Analysis
-
max time kernel
7s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 03:05
Static task
static1
Behavioral task
behavioral1
Sample
Quotation-04 - 609967.scr
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Quotation-04 - 609967.scr
Resource
win10v2004-20240611-en
General
-
Target
Quotation-04 - 609967.scr
-
Size
95KB
-
MD5
50cf2b84679ea401530b7e30d16f166b
-
SHA1
1720348ae4b55ce19a252e2161c6eb0684ebea10
-
SHA256
0738981879dde83f3a14602cfa2842e934a11c5339b460a8dd4c57c778221ddd
-
SHA512
273a2fe9402a237314dce9937a1ec0c36cdcef8a0e2820dcaf40382061fa7fc85ef9df7bfba0b237b40eb10d4ecc236eb650f528400860dd309666c1a1d519b1
-
SSDEEP
1536:mOhzJDZr9BzDNATEk9UbTV0+gRLVNI6e:lhzbrjDNATEkebh0BRk6e
Malware Config
Extracted
remcos
RemoteHost
107.173.62.181:17120
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-F9ZGZ8
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Quotation-04 - 609967.scr = "C:\\Users\\Admin\\Documents\\Quotation-04 - 609967.scr.pif" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Quotation-04 - 609967.scrdescription pid process target process PID 1684 set thread context of 2736 1684 Quotation-04 - 609967.scr Quotation-04 - 609967.scr -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
Quotation-04 - 609967.scrpid process 1684 Quotation-04 - 609967.scr 1684 Quotation-04 - 609967.scr 1684 Quotation-04 - 609967.scr 1684 Quotation-04 - 609967.scr 1684 Quotation-04 - 609967.scr 1684 Quotation-04 - 609967.scr 1684 Quotation-04 - 609967.scr 1684 Quotation-04 - 609967.scr 1684 Quotation-04 - 609967.scr 1684 Quotation-04 - 609967.scr 1684 Quotation-04 - 609967.scr 1684 Quotation-04 - 609967.scr 1684 Quotation-04 - 609967.scr 1684 Quotation-04 - 609967.scr 1684 Quotation-04 - 609967.scr 1684 Quotation-04 - 609967.scr 1684 Quotation-04 - 609967.scr 1684 Quotation-04 - 609967.scr 1684 Quotation-04 - 609967.scr 1684 Quotation-04 - 609967.scr 1684 Quotation-04 - 609967.scr 1684 Quotation-04 - 609967.scr 1684 Quotation-04 - 609967.scr 1684 Quotation-04 - 609967.scr 1684 Quotation-04 - 609967.scr 1684 Quotation-04 - 609967.scr -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Quotation-04 - 609967.scrdescription pid process Token: SeDebugPrivilege 1684 Quotation-04 - 609967.scr -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
Quotation-04 - 609967.scrcmd.exedescription pid process target process PID 1684 wrote to memory of 3068 1684 Quotation-04 - 609967.scr cmd.exe PID 1684 wrote to memory of 3068 1684 Quotation-04 - 609967.scr cmd.exe PID 1684 wrote to memory of 3068 1684 Quotation-04 - 609967.scr cmd.exe PID 1684 wrote to memory of 3068 1684 Quotation-04 - 609967.scr cmd.exe PID 3068 wrote to memory of 1272 3068 cmd.exe reg.exe PID 3068 wrote to memory of 1272 3068 cmd.exe reg.exe PID 3068 wrote to memory of 1272 3068 cmd.exe reg.exe PID 3068 wrote to memory of 1272 3068 cmd.exe reg.exe PID 1684 wrote to memory of 2732 1684 Quotation-04 - 609967.scr cmd.exe PID 1684 wrote to memory of 2732 1684 Quotation-04 - 609967.scr cmd.exe PID 1684 wrote to memory of 2732 1684 Quotation-04 - 609967.scr cmd.exe PID 1684 wrote to memory of 2732 1684 Quotation-04 - 609967.scr cmd.exe PID 1684 wrote to memory of 2736 1684 Quotation-04 - 609967.scr Quotation-04 - 609967.scr PID 1684 wrote to memory of 2736 1684 Quotation-04 - 609967.scr Quotation-04 - 609967.scr PID 1684 wrote to memory of 2736 1684 Quotation-04 - 609967.scr Quotation-04 - 609967.scr PID 1684 wrote to memory of 2736 1684 Quotation-04 - 609967.scr Quotation-04 - 609967.scr PID 1684 wrote to memory of 2736 1684 Quotation-04 - 609967.scr Quotation-04 - 609967.scr PID 1684 wrote to memory of 2736 1684 Quotation-04 - 609967.scr Quotation-04 - 609967.scr PID 1684 wrote to memory of 2736 1684 Quotation-04 - 609967.scr Quotation-04 - 609967.scr PID 1684 wrote to memory of 2736 1684 Quotation-04 - 609967.scr Quotation-04 - 609967.scr PID 1684 wrote to memory of 2736 1684 Quotation-04 - 609967.scr Quotation-04 - 609967.scr PID 1684 wrote to memory of 2736 1684 Quotation-04 - 609967.scr Quotation-04 - 609967.scr PID 1684 wrote to memory of 2736 1684 Quotation-04 - 609967.scr Quotation-04 - 609967.scr PID 1684 wrote to memory of 2736 1684 Quotation-04 - 609967.scr Quotation-04 - 609967.scr PID 1684 wrote to memory of 2736 1684 Quotation-04 - 609967.scr Quotation-04 - 609967.scr
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation-04 - 609967.scr"C:\Users\Admin\AppData\Local\Temp\Quotation-04 - 609967.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Quotation-04 - 609967.scr" /t REG_SZ /F /D "C:\Users\Admin\Documents\Quotation-04 - 609967.scr.pif"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Quotation-04 - 609967.scr" /t REG_SZ /F /D "C:\Users\Admin\Documents\Quotation-04 - 609967.scr.pif"3⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.execmd /c Copy "C:\Users\Admin\AppData\Local\Temp\Quotation-04 - 609967.scr" "C:\Users\Admin\Documents\Quotation-04 - 609967.scr.pif"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation-04 - 609967.scr"C:\Users\Admin\AppData\Local\Temp\Quotation-04 - 609967.scr"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\remcos\logs.datFilesize
144B
MD50f4e1ae8323685eb3dae24b6c7d78d83
SHA13693c618a02c126e6ad1f90b27812ce5fb5229fa
SHA256e373a723a5aa600fa0a00e1d2ca30720a7feda03dad9377e4d52fd5acf4919c8
SHA512a68cb9d3a0d749896236b370f7d6630be85e333a6cfed6c25676d5d53b5e6c0ca6453ef1f873fe863ab5e227daf10be7119985e35e4a5b69081740399457efbc
-
memory/1684-33-0x00000000746B0000-0x0000000074D9E000-memory.dmpFilesize
6.9MB
-
memory/1684-1-0x0000000000DB0000-0x0000000000DCE000-memory.dmpFilesize
120KB
-
memory/1684-2-0x00000000746B0000-0x0000000074D9E000-memory.dmpFilesize
6.9MB
-
memory/1684-3-0x0000000005320000-0x00000000053A2000-memory.dmpFilesize
520KB
-
memory/1684-0-0x00000000746BE000-0x00000000746BF000-memory.dmpFilesize
4KB
-
memory/2736-14-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2736-38-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2736-32-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2736-24-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2736-31-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2736-26-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2736-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2736-12-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2736-19-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2736-17-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2736-20-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2736-10-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2736-8-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2736-27-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2736-39-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2736-40-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2736-6-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2736-45-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2736-46-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2736-52-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2736-53-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2736-58-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2736-59-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2736-64-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2736-66-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2736-71-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/2736-72-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB