Analysis
-
max time kernel
115s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 03:37
Static task
static1
Behavioral task
behavioral1
Sample
88586521287a64331eb275b700110ff4fae5884e8a62655fe88cae71d59cb73cN.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
88586521287a64331eb275b700110ff4fae5884e8a62655fe88cae71d59cb73cN.exe
Resource
win10v2004-20241007-en
General
-
Target
88586521287a64331eb275b700110ff4fae5884e8a62655fe88cae71d59cb73cN.exe
-
Size
140KB
-
MD5
26ef5428d0ca17146002a3cea5b96810
-
SHA1
c2e9289ff3932e602884ce4d1f03f0fde8c2e67a
-
SHA256
88586521287a64331eb275b700110ff4fae5884e8a62655fe88cae71d59cb73c
-
SHA512
795bdcb328f09ff8c1f5f2934fd104c8865f1ac744bac01d988def996ce7a521139d8a686bb7bd8f6ceda74891ab560c96b86d09f0fc62ca6f98d003b0758c77
-
SSDEEP
3072:xPd4n/M+WLcilrpgGH/GwY87mVmIXhIHVSJ:xP6/M+WLckOBhVmIYI
Malware Config
Extracted
remcos
1.7 Pro
Host
systemcontrol.ddns.net:45000
systemcontrol2.ddns.net:45000
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
OfficeUpgrade.exe
-
copy_folder
OfficeUpgrade
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
Upgrader.dat
-
keylog_flag
false
-
keylog_folder
Upgrader
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
req_khauflaoyr
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
OfficeUpgrade
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Executes dropped EXE 2 IoCs
pid Process 2720 wn2ra4ohzdr.exe 2576 wn2ra4ohzdr.exe -
Loads dropped DLL 1 IoCs
pid Process 2944 88586521287a64331eb275b700110ff4fae5884e8a62655fe88cae71d59cb73cN.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\raj4dkhhiap = "C:\\Users\\Admin\\AppData\\Roaming\\raj4dkhhiap\\wn2ra4ohzdr.exe" 88586521287a64331eb275b700110ff4fae5884e8a62655fe88cae71d59cb73cN.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2720 set thread context of 2576 2720 wn2ra4ohzdr.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88586521287a64331eb275b700110ff4fae5884e8a62655fe88cae71d59cb73cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wn2ra4ohzdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wn2ra4ohzdr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2576 wn2ra4ohzdr.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2944 wrote to memory of 2720 2944 88586521287a64331eb275b700110ff4fae5884e8a62655fe88cae71d59cb73cN.exe 30 PID 2944 wrote to memory of 2720 2944 88586521287a64331eb275b700110ff4fae5884e8a62655fe88cae71d59cb73cN.exe 30 PID 2944 wrote to memory of 2720 2944 88586521287a64331eb275b700110ff4fae5884e8a62655fe88cae71d59cb73cN.exe 30 PID 2944 wrote to memory of 2720 2944 88586521287a64331eb275b700110ff4fae5884e8a62655fe88cae71d59cb73cN.exe 30 PID 2720 wrote to memory of 2576 2720 wn2ra4ohzdr.exe 31 PID 2720 wrote to memory of 2576 2720 wn2ra4ohzdr.exe 31 PID 2720 wrote to memory of 2576 2720 wn2ra4ohzdr.exe 31 PID 2720 wrote to memory of 2576 2720 wn2ra4ohzdr.exe 31 PID 2720 wrote to memory of 2576 2720 wn2ra4ohzdr.exe 31 PID 2720 wrote to memory of 2576 2720 wn2ra4ohzdr.exe 31 PID 2720 wrote to memory of 2576 2720 wn2ra4ohzdr.exe 31 PID 2720 wrote to memory of 2576 2720 wn2ra4ohzdr.exe 31 PID 2720 wrote to memory of 2576 2720 wn2ra4ohzdr.exe 31 PID 2720 wrote to memory of 2576 2720 wn2ra4ohzdr.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\88586521287a64331eb275b700110ff4fae5884e8a62655fe88cae71d59cb73cN.exe"C:\Users\Admin\AppData\Local\Temp\88586521287a64331eb275b700110ff4fae5884e8a62655fe88cae71d59cb73cN.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2576
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
140KB
MD58329081c1a1b90cfd052330f631eb1d6
SHA1c754a6bde7b565b3cef79a1d0af124c58beca29d
SHA256007b86d95e19cbacca81c2718dc84094180579a0f4961e8f30389cbe08821cd8
SHA5128867d3647141a19a787165a34c17ced9918da6ad7b4d52e2046d7af36ba2c2b8542843f8194598561fafb9d1a47cf70f44fe8eb056c3be39ef57513552c7a514