Analysis
-
max time kernel
119s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 06:52
Static task
static1
Behavioral task
behavioral1
Sample
d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe
Resource
win10v2004-20241007-en
General
-
Target
d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe
-
Size
1.1MB
-
MD5
a5214c80f5c9addd11c0deb759fbca74
-
SHA1
eaf20ee151ca884cf30bbe3ffa66fdc442b27177
-
SHA256
d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c
-
SHA512
53657957ea7150c2fa8882e08319b9d13d6225b798121c81936ab482cef46386b6f4cc0825cf14a0f720b98c9aed91d8244178ff9c6623d2355e5b43745602e4
-
SSDEEP
24576:1u6J33O0c+JY5UZ+XC0kGso6FakCsU4yYhK3x9uZ3WY7:Xu0c++OCvkGs9Fak4BY7
Malware Config
Extracted
remcos
2.2.0 Pro
RemoteHost
185.217.1.142:3337
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
3
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
true
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Remcos-VBI2IL
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe -
Remcos family
-
Executes dropped EXE 4 IoCs
pid Process 2172 Dxpserver.exe 2456 Dxpserver.exe 2200 Dxpserver.exe 2120 Dxpserver.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\"" Dxpserver.exe -
Modifies WinLogon 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ Dxpserver.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ Dxpserver.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x000700000001921f-19.dat autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2100 set thread context of 2392 2100 d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe 31 PID 2172 set thread context of 2456 2172 Dxpserver.exe 37 PID 2200 set thread context of 2120 2200 Dxpserver.exe 43 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dxpserver.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2756 schtasks.exe 2848 schtasks.exe 2512 schtasks.exe -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2392 2100 d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe 31 PID 2100 wrote to memory of 2392 2100 d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe 31 PID 2100 wrote to memory of 2392 2100 d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe 31 PID 2100 wrote to memory of 2392 2100 d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe 31 PID 2100 wrote to memory of 2392 2100 d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe 31 PID 2100 wrote to memory of 2392 2100 d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe 31 PID 2392 wrote to memory of 2744 2392 d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe 32 PID 2392 wrote to memory of 2744 2392 d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe 32 PID 2392 wrote to memory of 2744 2392 d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe 32 PID 2392 wrote to memory of 2744 2392 d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe 32 PID 2100 wrote to memory of 2756 2100 d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe 33 PID 2100 wrote to memory of 2756 2100 d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe 33 PID 2100 wrote to memory of 2756 2100 d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe 33 PID 2100 wrote to memory of 2756 2100 d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe 33 PID 1616 wrote to memory of 2172 1616 taskeng.exe 36 PID 1616 wrote to memory of 2172 1616 taskeng.exe 36 PID 1616 wrote to memory of 2172 1616 taskeng.exe 36 PID 1616 wrote to memory of 2172 1616 taskeng.exe 36 PID 2172 wrote to memory of 2456 2172 Dxpserver.exe 37 PID 2172 wrote to memory of 2456 2172 Dxpserver.exe 37 PID 2172 wrote to memory of 2456 2172 Dxpserver.exe 37 PID 2172 wrote to memory of 2456 2172 Dxpserver.exe 37 PID 2172 wrote to memory of 2456 2172 Dxpserver.exe 37 PID 2172 wrote to memory of 2456 2172 Dxpserver.exe 37 PID 2456 wrote to memory of 2088 2456 Dxpserver.exe 38 PID 2456 wrote to memory of 2088 2456 Dxpserver.exe 38 PID 2456 wrote to memory of 2088 2456 Dxpserver.exe 38 PID 2456 wrote to memory of 2088 2456 Dxpserver.exe 38 PID 2172 wrote to memory of 2848 2172 Dxpserver.exe 39 PID 2172 wrote to memory of 2848 2172 Dxpserver.exe 39 PID 2172 wrote to memory of 2848 2172 Dxpserver.exe 39 PID 2172 wrote to memory of 2848 2172 Dxpserver.exe 39 PID 1616 wrote to memory of 2200 1616 taskeng.exe 42 PID 1616 wrote to memory of 2200 1616 taskeng.exe 42 PID 1616 wrote to memory of 2200 1616 taskeng.exe 42 PID 1616 wrote to memory of 2200 1616 taskeng.exe 42 PID 2200 wrote to memory of 2120 2200 Dxpserver.exe 43 PID 2200 wrote to memory of 2120 2200 Dxpserver.exe 43 PID 2200 wrote to memory of 2120 2200 Dxpserver.exe 43 PID 2200 wrote to memory of 2120 2200 Dxpserver.exe 43 PID 2200 wrote to memory of 2120 2200 Dxpserver.exe 43 PID 2200 wrote to memory of 2120 2200 Dxpserver.exe 43 PID 2120 wrote to memory of 2084 2120 Dxpserver.exe 44 PID 2120 wrote to memory of 2084 2120 Dxpserver.exe 44 PID 2120 wrote to memory of 2084 2120 Dxpserver.exe 44 PID 2120 wrote to memory of 2084 2120 Dxpserver.exe 44 PID 2200 wrote to memory of 2512 2200 Dxpserver.exe 45 PID 2200 wrote to memory of 2512 2200 Dxpserver.exe 45 PID 2200 wrote to memory of 2512 2200 Dxpserver.exe 45 PID 2200 wrote to memory of 2512 2200 Dxpserver.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe"C:\Users\Admin\AppData\Local\Temp\d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe"C:\Users\Admin\AppData\Local\Temp\d2554d4225aff7609158eab385a7090073afc2e5853b2a20f8752aae7cd8d06c.exe"2⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"3⤵
- System Location Discovery: System Language Discovery
PID:2744
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn cttunesvr /tr "C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2756
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {CA7EEBF4-035E-46AA-BDDD-99D476571D18} S-1-5-21-2039016743-699959520-214465309-1000:PIDEURYY\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exeC:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"4⤵
- System Location Discovery: System Language Discovery
PID:2088
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn cttunesvr /tr "C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe" /sc minute /mo 1 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2848
-
-
-
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exeC:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe"3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"4⤵
- System Location Discovery: System Language Discovery
PID:2084
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn cttunesvr /tr "C:\Users\Admin\AppData\Roaming\adprovider\Dxpserver.exe" /sc minute /mo 1 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2512
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
658B
MD57bdb5fb47ea04b2f321f7b69450e724f
SHA19d832f661dc703b5535453e2360d52ddf33f177e
SHA2568bb2bd905f30fd8b572b78af8bc8fa3f505051c8d3cd4bb9cb361b7723e99dde
SHA512d708e624e76a70accaf1938acaea4e8192c2bf18d76c395e5d5d70c251a2d5d50803402126aa7d07b0bf917cb1ba9ebaa8ea8ac7078e607cab50cf2ca20fa50b
-
Filesize
564B
MD5e221e7bd7e33aef4a5264f798818142e
SHA13545dbcc35de80c8f15da0daceab80acd0f1ae22
SHA256f37e43a3504c163fa4a82bacc92ceb8cccd37d1020fbba95cc954f316ce49516
SHA51204775d0fa21526bbbaa2deea13af1d5fab6183ea3a2809073539293da78e20f1cf4b9a4afdeafb1b4e8ce17a5be40f44364808ab73c174c98bce53ad8a1807d8
-
Filesize
1.1MB
MD58afeed07ecc6bdd4b5c7dd4cb9f894a2
SHA1796ad32addaeb17cef8f6b426363bb2c7dc52d53
SHA256c0c9900801dcbe57616758adf63cb17eeede094a83cc3fe358582e3730a58205
SHA512108fd78bac065a8a7f1c3b23b676d7183d8db89c03cc6d74703d6ec40c6052431d827d3410256ca5f7b83b4375c4e635518145248da7fb2e79a477752e6a8a1b