Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-06-2024 19:07
Static task
static1
Behavioral task
behavioral1
Sample
212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exe
Resource
win10v2004-20240508-en
General
-
Target
212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exe
-
Size
137KB
-
MD5
7d421d9e6ce2288ccd3bf812e84e1958
-
SHA1
b68144ec39afef3248c53315379759b681918567
-
SHA256
212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c
-
SHA512
27df2876b389d0af3a8d2b35d23cf3ed648330c8fe181e25fd287cc84cf1295c821f3dd0ea494cb900606d18b45829cb086b7e07a3e977bbfdcd7ae815355cd0
-
SSDEEP
1536:ITHiPBX4nDzMyRXGHrc9YRHqbTypgpmb5Q+ZReSdhk/J+YLgD3mrxb53cSuYQjKg:xPd4n/M+WLcilrpgGH/GwY87mVmIXGD3
Malware Config
Extracted
remcos
1.7 Pro
Host
systemcontrol.ddns.net:45000
systemcontrol2.ddns.net:45000
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
OfficeUpgrade.exe
-
copy_folder
OfficeUpgrade
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
true
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
true
-
keylog_file
Upgrader.dat
-
keylog_flag
false
-
keylog_folder
Upgrader
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
req_khauflaoyr
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
OfficeUpgrade
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
detects Windows exceutables potentially bypassing UAC using eventvwr.exe 5 IoCs
Processes:
resource yara_rule behavioral2/memory/3324-26-0x0000000000400000-0x0000000000417000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer behavioral2/memory/3324-25-0x0000000000400000-0x0000000000417000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer behavioral2/memory/3324-24-0x0000000000400000-0x0000000000417000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer behavioral2/memory/3324-30-0x0000000000400000-0x0000000000417000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer behavioral2/memory/3324-31-0x0000000000400000-0x0000000000417000-memory.dmp INDICATOR_SUSPICIOUS_EXE_UACBypass_EventViewer -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exe -
Executes dropped EXE 2 IoCs
Processes:
wn2ra4ohzdr.exewn2ra4ohzdr.exepid process 4220 wn2ra4ohzdr.exe 3324 wn2ra4ohzdr.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raj4dkhhiap = "C:\\Users\\Admin\\AppData\\Roaming\\raj4dkhhiap\\wn2ra4ohzdr.exe" 212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
wn2ra4ohzdr.exedescription pid process target process PID 4220 set thread context of 3324 4220 wn2ra4ohzdr.exe wn2ra4ohzdr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
wn2ra4ohzdr.exepid process 3324 wn2ra4ohzdr.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exewn2ra4ohzdr.exedescription pid process target process PID 1880 wrote to memory of 4220 1880 212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exe wn2ra4ohzdr.exe PID 1880 wrote to memory of 4220 1880 212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exe wn2ra4ohzdr.exe PID 1880 wrote to memory of 4220 1880 212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exe wn2ra4ohzdr.exe PID 4220 wrote to memory of 3324 4220 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 4220 wrote to memory of 3324 4220 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 4220 wrote to memory of 3324 4220 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 4220 wrote to memory of 3324 4220 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 4220 wrote to memory of 3324 4220 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 4220 wrote to memory of 3324 4220 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 4220 wrote to memory of 3324 4220 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 4220 wrote to memory of 3324 4220 wn2ra4ohzdr.exe wn2ra4ohzdr.exe PID 4220 wrote to memory of 3324 4220 wn2ra4ohzdr.exe wn2ra4ohzdr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exe"C:\Users\Admin\AppData\Local\Temp\212a56150b50e4bb9b18a8b6c10e2f0b0c18f6d74cb6d41065f8fee0fe2bd39c.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exeFilesize
137KB
MD59c8debc47b5225ca8b61ec10a9435792
SHA1c1b17c2d86d3f16ebfc47a15dac64b82f7c630d4
SHA256eddf521daa144bb79856445778ad8e2b5d4b625bb9956058e50bc936c08862ce
SHA5123a67ed298d6612b6235a841ad8e5c81fb76bf23b1db51f1c21f5dc76eb811ac904e414b318c14408fc7345c0eb76535559385ba1400eaf4311c94b81de4a61a2
-
memory/1880-20-0x0000000075350000-0x0000000075B00000-memory.dmpFilesize
7.7MB
-
memory/1880-5-0x0000000075350000-0x0000000075B00000-memory.dmpFilesize
7.7MB
-
memory/1880-0-0x000000007535E000-0x000000007535F000-memory.dmpFilesize
4KB
-
memory/1880-4-0x00000000052D0000-0x00000000052DA000-memory.dmpFilesize
40KB
-
memory/1880-2-0x00000000058A0000-0x0000000005E44000-memory.dmpFilesize
5.6MB
-
memory/1880-6-0x0000000005870000-0x0000000005890000-memory.dmpFilesize
128KB
-
memory/1880-1-0x00000000008A0000-0x00000000008C8000-memory.dmpFilesize
160KB
-
memory/1880-3-0x00000000052F0000-0x0000000005382000-memory.dmpFilesize
584KB
-
memory/3324-26-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3324-25-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3324-24-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3324-23-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3324-30-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3324-31-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/4220-22-0x0000000075350000-0x0000000075B00000-memory.dmpFilesize
7.7MB
-
memory/4220-21-0x0000000075350000-0x0000000075B00000-memory.dmpFilesize
7.7MB
-
memory/4220-37-0x0000000075350000-0x0000000075B00000-memory.dmpFilesize
7.7MB