Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
26-06-2024 19:07
Static task
static1
Behavioral task
behavioral1
Sample
212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exe
Resource
win10v2004-20240508-en
General
-
Target
212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exe
-
Size
137KB
-
MD5
7d421d9e6ce2288ccd3bf812e84e1958
-
SHA1
b68144ec39afef3248c53315379759b681918567
-
SHA256
212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c
-
SHA512
27df2876b389d0af3a8d2b35d23cf3ed648330c8fe181e25fd287cc84cf1295c821f3dd0ea494cb900606d18b45829cb086b7e07a3e977bbfdcd7ae815355cd0
-
SSDEEP
1536:ITHiPBX4nDzMyRXGHrc9YRHqbTypgpmb5Q+ZReSdhk/J+YLgD3mrxb53cSuYQjKg:xPd4n/M+WLcilrpgGH/GwY87mVmIXGD3
Malware Config
Extracted
remcos
1.7 Pro
Host
systemcontrol.ddns.net:45000
systemcontrol2.ddns.net:45000
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
OfficeUpgrade.exe
-
copy_folder
OfficeUpgrade
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
Upgrader.dat
-
keylog_flag
false
-
keylog_folder
Upgrader
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
req_khauflaoyr
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
OfficeUpgrade
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
detects Windows exceutables potentially bypassing UAC using eventvwr.exe 7 IoCs
Processes:
resource yara_rule behavioral1/memory/2608-29-0x0000000000400000-0x0000000000417000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer behavioral1/memory/2608-35-0x0000000000400000-0x0000000000417000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer behavioral1/memory/2608-26-0x0000000000400000-0x0000000000417000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer behavioral1/memory/2608-23-0x0000000000400000-0x0000000000417000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer behavioral1/memory/2608-36-0x0000000000400000-0x0000000000417000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer behavioral1/memory/2608-39-0x0000000000400000-0x0000000000417000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer behavioral1/memory/2608-43-0x0000000000400000-0x0000000000417000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer -
Executes dropped EXE 2 IoCs
Processes:
wn2ra4ohzdr.exewn2ra4ohzdr.exepid process 2756 wn2ra4ohzdr.exe 2608 wn2ra4ohzdr.exe -
Loads dropped DLL 1 IoCs
Processes:
212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exepid process 2252 212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\raj4dkhhiap = "C:\\Users\\Admin\\AppData\\Roaming\\raj4dkhhiap\\wn2ra4ohzdr.exe" 212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
wn2ra4ohzdr.exedescription pid process target process PID 2756 set thread context of 2608 2756 wn2ra4ohzdr.exe wn2ra4ohzdr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
wn2ra4ohzdr.exepid process 2608 wn2ra4ohzdr.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exewn2ra4ohzdr.exedescription pid process target process PID 2252 wrote to memory of 2756 2252 212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exe wn2ra4ohzdr.exe PID 2252 wrote to memory of 2756 2252 212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exe wn2ra4ohzdr.exe PID 2252 wrote to memory of 2756 2252 212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exe wn2ra4ohzdr.exe PID 2252 wrote to memory of 2756 2252 212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exe wn2ra4ohzdr.exe PID 2756 wrote to memory of 2608 2756 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 2756 wrote to memory of 2608 2756 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 2756 wrote to memory of 2608 2756 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 2756 wrote to memory of 2608 2756 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 2756 wrote to memory of 2608 2756 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 2756 wrote to memory of 2608 2756 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 2756 wrote to memory of 2608 2756 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 2756 wrote to memory of 2608 2756 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 2756 wrote to memory of 2608 2756 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 2756 wrote to memory of 2608 2756 wn2ra4ohzdr.exe wn2ra4ohzdr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exe"C:\Users\Admin\AppData\Local\Temp\212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exeFilesize
137KB
MD59ec3cacdee353f83e8165e1239d2a0f7
SHA1cde028b533a8210daa80a9e61591be8bbc1ccf0e
SHA2562b5a4b79bfaefb7e91252902a867ab0508038edef5ee71a4a48421fba64a24ed
SHA5126c92981d5d3f891b9bd78e070061b91a93a69a6d2d2061cb3514bd93dd6ed82f550cdc46f05873beefac59230ddf9be209814ad0616c5ccfa6680f20c3316b13
-
memory/2252-12-0x0000000074900000-0x0000000074FEE000-memory.dmpFilesize
6.9MB
-
memory/2252-1-0x00000000012F0000-0x0000000001318000-memory.dmpFilesize
160KB
-
memory/2252-2-0x0000000074900000-0x0000000074FEE000-memory.dmpFilesize
6.9MB
-
memory/2252-3-0x0000000000590000-0x00000000005B0000-memory.dmpFilesize
128KB
-
memory/2252-0-0x000000007490E000-0x000000007490F000-memory.dmpFilesize
4KB
-
memory/2608-23-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2608-35-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2608-43-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2608-18-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2608-16-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2608-29-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2608-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2608-39-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2608-26-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2608-36-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2608-20-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/2756-13-0x0000000001380000-0x00000000013A8000-memory.dmpFilesize
160KB
-
memory/2756-14-0x0000000074900000-0x0000000074FEE000-memory.dmpFilesize
6.9MB
-
memory/2756-40-0x0000000074900000-0x0000000074FEE000-memory.dmpFilesize
6.9MB
-
memory/2756-15-0x0000000074900000-0x0000000074FEE000-memory.dmpFilesize
6.9MB