Overview

overview

10

Static

static

3

Remcos Pro...22.zip

windows11-21h2-x64

Analysis

  • max time kernel
    192s
  • max time network
    197s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03-01-2025 19:05

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    Remcos Professional Cracked By Alcatraz3222.zip

  • Size

    17.3MB

  • MD5

    ea3fd7407073aae0205a02f10c1f826f

  • SHA1

    aeb5a674da5bbdea4e1b42470e6e059b730b88a6

  • SHA256

    bdb96b7a1a75fa4f56d1b1f922d80f029c12df21df49cbbfd1f2a3175d604195

  • SHA512

    bf69f80a585eed54b599cb5adf285ca0576650b275daef6e502eae2d564906950cb4a13821b67325bc1c2ba0ca6436401f562c279cc42d3590e0f8becfec028f

  • SSDEEP

    393216:2+Y8LpIcxbEWd4rSrwcJY2sG1l/TTwizV1iBLzCoa+++OvPrTy:/yMwWqrXc+G1l7TwiRI9z8++TTy

Score
10/10
njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

dllsys.duckdns.org:3202

Mutex

3b570ffeeb3d34249b9a5ce0ee58a328

Attributes
  • reg_key

    3b570ffeeb3d34249b9a5ce0ee58a328

  • splitter

    svchost

Signatures

  • Njrat family
    njrat
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Executes dropped EXE 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 20 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222.zip"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2124
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4588
    • C:\Users\Admin\Desktop\Remcos Professional Cracked By Alcatraz3222\Remcos Professional Cracked By Alcatraz3222.exe
      "C:\Users\Admin\Desktop\Remcos Professional Cracked By Alcatraz3222\Remcos Professional Cracked By Alcatraz3222.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2500
      • C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222.exe
        "C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:616
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/Desktop/Remcos Professional Cracked By Alcatraz3222/Remcos Professional Cracked By Alcatraz3222.exe" "%temp%\Profile Remcos\Update_Lock_Remcos.exe" /Y
        2⤵
        • System Location Discovery: System Language Discovery
        PID:3764
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\Profile Remcos\Update_Lock_Remcos.exe.lnk" /f
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1504
        • C:\Windows\SysWOW64\reg.exe
          reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Profile Remcos\Update_Lock_Remcos.exe.lnk" /f
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3448
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\Profile Remcos\Update_Lock_Remcos.exe:Zone.Identifier
        2⤵
        • System Location Discovery: System Language Discovery
        PID:3056
      • C:\Users\Admin\AppData\Local\Temp\taskhost.exe
        "C:\Users\Admin\AppData\Local\Temp\taskhost.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4208
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\taskhost.exe" "taskhost.exe" ENABLE
          3⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:4516
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4028
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:916
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:1980
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x4 /state0:0xa3a08855 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:1612

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222.exe
      Filesize

      17.4MB

      MD5

      c3c21fa4c2186deb641455482ab0d3aa

      SHA1

      2f4b49e8383e073ccb965943ce970de403412567

      SHA256

      4ea203509d0fdff3e31f976413c546ca3d36133bc708e9a1301860961cc3a8d9

      SHA512

      31db2963f1bd49f7b4a6ee38e54940d20120d6c05ef7bf34ec97eb93051bee6d5428e9e1271e4ae8f5544b824188ac7278315e2e2c27be302a312eebbf8c3fb7

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\taskhost.exe
      Filesize

      256KB

      MD5

      d10a3cfcc08aae3a7234498f213cf89e

      SHA1

      ccae4469a3a05fcb6e7af33019ca5357e5406dda

      SHA256

      0da56bd07a486818b7735761001cc1d3ca5af645f369a3c206bcb6719fefff06

      SHA512

      90a4a68b45113360d732ccac7698c74aa550c05d9883d287b808982800fce1a24abf69cf06b0f017babd647cafd3ca10aa894c59e6dab8ba1ff34c639bdf6427

      Download Submit

    • C:\Users\Admin\Desktop\Remcos Professional Cracked By Alcatraz3222\Remcos Professional Cracked By Alcatraz3222.exe
      Filesize

      17.7MB

      MD5

      efc159c7cf75545997f8c6af52d3e802

      SHA1

      b85bd368c91a13db1c5de2326deb25ad666c24c1

      SHA256

      898ac001d0f6c52c1001c640d9860287fdf30a648d580e9f5dd15e2ef84ab18e

      SHA512

      d06a432233dceb731defd53238971699fef201d0f9144ee50e5dd7d6620dfdd6c298d52618bf2c9feb0519574f4565fb0177b00fd8292768fbd8b85dd11e650d

      Download Submit

    • C:\Users\Admin\Desktop\Remcos Professional Cracked By Alcatraz3222\Remcos_Settings.ini
      Filesize

      881B

      MD5

      a3468935e33e361cf94f4721ed4cb66d

      SHA1

      c3b19ca8382534b2179940cabede8c6c952a9c06

      SHA256

      b374af58c24b6085f64f979dab434643da39d0267a27975f396473327dc98c7d

      SHA512

      c1caa0b9637a46187d54b2952db204182fad5a5324574949ce4db13bdb17624ccd8b3228eb9b2bcfe5851add2c5d2f586945e7264b1d1cd02d91acf1fd81583a

      Download Submit

    • memory/616-29-0x0000000004990000-0x0000000004991000-memory.dmp

      Filesize

      4KB

      Download

    • memory/616-32-0x0000000000400000-0x0000000002991000-memory.dmp

      Filesize

      37.6MB

      Download

    • memory/616-31-0x00000000049B0000-0x00000000049B1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/616-24-0x0000000003050000-0x0000000003051000-memory.dmp

      Filesize

      4KB

      Download

    • memory/616-25-0x0000000003170000-0x0000000003171000-memory.dmp

      Filesize

      4KB

      Download

    • memory/616-26-0x0000000003180000-0x0000000003181000-memory.dmp

      Filesize

      4KB

      Download

    • memory/616-27-0x0000000003190000-0x0000000003191000-memory.dmp

      Filesize

      4KB

      Download

    • memory/616-28-0x00000000031B0000-0x00000000031B1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/616-30-0x00000000049A0000-0x00000000049A1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2500-10-0x0000000006460000-0x00000000064FC000-memory.dmp

      Filesize

      624KB

      Download

    • memory/2500-11-0x0000000074FC0000-0x0000000075771000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/2500-12-0x000000000DC10000-0x000000000ED92000-memory.dmp

      Filesize

      17.5MB

      Download

    • memory/2500-9-0x0000000000850000-0x00000000019FE000-memory.dmp

      Filesize

      17.7MB

      Download

    • memory/2500-8-0x0000000074FCE000-0x0000000074FCF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2500-48-0x0000000074FCE000-0x0000000074FCF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2500-49-0x0000000074FC0000-0x0000000075771000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/2500-53-0x0000000074FC0000-0x0000000075771000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4208-42-0x0000000000400000-0x000000000040E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/4208-47-0x0000000005E40000-0x00000000063E6000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/4208-50-0x0000000005A20000-0x0000000005AB2000-memory.dmp

      Filesize

      584KB

      Download

    • memory/4208-51-0x00000000059F0000-0x00000000059FA000-memory.dmp

      Filesize

      40KB

      Download