Analysis
-
max time kernel
143s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 09:34
Static task
static1
Behavioral task
behavioral1
Sample
payment slip..exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
payment slip..exe
Resource
win10v2004-20241007-en
General
-
Target
payment slip..exe
-
Size
1.1MB
-
MD5
87b1f43499fb88d1971cf2eaf8409cf5
-
SHA1
65013ee9162f40b51049c81f0d5ab8c7971f2ba8
-
SHA256
ae5c7c5f680e962071211f744fac2af5ad9a508ffe60f4bd747e885f017fbeae
-
SHA512
4c3e45ddcba1fc08fd250ba37b02cf50ad0259cea0c1177955de5346838fae30ddd16a37abf5c4d3a90bd4ed9f083debb860e1147c1dbe3564846e21e817c28c
-
SSDEEP
24576:8zcj2wPT+b1WEHsOzj4j85M1hUQDAxzJX4cJeZ:4Av411sOzj4jGM1aK4FX
Malware Config
Extracted
remcos
wire 18/12
teebro1800.dynamic-dns.net:2195
teewire.ydns.eu:2195
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-X4SWKO
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Executes dropped EXE 1 IoCs
pid Process 3064 chrome.exe -
Loads dropped DLL 2 IoCs
pid Process 2620 cmd.exe 2620 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\chrome.exe" reg.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chrome.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language payment slip..exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2012 PING.EXE 2620 cmd.exe 2592 PING.EXE 612 PING.EXE 2760 cmd.exe -
Runs ping.exe 1 TTPs 3 IoCs
pid Process 2012 PING.EXE 2592 PING.EXE 612 PING.EXE -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2636 payment slip..exe 2636 payment slip..exe 2636 payment slip..exe 2636 payment slip..exe 2636 payment slip..exe 2636 payment slip..exe 3064 chrome.exe 3064 chrome.exe 3064 chrome.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2636 payment slip..exe Token: SeDebugPrivilege 3064 chrome.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2760 2636 payment slip..exe 30 PID 2636 wrote to memory of 2760 2636 payment slip..exe 30 PID 2636 wrote to memory of 2760 2636 payment slip..exe 30 PID 2636 wrote to memory of 2760 2636 payment slip..exe 30 PID 2760 wrote to memory of 2012 2760 cmd.exe 32 PID 2760 wrote to memory of 2012 2760 cmd.exe 32 PID 2760 wrote to memory of 2012 2760 cmd.exe 32 PID 2760 wrote to memory of 2012 2760 cmd.exe 32 PID 2636 wrote to memory of 2620 2636 payment slip..exe 34 PID 2636 wrote to memory of 2620 2636 payment slip..exe 34 PID 2636 wrote to memory of 2620 2636 payment slip..exe 34 PID 2636 wrote to memory of 2620 2636 payment slip..exe 34 PID 2620 wrote to memory of 2592 2620 cmd.exe 36 PID 2620 wrote to memory of 2592 2620 cmd.exe 36 PID 2620 wrote to memory of 2592 2620 cmd.exe 36 PID 2620 wrote to memory of 2592 2620 cmd.exe 36 PID 2760 wrote to memory of 2804 2760 cmd.exe 37 PID 2760 wrote to memory of 2804 2760 cmd.exe 37 PID 2760 wrote to memory of 2804 2760 cmd.exe 37 PID 2760 wrote to memory of 2804 2760 cmd.exe 37 PID 2620 wrote to memory of 612 2620 cmd.exe 38 PID 2620 wrote to memory of 612 2620 cmd.exe 38 PID 2620 wrote to memory of 612 2620 cmd.exe 38 PID 2620 wrote to memory of 612 2620 cmd.exe 38 PID 2620 wrote to memory of 3064 2620 cmd.exe 39 PID 2620 wrote to memory of 3064 2620 cmd.exe 39 PID 2620 wrote to memory of 3064 2620 cmd.exe 39 PID 2620 wrote to memory of 3064 2620 cmd.exe 39 PID 3064 wrote to memory of 2792 3064 chrome.exe 40 PID 3064 wrote to memory of 2792 3064 chrome.exe 40 PID 3064 wrote to memory of 2792 3064 chrome.exe 40 PID 3064 wrote to memory of 2792 3064 chrome.exe 40 PID 3064 wrote to memory of 2792 3064 chrome.exe 40 PID 3064 wrote to memory of 2792 3064 chrome.exe 40 PID 3064 wrote to memory of 2792 3064 chrome.exe 40 PID 3064 wrote to memory of 2792 3064 chrome.exe 40 PID 3064 wrote to memory of 2792 3064 chrome.exe 40 PID 3064 wrote to memory of 2792 3064 chrome.exe 40 PID 3064 wrote to memory of 2792 3064 chrome.exe 40 PID 3064 wrote to memory of 2792 3064 chrome.exe 40 PID 3064 wrote to memory of 2792 3064 chrome.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\payment slip..exe"C:\Users\Admin\AppData\Local\Temp\payment slip..exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 38 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "chrome" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chrome.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 383⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2012
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "chrome" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chrome.exe"3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2804
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 39 > nul && copy "C:\Users\Admin\AppData\Local\Temp\payment slip..exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chrome.exe" && ping 127.0.0.1 -n 39 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chrome.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 393⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2592
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 393⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:612
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chrome.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\chrome.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"4⤵PID:2792
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD587b1f43499fb88d1971cf2eaf8409cf5
SHA165013ee9162f40b51049c81f0d5ab8c7971f2ba8
SHA256ae5c7c5f680e962071211f744fac2af5ad9a508ffe60f4bd747e885f017fbeae
SHA5124c3e45ddcba1fc08fd250ba37b02cf50ad0259cea0c1177955de5346838fae30ddd16a37abf5c4d3a90bd4ed9f083debb860e1147c1dbe3564846e21e817c28c