382c80331da4fe2a535f
SHA5123e994fab58999790c1cd3b471eb69ff6dd32716c4749a306e935a74a2e7ee5955f384956c24be21268bbb7a317fd26656bc36c4d348892cf1e33a02bcfbdcd0f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1.0MB
MD5b5b9a1a6877a5aa17b627b3d2850d2dc
SHA104cd9ce3fd45a48c118410451d2284911faaa4e9
SHA256aeeeab0413a5099927c968d96d360301fce74137b150f3acf82b51b463e7a2bf
SHA512bca5530d825bbf868d11a6f353f7ee9f2ecce6d30bd02307d8488e3674537a5bc3e8f160b0cc509d8d34b5f50629e8045dd3781db06e7f3af16f015a8000be51