Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
30-12-2024 00:05
Behavioral task
behavioral1
Sample
4492030951.exe
Resource
win7-20240729-en
General
-
Target
4492030951.exe
-
Size
463KB
-
MD5
56cf2e34e8c4b39d3ecb18935a1e96df
-
SHA1
d7cddc46a566dffff1a808526f48c96ef4b64302
-
SHA256
e1bd512161ccc65e6dd85edda13d9b97d96867d8c45dbce407f7455d8f12a90c
-
SHA512
387bb997d64d5d6c38b5e9854ad595860bb482eab3df7064676fbccb8943326dbc9b8166d412d5750a7792ea6eb9f35526b8f7e76f811dd4bcf2ac3fc66ccc2c
-
SSDEEP
12288:uegN0jfYLclGb0bVT6e+MT2MffZS/ghSYo:QNywLclGIeMT2MXZRhSV
Malware Config
Extracted
remcos
3.3.2 Pro
Luder
31.220.44.253:5222
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
true
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%UserProfile%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
h908hn+0938g3-Y4186N
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
svchost
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
-
Remcos family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Deletes itself 1 IoCs
pid Process 2800 WScript.exe -
Executes dropped EXE 1 IoCs
pid Process 3020 remcos.exe -
Loads dropped DLL 2 IoCs
pid Process 2808 cmd.exe 2808 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\remcos\\remcos.exe\"" 4492030951.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\remcos\\remcos.exe\"" remcos.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3020 set thread context of 2056 3020 remcos.exe 39 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4492030951.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry key 1 TTPs 2 IoCs
pid Process 2732 reg.exe 2584 reg.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2672 2188 4492030951.exe 30 PID 2188 wrote to memory of 2672 2188 4492030951.exe 30 PID 2188 wrote to memory of 2672 2188 4492030951.exe 30 PID 2188 wrote to memory of 2672 2188 4492030951.exe 30 PID 2672 wrote to memory of 2732 2672 cmd.exe 32 PID 2672 wrote to memory of 2732 2672 cmd.exe 32 PID 2672 wrote to memory of 2732 2672 cmd.exe 32 PID 2672 wrote to memory of 2732 2672 cmd.exe 32 PID 2188 wrote to memory of 2800 2188 4492030951.exe 33 PID 2188 wrote to memory of 2800 2188 4492030951.exe 33 PID 2188 wrote to memory of 2800 2188 4492030951.exe 33 PID 2188 wrote to memory of 2800 2188 4492030951.exe 33 PID 2800 wrote to memory of 2808 2800 WScript.exe 34 PID 2800 wrote to memory of 2808 2800 WScript.exe 34 PID 2800 wrote to memory of 2808 2800 WScript.exe 34 PID 2800 wrote to memory of 2808 2800 WScript.exe 34 PID 2808 wrote to memory of 3020 2808 cmd.exe 36 PID 2808 wrote to memory of 3020 2808 cmd.exe 36 PID 2808 wrote to memory of 3020 2808 cmd.exe 36 PID 2808 wrote to memory of 3020 2808 cmd.exe 36 PID 3020 wrote to memory of 2764 3020 remcos.exe 37 PID 3020 wrote to memory of 2764 3020 remcos.exe 37 PID 3020 wrote to memory of 2764 3020 remcos.exe 37 PID 3020 wrote to memory of 2764 3020 remcos.exe 37 PID 3020 wrote to memory of 2056 3020 remcos.exe 39 PID 3020 wrote to memory of 2056 3020 remcos.exe 39 PID 3020 wrote to memory of 2056 3020 remcos.exe 39 PID 3020 wrote to memory of 2056 3020 remcos.exe 39 PID 3020 wrote to memory of 2056 3020 remcos.exe 39 PID 3020 wrote to memory of 2056 3020 remcos.exe 39 PID 2764 wrote to memory of 2584 2764 cmd.exe 40 PID 2764 wrote to memory of 2584 2764 cmd.exe 40 PID 2764 wrote to memory of 2584 2764 cmd.exe 40 PID 2764 wrote to memory of 2584 2764 cmd.exe 40 PID 3020 wrote to memory of 2056 3020 remcos.exe 39 PID 3020 wrote to memory of 2056 3020 remcos.exe 39 PID 3020 wrote to memory of 2056 3020 remcos.exe 39 PID 3020 wrote to memory of 2056 3020 remcos.exe 39 PID 3020 wrote to memory of 2056 3020 remcos.exe 39 PID 3020 wrote to memory of 2056 3020 remcos.exe 39 PID 3020 wrote to memory of 2056 3020 remcos.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\4492030951.exe"C:\Users\Admin\AppData\Local\Temp\4492030951.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2732
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\remcos\remcos.exe"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\remcos\remcos.exeC:\Users\Admin\remcos\remcos.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f6⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2584
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe5⤵PID:2056
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
518B
MD5041f69d38a1a0ba68bd17bd7f14a64a2
SHA1e67f0e3a465ec9896aa8feb4ed46a5dc235d67db
SHA25619ba1d8894f20c95629c17fbbae7c3a8e3275f7bb21c8a9ec1d7a8e1a4c162a3
SHA512dcea0330d73c3fe0b3504594a673beb78e870533efb6509a90d35e66870e195ddb2eb9341ccc9badb839e0e0f7fd7763e9365539c1db5693e7dfe5e18187c347
-
Filesize
463KB
MD556cf2e34e8c4b39d3ecb18935a1e96df
SHA1d7cddc46a566dffff1a808526f48c96ef4b64302
SHA256e1bd512161ccc65e6dd85edda13d9b97d96867d8c45dbce407f7455d8f12a90c
SHA512387bb997d64d5d6c38b5e9854ad595860bb482eab3df7064676fbccb8943326dbc9b8166d412d5750a7792ea6eb9f35526b8f7e76f811dd4bcf2ac3fc66ccc2c