Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
03/04/2025, 12:23
Static task
static1
Behavioral task
behavioral1
Sample
Stamped Purchase Order Against Payment.exe
Resource
win10v2004-20250314-en
General
-
Target
Stamped Purchase Order Against Payment.exe
-
Size
1.2MB
-
MD5
942c4a30d66950e6b559594639b01811
-
SHA1
d7f5281bab0aeec1c1abd18e8b67ee8642100168
-
SHA256
b8f7a9a7cc45c8a200c6f2a62f545bac04c8b6ad032c3042b0686307578c3f58
-
SHA512
4341d118bd5a76c5fb95b3dc13e9e4649825cd3ddc2e73cb6602fa22d55f2e049b7b8db53c78e25218412f9d6027a813f56dae94d54b0c3057f43ab5815c9a0d
-
SSDEEP
24576:tu6J33O0c+JY5UZ+XC0kGso6FahskQd8GpnruryULDSYWY:fu0c++OCvkGs9FahanNY
Malware Config
Extracted
remcos
RemoteHost
127.0.0.1:51010
196.251.92.49:51010
oni17.duckdns.org:51010
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-XLVXMK
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iodite.vbs iodite.exe -
Executes dropped EXE 1 IoCs
pid Process 3848 iodite.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x000d000000023fbe-9.dat autoit_exe behavioral1/memory/3848-18-0x0000000000DC0000-0x0000000000F01000-memory.dmp autoit_exe behavioral1/memory/3848-22-0x0000000000DC0000-0x0000000000F01000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3848 set thread context of 3476 3848 iodite.exe 92 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iodite.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Stamped Purchase Order Against Payment.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3848 iodite.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1924 Stamped Purchase Order Against Payment.exe 1924 Stamped Purchase Order Against Payment.exe 3848 iodite.exe 3848 iodite.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1924 Stamped Purchase Order Against Payment.exe 1924 Stamped Purchase Order Against Payment.exe 3848 iodite.exe 3848 iodite.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1924 wrote to memory of 3848 1924 Stamped Purchase Order Against Payment.exe 89 PID 1924 wrote to memory of 3848 1924 Stamped Purchase Order Against Payment.exe 89 PID 1924 wrote to memory of 3848 1924 Stamped Purchase Order Against Payment.exe 89 PID 3848 wrote to memory of 3476 3848 iodite.exe 92 PID 3848 wrote to memory of 3476 3848 iodite.exe 92 PID 3848 wrote to memory of 3476 3848 iodite.exe 92 PID 3848 wrote to memory of 3476 3848 iodite.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stamped Purchase Order Against Payment.exe"C:\Users\Admin\AppData\Local\Temp\Stamped Purchase Order Against Payment.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\ophiolatrous\iodite.exe"C:\Users\Admin\AppData\Local\Temp\Stamped Purchase Order Against Payment.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Stamped Purchase Order Against Payment.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3476
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5942c4a30d66950e6b559594639b01811
SHA1d7f5281bab0aeec1c1abd18e8b67ee8642100168
SHA256b8f7a9a7cc45c8a200c6f2a62f545bac04c8b6ad032c3042b0686307578c3f58
SHA5124341d118bd5a76c5fb95b3dc13e9e4649825cd3ddc2e73cb6602fa22d55f2e049b7b8db53c78e25218412f9d6027a813f56dae94d54b0c3057f43ab5815c9a0d