Analysis
-
max time kernel
112s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/01/2025, 21:53
Static task
static1
Behavioral task
behavioral1
Sample
d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe
Resource
win10v2004-20241007-en
General
-
Target
d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe
-
Size
1.1MB
-
MD5
787841181de0ea645b316148b740b0c9
-
SHA1
055f48f3b7654f870cd2fbbbb6e974b03ae945db
-
SHA256
d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3
-
SHA512
34f3ffec42fb9ab11c4cb2ac7d54657bed043d8c6316a7abad1b08ea73aba62d3df43112b96f4eefe6dab07d41801eef001c1695aa818c7033c1b5c705fc7130
-
SSDEEP
24576:1u6J33O0c+JY5UZ+XC0kGso6FakCsU4yYhK3x9uZ3WYy:Xu0c++OCvkGs9Fak4BYy
Malware Config
Extracted
remcos
2.2.0 Pro
RemoteHost
185.217.1.142:3337
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
3
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
true
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-VBI2IL
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe -
Remcos family
-
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation Dxpserver.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation Dxpserver.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation Dxpserver.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation Dxpserver.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe -
Executes dropped EXE 4 IoCs
pid Process 4904 Dxpserver.exe 4984 Dxpserver.exe 4980 Dxpserver.exe 4680 Dxpserver.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe -
Modifies WinLogon 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ Dxpserver.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ Dxpserver.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000a000000023b9e-15.dat autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1496 set thread context of 3588 1496 d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe 82 PID 4904 set thread context of 4984 4904 Dxpserver.exe 96 PID 4980 set thread context of 4680 4980 Dxpserver.exe 101 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings Dxpserver.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings Dxpserver.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4820 schtasks.exe 1072 schtasks.exe 1528 schtasks.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1496 wrote to memory of 3588 1496 d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe 82 PID 1496 wrote to memory of 3588 1496 d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe 82 PID 1496 wrote to memory of 3588 1496 d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe 82 PID 1496 wrote to memory of 3588 1496 d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe 82 PID 1496 wrote to memory of 3588 1496 d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe 82 PID 3588 wrote to memory of 3444 3588 d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe 83 PID 3588 wrote to memory of 3444 3588 d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe 83 PID 3588 wrote to memory of 3444 3588 d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe 83 PID 1496 wrote to memory of 1072 1496 d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe 89 PID 1496 wrote to memory of 1072 1496 d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe 89 PID 1496 wrote to memory of 1072 1496 d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe 89 PID 4904 wrote to memory of 4984 4904 Dxpserver.exe 96 PID 4904 wrote to memory of 4984 4904 Dxpserver.exe 96 PID 4904 wrote to memory of 4984 4904 Dxpserver.exe 96 PID 4904 wrote to memory of 4984 4904 Dxpserver.exe 96 PID 4904 wrote to memory of 4984 4904 Dxpserver.exe 96 PID 4984 wrote to memory of 4836 4984 Dxpserver.exe 97 PID 4984 wrote to memory of 4836 4984 Dxpserver.exe 97 PID 4984 wrote to memory of 4836 4984 Dxpserver.exe 97 PID 4904 wrote to memory of 1528 4904 Dxpserver.exe 98 PID 4904 wrote to memory of 1528 4904 Dxpserver.exe 98 PID 4904 wrote to memory of 1528 4904 Dxpserver.exe 98 PID 4980 wrote to memory of 4680 4980 Dxpserver.exe 101 PID 4980 wrote to memory of 4680 4980 Dxpserver.exe 101 PID 4980 wrote to memory of 4680 4980 Dxpserver.exe 101 PID 4980 wrote to memory of 4680 4980 Dxpserver.exe 101 PID 4980 wrote to memory of 4680 4980 Dxpserver.exe 101 PID 4680 wrote to memory of 2232 4680 Dxpserver.exe 102 PID 4680 wrote to memory of 2232 4680 Dxpserver.exe 102 PID 4680 wrote to memory of 2232 4680 Dxpserver.exe 102 PID 4980 wrote to memory of 4820 4980 Dxpserver.exe 103 PID 4980 wrote to memory of 4820 4980 Dxpserver.exe 103 PID 4980 wrote to memory of 4820 4980 Dxpserver.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe"C:\Users\Admin\AppData\Local\Temp\d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe"C:\Users\Admin\AppData\Local\Temp\d45d672180e6840443591839dfdaa304142243ff495d6a5ad5852142dc6846d3.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- System Location Discovery: System Language Discovery
PID:3444
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn cttunesvr /tr "C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1072
-
-
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exeC:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- System Location Discovery: System Language Discovery
PID:4836
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn cttunesvr /tr "C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1528
-
-
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exeC:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- System Location Discovery: System Language Discovery
PID:2232
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn cttunesvr /tr "C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4820
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
658B
MD587fb54e35d2b42e2a5882fd866bd5391
SHA14fcbd13e36393bf8ce102f4c36c688fa1686c5bc
SHA25690c3e99e15f34c2cd793be4679700e9bbf4503ed1e6464f852ce57b71ee51b98
SHA512f95d63316690a92865d4f672d552a81818dc0bb7a565b93b995de9171b6622f23b4177c8115b618f0a0dac2d7034c7c57b1d857eb2abfe68986eefefd8e82522
-
Filesize
564B
MD5e221e7bd7e33aef4a5264f798818142e
SHA13545dbcc35de80c8f15da0daceab80acd0f1ae22
SHA256f37e43a3504c163fa4a82bacc92ceb8cccd37d1020fbba95cc954f316ce49516
SHA51204775d0fa21526bbbaa2deea13af1d5fab6183ea3a2809073539293da78e20f1cf4b9a4afdeafb1b4e8ce17a5be40f44364808ab73c174c98bce53ad8a1807d8
-
Filesize
1.1MB
MD5f98980c3884c4f8f7acf46a43308ce4e
SHA1fac1cea54636e05ea1571cfba03cca6a5a865873
SHA2565d51a95e58efa750babac58a1a1da78a11930adb72304856b470ae26b576af93
SHA5121f055d6720bab0bab0247f3f1b1d6c8ec486b21bb3aab036a77074d1f4d8df2e4e40107605fec9a9efba9ae202edfd2b57a47e32240f6af570de83cd1961e2de