Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20250207-en -
resource tags
arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system -
submitted
10-02-2025 06:13
Static task
static1
Behavioral task
behavioral1
Sample
fd590a606d1d440d77d341a682c0e1e7.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
fd590a606d1d440d77d341a682c0e1e7.exe
Resource
win10v2004-20250207-en
General
-
Target
fd590a606d1d440d77d341a682c0e1e7.exe
-
Size
1.0MB
-
MD5
fd590a606d1d440d77d341a682c0e1e7
-
SHA1
3f9fedc607ba64b88b607d99ed4071b9d04f9589
-
SHA256
d2a87b1b1a1106b874e949e49a55e7e68202eaa84062c270bbf62481bb769a45
-
SHA512
b5ae2854414d2baffb33bee8c723eff60f67ead3dcc13705390c6bbd61482599cbc9cb9165a29ac4c7290a57e0c4af8f2b65a7e5e9cb0f553bf14ce5741deb3f
-
SSDEEP
24576:4zqwz4J8WFCIvIwxoKCWS2zzIy4zhnmCeNv7KCuCqsRG/:4z7zMLFCIKWS6zIXhnOOCTqsk
Malware Config
Extracted
remcos
RemoteHost
198.12.81.146:7643
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-5YTKJV
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Downloads MZ/PE file 1 IoCs
flow pid Process 42 1036 Process not Found -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5024 set thread context of 1228 5024 fd590a606d1d440d77d341a682c0e1e7.exe 90 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fd590a606d1d440d77d341a682c0e1e7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2064 MicrosoftEdgeUpdate.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5024 fd590a606d1d440d77d341a682c0e1e7.exe 5024 fd590a606d1d440d77d341a682c0e1e7.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5024 fd590a606d1d440d77d341a682c0e1e7.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1228 fd590a606d1d440d77d341a682c0e1e7.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 5024 wrote to memory of 4376 5024 fd590a606d1d440d77d341a682c0e1e7.exe 89 PID 5024 wrote to memory of 4376 5024 fd590a606d1d440d77d341a682c0e1e7.exe 89 PID 5024 wrote to memory of 4376 5024 fd590a606d1d440d77d341a682c0e1e7.exe 89 PID 5024 wrote to memory of 1228 5024 fd590a606d1d440d77d341a682c0e1e7.exe 90 PID 5024 wrote to memory of 1228 5024 fd590a606d1d440d77d341a682c0e1e7.exe 90 PID 5024 wrote to memory of 1228 5024 fd590a606d1d440d77d341a682c0e1e7.exe 90 PID 5024 wrote to memory of 1228 5024 fd590a606d1d440d77d341a682c0e1e7.exe 90 PID 5024 wrote to memory of 1228 5024 fd590a606d1d440d77d341a682c0e1e7.exe 90 PID 5024 wrote to memory of 1228 5024 fd590a606d1d440d77d341a682c0e1e7.exe 90 PID 5024 wrote to memory of 1228 5024 fd590a606d1d440d77d341a682c0e1e7.exe 90 PID 5024 wrote to memory of 1228 5024 fd590a606d1d440d77d341a682c0e1e7.exe 90 PID 5024 wrote to memory of 1228 5024 fd590a606d1d440d77d341a682c0e1e7.exe 90 PID 5024 wrote to memory of 1228 5024 fd590a606d1d440d77d341a682c0e1e7.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd590a606d1d440d77d341a682c0e1e7.exe"C:\Users\Admin\AppData\Local\Temp\fd590a606d1d440d77d341a682c0e1e7.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\fd590a606d1d440d77d341a682c0e1e7.exe"C:\Users\Admin\AppData\Local\Temp\fd590a606d1d440d77d341a682c0e1e7.exe"2⤵PID:4376
-
-
C:\Users\Admin\AppData\Local\Temp\fd590a606d1d440d77d341a682c0e1e7.exe"C:\Users\Admin\AppData\Local\Temp\fd590a606d1d440d77d341a682c0e1e7.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:1228
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUFENTA4QkMtRDVGRi00MEU0LUI1RUQtQzcwQTQxNzJEQzQ1fSIgdXNlcmlkPSJ7MEQyOURFQzQtQUExQy00QjY5LUFDMTUtNURDRUY1NjM3NTY1fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RjJENkNENzctNjZFMS00RDY5LUIzN0EtN0JCRjQwNEEzQzcwfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY4ODkiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTM2NTgwOTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MzAyNDY2NjUzIi8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2064
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5982e8ea0cddd4f82d7ff9a6fa2d68648
SHA1ba4d8d4adb3fcd825235f0212190709215599722
SHA256b240da486ccfbdaf47ca04e7ae5549375eab9093c16feba3a54f4a508d59d61c
SHA5122bf17ccf503ba086d3407982c3bab47930d4df23b5248e8536a3d757d5ab394d7c06942b64a4ef61879a23a188495933e05c121345699b1e25c7fda0e4284dda