Overview
overview
10Static
static
8Order.exe
windows7-x64
5Order.exe
windows10-2004-x64
5төлем...DF.exe
windows7-x64
10төлем...DF.exe
windows10-2004-x64
1087597.exe
windows7-x64
1087597.exe
windows10-2004-x64
1029146c1ccd...70.exe
windows7-x64
729146c1ccd...70.exe
windows10-2004-x64
72cc3b42957...8e.exe
windows7-x64
102cc3b42957...8e.exe
windows10-2004-x64
10RICHIESTA ...TA.exe
windows7-x64
10RICHIESTA ...TA.exe
windows10-2004-x64
1039c1e12e0a...25c.js
windows7-x64
339c1e12e0a...25c.js
windows10-2004-x64
33f46e10e5f...3b.exe
windows7-x64
103f46e10e5f...3b.exe
windows10-2004-x64
1053074094ad...95dbec
debian-12-mipsel
10632cfc71bd...b1.doc
windows7-x64
10632cfc71bd...b1.doc
windows10-2004-x64
10685dce7a17...03.exe
windows7-x64
10685dce7a17...03.exe
windows10-2004-x64
106c4aab4c3b...e2.exe
windows7-x64
106c4aab4c3b...e2.exe
windows10-2004-x64
1073a52a4c60...c0.exe
windows7-x64
373a52a4c60...c0.exe
windows10-2004-x64
3Inv_7623980.exe
windows7-x64
10Inv_7623980.exe
windows10-2004-x64
108954739d96...a8.ps1
windows7-x64
38954739d96...a8.ps1
windows10-2004-x64
8USD $.exe
windows7-x64
10USD $.exe
windows10-2004-x64
1091d079d937...b9.exe
windows7-x64
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 12:40
Behavioral task
behavioral1
Sample
Order.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Order.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
төлем туралы есеп#454326_PDF.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
төлем туралы есеп#454326_PDF.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
87597.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
87597.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
29146c1ccdf280c8ac9d0c861f8bd222d2d93777c8a822da4d72c64fc3f78670.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
29146c1ccdf280c8ac9d0c861f8bd222d2d93777c8a822da4d72c64fc3f78670.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
2cc3b4295747aeeb5a54b923fdbc9be766ee156c8914f5c07663f7cb1055068e.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
2cc3b4295747aeeb5a54b923fdbc9be766ee156c8914f5c07663f7cb1055068e.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
RICHIESTA DI OFFERTA.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
RICHIESTA DI OFFERTA.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
39c1e12e0ada85fa835b623a4698345bf95372bea57a7d3a5070ea1d5d5d825c.js
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
39c1e12e0ada85fa835b623a4698345bf95372bea57a7d3a5070ea1d5d5d825c.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
3f46e10e5fe376b995e2947d1be21955aa8341f39d80cca737109fcf2cf2bf3b.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
3f46e10e5fe376b995e2947d1be21955aa8341f39d80cca737109fcf2cf2bf3b.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
53074094addc55786936f3d67d7fe36554a7c4f4f96c06252ae768707295dbec
Resource
debian12-mipsel-20240221-en
Behavioral task
behavioral18
Sample
632cfc71bd4734fdd98e48166a52fbc4a48d43640f3375fd882dd374479bffb1.doc
Resource
win7-20240903-en
Behavioral task
behavioral19
Sample
632cfc71bd4734fdd98e48166a52fbc4a48d43640f3375fd882dd374479bffb1.doc
Resource
win10v2004-20241007-en
Behavioral task
behavioral20
Sample
685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe
Resource
win7-20241010-en
Behavioral task
behavioral21
Sample
685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral22
Sample
6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2.exe
Resource
win7-20240729-en
Behavioral task
behavioral23
Sample
6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral24
Sample
73a52a4c60d253ccdb79e5d50814d1689a49fd85f9e0a40a0dc57ba7fb54e5c0.exe
Resource
win7-20240903-en
Behavioral task
behavioral25
Sample
73a52a4c60d253ccdb79e5d50814d1689a49fd85f9e0a40a0dc57ba7fb54e5c0.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral26
Sample
Inv_7623980.exe
Resource
win7-20240903-en
Behavioral task
behavioral27
Sample
Inv_7623980.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral28
Sample
8954739d960eecd84aa64e657aed72d40567764023ba14e048778d0ebf24cba8.ps1
Resource
win7-20240903-en
Behavioral task
behavioral29
Sample
8954739d960eecd84aa64e657aed72d40567764023ba14e048778d0ebf24cba8.ps1
Resource
win10v2004-20241007-en
Behavioral task
behavioral30
Sample
USD $.exe
Resource
win7-20241010-en
Behavioral task
behavioral31
Sample
USD $.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral32
Sample
91d079d9371fa53227e4bb2207ba4d3aa4733feee607773b696779c5e87846b9.exe
Resource
win7-20240903-en
General
-
Target
632cfc71bd4734fdd98e48166a52fbc4a48d43640f3375fd882dd374479bffb1.doc
-
Size
9.3MB
-
MD5
aaa839e4993c07fdfba45afe8826d6bf
-
SHA1
3d00bce50c92b31c3d74d20c5451aedc6878a246
-
SHA256
632cfc71bd4734fdd98e48166a52fbc4a48d43640f3375fd882dd374479bffb1
-
SHA512
e3bca0a028a39e602b093069fb84a84ff13d7451ebaaf05dc127aa061ae7d096460133a3b8d726adedafd1dd08d09621197bf9e8747ac622bfedd909dec6f3cc
-
SSDEEP
98304:IydePKsBylarg6bY/J1ZKbTsBylarg6bY/J1ZKb2ayX0I6:IHisB2Eb01ZssB2Eb01Z820X
Malware Config
Extracted
remcos
3.1.4 Pro
RemoteHost
elninotronics.com:2404
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-E8E8J7
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
-
Remcos family
-
Executes dropped EXE 1 IoCs
pid Process 2572 openvpn-gui.exe -
Loads dropped DLL 3 IoCs
pid Process 2444 WINWORD.EXE 2572 openvpn-gui.exe 2572 openvpn-gui.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\openvpn-gui.job cmd.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language openvpn-gui.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2444 WINWORD.EXE 2444 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2572 openvpn-gui.exe 2860 notepad.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2860 notepad.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2444 WINWORD.EXE 2444 WINWORD.EXE 2444 WINWORD.EXE 2444 WINWORD.EXE 2444 WINWORD.EXE 2444 WINWORD.EXE 2444 WINWORD.EXE 2444 WINWORD.EXE 2444 WINWORD.EXE 2572 openvpn-gui.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103 PID 2572 wrote to memory of 2860 2572 openvpn-gui.exe 103
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\632cfc71bd4734fdd98e48166a52fbc4a48d43640f3375fd882dd374479bffb1.doc" /o ""1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2444
-
C:\Users\Admin\AppData\Local\Adobe\openvpn-gui.exe"C:\Users\Admin\AppData\Local\Adobe\openvpn-gui.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2860 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3776
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.9MB
MD567389b7169dbec76a9a11d8570896f4f
SHA1b9083a4f76911d2ab03b1e3fa2eaa7518e2e8928
SHA256d65ea87824e597d3025d6beb12cc3816a98fb34125628120abf7dc3fc73d0e39
SHA5123a095f630d3c68e0af6ae0f4c469db33c90eb537edefd83f1b054241ed43ed2afe1a2c34a693cd81388f8edae693890f2bb6b9b81a1f9adca841eb05b8abb342
-
Filesize
45KB
MD587390e37e36622b054d4bdcbb7997b6c
SHA14d591f310318fd95a95109d7965a79729b65c69e
SHA2565f067f86ad0f88a629263162810bf5052f5ebbd97d5d0de936311bb44c9f35e7
SHA512285abb19138a5dd109dfc0e76f4a4f96b3731a84ca9229e6ef9315513b052fd7ad7b2e0392ac9becbf4caf2c9bbdbd87f5b66486fb2ae1385c1fbe6e1ed643dd
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
29KB
MD5f7092de5f32c0df837fa7f947a3424af
SHA1acc8123288c20b1c4ae67ef4f2b4028d9153239c
SHA25697adb1700858b74f456f5cf681b0421d0be50e3aed1adea3d1b9694295723700
SHA512f10d5c86a85d3d8be56fb5066fddd0474c71a36f280f475f4e3d6cc939718647f493665c4c9ea00c3d60f22f172019e2082c7090b54f730d02701f1cb3d34164
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD5fbd767bcf65f3bd1a7c82fe8d72e845a
SHA10f4f9fee765638c83bd226303338d1e438480cae
SHA256dd8e3862dc1542f7ac6fc083a978e00e5a1d60f5b53352f066cfc7039e9645fd
SHA51227c761beb47ae5da2e8b45e303efb5c0459c505d069b9158b010a99186bb812fa1ba5bdd1e23af49f23529779cca35baf859547778f807dd052c2abafc6c1e01