Analysis

  • max time kernel
    124s
  • max time network
    178s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    22-07-2021 07:59

General

  • Target

    f8b12b37061c62984a170f834535842b.exe

  • Size

    516KB

  • MD5

    f8b12b37061c62984a170f834535842b

  • SHA1

    f178dbcaafb30841c1a6a1c78be84ecbaf37b3f7

  • SHA256

    548f6a3cc2e79d94f8735680af5a91b4d8dc1a003e578d9027dca782939c9755

  • SHA512

    4d24383d101edaf279af020c4e39731819465a22475548649511523732626ea04d679fc8dd832b59555099bd9b1c82407334ab6106010444f4ebcfa37d780607

Malware Config

Extracted

Family

warzonerat

C2

byx.z86.ru:5200

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

dpqw-avira.bot.nu:2404

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    explorer.exe

  • copy_folder

    windows

  • delete_file

    false

  • hide_file

    true

  • hide_keylog_file

    false

  • install_flag

    true

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    remcos_abihghbcgbxx#

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screens

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    pdf

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 12 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 8 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 59 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f8b12b37061c62984a170f834535842b.exe
    "C:\Users\Admin\AppData\Local\Temp\f8b12b37061c62984a170f834535842b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1308
    • C:\Users\Admin\AppData\Local\Temp\f8b12b37061c62984a170f834535842b.exe
      C:\Users\Admin\AppData\Local\Temp\f8b12b37061c62984a170f834535842b.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:764
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\svchost.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1516
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\svchost.exe"
          4⤵
            PID:400
        • C:\ProgramData\svchost.exe
          "C:\ProgramData\svchost.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1964
          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
            C:\Users\Admin\AppData\Local\Temp\svchost.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:864
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe"
              5⤵
                PID:1552
              • C:\Users\Admin\AppData\Roaming\bCEhedJEK.exe
                "C:\Users\Admin\AppData\Roaming\bCEhedJEK.exe"
                5⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious use of WriteProcessMemory
                PID:336
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
                  6⤵
                  • Loads dropped DLL
                  • Suspicious use of WriteProcessMemory
                  PID:1308
                  • C:\Windows\SysWOW64\PING.EXE
                    PING 127.0.0.1 -n 2
                    7⤵
                    • Runs ping.exe
                    PID:968
                  • C:\Users\Admin\AppData\Roaming\windows\explorer.exe
                    "C:\Users\Admin\AppData\Roaming\windows\explorer.exe"
                    7⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    PID:820

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Defense Evasion

      Modify Registry

      1
      T1112

      Credential Access

      Credentials in Files

      1
      T1081

      Discovery

      System Information Discovery

      1
      T1082

      Remote System Discovery

      1
      T1018

      Collection

      Data from Local System

      1
      T1005

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\svchost.exe
        MD5

        f8b12b37061c62984a170f834535842b

        SHA1

        f178dbcaafb30841c1a6a1c78be84ecbaf37b3f7

        SHA256

        548f6a3cc2e79d94f8735680af5a91b4d8dc1a003e578d9027dca782939c9755

        SHA512

        4d24383d101edaf279af020c4e39731819465a22475548649511523732626ea04d679fc8dd832b59555099bd9b1c82407334ab6106010444f4ebcfa37d780607

      • C:\ProgramData\svchost.exe
        MD5

        f8b12b37061c62984a170f834535842b

        SHA1

        f178dbcaafb30841c1a6a1c78be84ecbaf37b3f7

        SHA256

        548f6a3cc2e79d94f8735680af5a91b4d8dc1a003e578d9027dca782939c9755

        SHA512

        4d24383d101edaf279af020c4e39731819465a22475548649511523732626ea04d679fc8dd832b59555099bd9b1c82407334ab6106010444f4ebcfa37d780607

      • C:\Users\Admin\AppData\Local\Temp\install.bat
        MD5

        514640b2ac709250f11d838ad29e2c0f

        SHA1

        29046710afc21589b0ccd50379f76767b40b1819

        SHA256

        c98ac7e318fd8b9694a0966da406f3c87f20f41f82cf98359c6e4aaf3fd89e53

        SHA512

        f5666c13ab715486614652fa6b405c7cae843d3fa0b00d82d443ed0da8212084382e01e39fc5de1f194713ef397e793c712ff28df36e4bf27a62ea7eb109655e

      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        MD5

        f8b12b37061c62984a170f834535842b

        SHA1

        f178dbcaafb30841c1a6a1c78be84ecbaf37b3f7

        SHA256

        548f6a3cc2e79d94f8735680af5a91b4d8dc1a003e578d9027dca782939c9755

        SHA512

        4d24383d101edaf279af020c4e39731819465a22475548649511523732626ea04d679fc8dd832b59555099bd9b1c82407334ab6106010444f4ebcfa37d780607

      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        MD5

        f8b12b37061c62984a170f834535842b

        SHA1

        f178dbcaafb30841c1a6a1c78be84ecbaf37b3f7

        SHA256

        548f6a3cc2e79d94f8735680af5a91b4d8dc1a003e578d9027dca782939c9755

        SHA512

        4d24383d101edaf279af020c4e39731819465a22475548649511523732626ea04d679fc8dd832b59555099bd9b1c82407334ab6106010444f4ebcfa37d780607

      • C:\Users\Admin\AppData\Roaming\bCEhedJEK.exe
        MD5

        04694be6bf4a97114fda8dec4f9b8f42

        SHA1

        91f4b470a65d756c32ce1967b8e5300ba70383c5

        SHA256

        ed3a96630761ee25131c40b747f50fc55aa85d5e8f631f71bbfc901dd96bac13

        SHA512

        9bec01db5b96b9a6aa9afc678aecc44bca7554b7c09588fc4504564269437995cb936c012b3f0a025e4b4cc566cec4dce8f3445ed23975fd0cecb50998e0ae27

      • C:\Users\Admin\AppData\Roaming\bCEhedJEK.exe
        MD5

        04694be6bf4a97114fda8dec4f9b8f42

        SHA1

        91f4b470a65d756c32ce1967b8e5300ba70383c5

        SHA256

        ed3a96630761ee25131c40b747f50fc55aa85d5e8f631f71bbfc901dd96bac13

        SHA512

        9bec01db5b96b9a6aa9afc678aecc44bca7554b7c09588fc4504564269437995cb936c012b3f0a025e4b4cc566cec4dce8f3445ed23975fd0cecb50998e0ae27

      • C:\Users\Admin\AppData\Roaming\windows\explorer.exe
        MD5

        04694be6bf4a97114fda8dec4f9b8f42

        SHA1

        91f4b470a65d756c32ce1967b8e5300ba70383c5

        SHA256

        ed3a96630761ee25131c40b747f50fc55aa85d5e8f631f71bbfc901dd96bac13

        SHA512

        9bec01db5b96b9a6aa9afc678aecc44bca7554b7c09588fc4504564269437995cb936c012b3f0a025e4b4cc566cec4dce8f3445ed23975fd0cecb50998e0ae27

      • C:\Users\Admin\AppData\Roaming\windows\explorer.exe
        MD5

        04694be6bf4a97114fda8dec4f9b8f42

        SHA1

        91f4b470a65d756c32ce1967b8e5300ba70383c5

        SHA256

        ed3a96630761ee25131c40b747f50fc55aa85d5e8f631f71bbfc901dd96bac13

        SHA512

        9bec01db5b96b9a6aa9afc678aecc44bca7554b7c09588fc4504564269437995cb936c012b3f0a025e4b4cc566cec4dce8f3445ed23975fd0cecb50998e0ae27

      • \ProgramData\svchost.exe
        MD5

        f8b12b37061c62984a170f834535842b

        SHA1

        f178dbcaafb30841c1a6a1c78be84ecbaf37b3f7

        SHA256

        548f6a3cc2e79d94f8735680af5a91b4d8dc1a003e578d9027dca782939c9755

        SHA512

        4d24383d101edaf279af020c4e39731819465a22475548649511523732626ea04d679fc8dd832b59555099bd9b1c82407334ab6106010444f4ebcfa37d780607

      • \Users\Admin\AppData\Local\Temp\freebl3.dll
        MD5

        ef12ab9d0b231b8f898067b2114b1bc0

        SHA1

        6d90f27b2105945f9bb77039e8b892070a5f9442

        SHA256

        2b00fc4f541ac10c94e3556ff28e30a801811c36422546a546a445aca3f410f7

        SHA512

        2aa62bfba556ad8f042942dd25aa071ff6677c257904377c1ec956fd9e862abcbf379e0cfd8c630c303a32ece75618c24e3eef58bddb705c427985b944689193

      • \Users\Admin\AppData\Local\Temp\mozglue.dll
        MD5

        75f8cc548cabf0cc800c25047e4d3124

        SHA1

        602676768f9faecd35b48c38a0632781dfbde10c

        SHA256

        fb419a60305f17359e2ac0510233ee80e845885eee60607715c67dd88e501ef0

        SHA512

        ed831c9c769aef3be253c52542cf032afa0a8fa5fe25ca704db65ee6883c608220df7102ac2b99ee9c2e599a0f5db99fd86894a4b169e68440eb1b0d0012672f

      • \Users\Admin\AppData\Local\Temp\msvcp140.dll
        MD5

        109f0f02fd37c84bfc7508d4227d7ed5

        SHA1

        ef7420141bb15ac334d3964082361a460bfdb975

        SHA256

        334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

        SHA512

        46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

      • \Users\Admin\AppData\Local\Temp\nss3.dll
        MD5

        d7858e8449004e21b01d468e9fd04b82

        SHA1

        9524352071ede21c167e7e4f106e9526dc23ef4e

        SHA256

        78758bf7f3b3b5e3477e38354acd32d787bc1286c8bd9b873471b9c195e638db

        SHA512

        1e2c981e6c0ca36c60c6e9cae9548b866d5c524df837095b30d618d9c322def7134c20de820105400dd1b58076b66d90274f67773ac6ba914f611b419babb440

      • \Users\Admin\AppData\Local\Temp\softokn3.dll
        MD5

        471c983513694ac3002590345f2be0da

        SHA1

        6612b9af4ff6830fa9b7d4193078434ef72f775b

        SHA256

        bb3ff746471116c6ad0339fa0522aa2a44a787e33a29c7b27649a054ecd4d00f

        SHA512

        a9b0fb923bc3b567e933de10b141a3e9213640e3d790b4c4d753cf220d55593ae8026102909969ba6bfc22da3b2fcd01e30a9f5a74bd14a0fdec9beaf0fb1410

      • \Users\Admin\AppData\Local\Temp\svchost.exe
        MD5

        f8b12b37061c62984a170f834535842b

        SHA1

        f178dbcaafb30841c1a6a1c78be84ecbaf37b3f7

        SHA256

        548f6a3cc2e79d94f8735680af5a91b4d8dc1a003e578d9027dca782939c9755

        SHA512

        4d24383d101edaf279af020c4e39731819465a22475548649511523732626ea04d679fc8dd832b59555099bd9b1c82407334ab6106010444f4ebcfa37d780607

      • \Users\Admin\AppData\Local\Temp\vcruntime140.dll
        MD5

        7587bf9cb4147022cd5681b015183046

        SHA1

        f2106306a8f6f0da5afb7fc765cfa0757ad5a628

        SHA256

        c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

        SHA512

        0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

      • \Users\Admin\AppData\Roaming\bCEhedJEK.exe
        MD5

        04694be6bf4a97114fda8dec4f9b8f42

        SHA1

        91f4b470a65d756c32ce1967b8e5300ba70383c5

        SHA256

        ed3a96630761ee25131c40b747f50fc55aa85d5e8f631f71bbfc901dd96bac13

        SHA512

        9bec01db5b96b9a6aa9afc678aecc44bca7554b7c09588fc4504564269437995cb936c012b3f0a025e4b4cc566cec4dce8f3445ed23975fd0cecb50998e0ae27

      • \Users\Admin\AppData\Roaming\bCEhedJEK.exe
        MD5

        04694be6bf4a97114fda8dec4f9b8f42

        SHA1

        91f4b470a65d756c32ce1967b8e5300ba70383c5

        SHA256

        ed3a96630761ee25131c40b747f50fc55aa85d5e8f631f71bbfc901dd96bac13

        SHA512

        9bec01db5b96b9a6aa9afc678aecc44bca7554b7c09588fc4504564269437995cb936c012b3f0a025e4b4cc566cec4dce8f3445ed23975fd0cecb50998e0ae27

      • \Users\Admin\AppData\Roaming\windows\explorer.exe
        MD5

        04694be6bf4a97114fda8dec4f9b8f42

        SHA1

        91f4b470a65d756c32ce1967b8e5300ba70383c5

        SHA256

        ed3a96630761ee25131c40b747f50fc55aa85d5e8f631f71bbfc901dd96bac13

        SHA512

        9bec01db5b96b9a6aa9afc678aecc44bca7554b7c09588fc4504564269437995cb936c012b3f0a025e4b4cc566cec4dce8f3445ed23975fd0cecb50998e0ae27

      • \Users\Admin\AppData\Roaming\windows\explorer.exe
        MD5

        04694be6bf4a97114fda8dec4f9b8f42

        SHA1

        91f4b470a65d756c32ce1967b8e5300ba70383c5

        SHA256

        ed3a96630761ee25131c40b747f50fc55aa85d5e8f631f71bbfc901dd96bac13

        SHA512

        9bec01db5b96b9a6aa9afc678aecc44bca7554b7c09588fc4504564269437995cb936c012b3f0a025e4b4cc566cec4dce8f3445ed23975fd0cecb50998e0ae27

      • memory/336-99-0x0000000000000000-mapping.dmp
      • memory/400-78-0x0000000000000000-mapping.dmp
      • memory/764-68-0x0000000000400000-0x000000000055E000-memory.dmp
        Filesize

        1.4MB

      • memory/764-70-0x0000000076281000-0x0000000076283000-memory.dmp
        Filesize

        8KB

      • memory/764-71-0x0000000000400000-0x000000000055E000-memory.dmp
        Filesize

        1.4MB

      • memory/764-69-0x0000000000405E28-mapping.dmp
      • memory/820-116-0x0000000000000000-mapping.dmp
      • memory/864-96-0x0000000003200000-0x0000000003300000-memory.dmp
        Filesize

        1024KB

      • memory/864-112-0x00000000048F0000-0x0000000004974000-memory.dmp
        Filesize

        528KB

      • memory/864-92-0x0000000000400000-0x000000000055E000-memory.dmp
        Filesize

        1.4MB

      • memory/864-89-0x0000000000405E28-mapping.dmp
      • memory/968-111-0x0000000000000000-mapping.dmp
      • memory/1308-67-0x00000000059D0000-0x0000000005A4B000-memory.dmp
        Filesize

        492KB

      • memory/1308-59-0x0000000000B20000-0x0000000000B21000-memory.dmp
        Filesize

        4KB

      • memory/1308-109-0x0000000000000000-mapping.dmp
      • memory/1308-62-0x0000000001FB0000-0x0000000002006000-memory.dmp
        Filesize

        344KB

      • memory/1308-61-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
        Filesize

        4KB

      • memory/1516-72-0x0000000000000000-mapping.dmp
      • memory/1552-95-0x00000000000B0000-0x00000000000B1000-memory.dmp
        Filesize

        4KB

      • memory/1552-94-0x0000000000000000-mapping.dmp
      • memory/1964-80-0x0000000000990000-0x0000000000991000-memory.dmp
        Filesize

        4KB

      • memory/1964-74-0x0000000000000000-mapping.dmp
      • memory/1964-77-0x0000000000D60000-0x0000000000D61000-memory.dmp
        Filesize

        4KB