Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
29-12-2024 03:02
Static task
static1
Behavioral task
behavioral1
Sample
Document.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
Document.exe
Resource
win10v2004-20241007-en
General
-
Target
Document.exe
-
Size
715KB
-
MD5
198ec1f69b5a33f3cc86502a1eed6d3b
-
SHA1
c8cfb04f36d1d819538f080c7e158987114c2602
-
SHA256
3ff0c7aa1953da8ec564575b0200453a7a0da774072b12fb1672f38aeef2b770
-
SHA512
f96160f0e33226737559d6d28d60c1e5fefbd87656f76d0755ddf501935da6ed649b6fffd766ebde84bf6676be055beeb52bd2753235438b00c2528f016add2c
-
SSDEEP
12288:HcELQF69pTfJghb83Ox3gNQ4z2wrnS6vbP5y0ZdG8T39G/sYEw2Vy:H5fp0l3Pk2J4bo+dpw2
Malware Config
Extracted
remcos
3.3.0 Pro
RemoteHost
salford1.ddns.net:2404
salford2.ddns.net:2404
salford3.ddns.net:2404
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-56OLZQ
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
-
Remcos family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2948 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2604 set thread context of 2808 2604 Document.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Document.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2872 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2604 Document.exe 2604 Document.exe 2948 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2604 Document.exe Token: SeDebugPrivilege 2948 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2808 Document.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2604 wrote to memory of 2948 2604 Document.exe 31 PID 2604 wrote to memory of 2948 2604 Document.exe 31 PID 2604 wrote to memory of 2948 2604 Document.exe 31 PID 2604 wrote to memory of 2948 2604 Document.exe 31 PID 2604 wrote to memory of 2872 2604 Document.exe 33 PID 2604 wrote to memory of 2872 2604 Document.exe 33 PID 2604 wrote to memory of 2872 2604 Document.exe 33 PID 2604 wrote to memory of 2872 2604 Document.exe 33 PID 2604 wrote to memory of 2808 2604 Document.exe 34 PID 2604 wrote to memory of 2808 2604 Document.exe 34 PID 2604 wrote to memory of 2808 2604 Document.exe 34 PID 2604 wrote to memory of 2808 2604 Document.exe 34 PID 2604 wrote to memory of 2808 2604 Document.exe 34 PID 2604 wrote to memory of 2808 2604 Document.exe 34 PID 2604 wrote to memory of 2808 2604 Document.exe 34 PID 2604 wrote to memory of 2808 2604 Document.exe 34 PID 2604 wrote to memory of 2808 2604 Document.exe 34 PID 2604 wrote to memory of 2808 2604 Document.exe 34 PID 2604 wrote to memory of 2808 2604 Document.exe 34 PID 2604 wrote to memory of 2808 2604 Document.exe 34 PID 2604 wrote to memory of 2808 2604 Document.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\Document.exe"C:\Users\Admin\AppData\Local\Temp\Document.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Document.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2948
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hlzimEOLBqvkW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3811.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2872
-
-
C:\Users\Admin\AppData\Local\Temp\Document.exe"C:\Users\Admin\AppData\Local\Temp\Document.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:2808
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148B
MD5ab833bdd3e8212c09e8006ce050cdb3e
SHA1b5337f2f495082c0732cb10587238d5bbebffdde
SHA256bd120877501218950181f374eca45efcd55159c719a845e26ece793f8729bf8d
SHA512c89b9987df226f1661781331f74846480e3148f1f5bbb0169b82f58501b34a4f4c082d2b4598fe4963f1077fefe33bbe96eab1c81b15d8d401e7de0ef863039a