Analysis

  • max time kernel
    149s
  • max time network
    183s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    05/08/2021, 09:52

General

  • Target

    gunzipped.exe

  • Size

    1.0MB

  • MD5

    ea1c39e72ae5c05ccb6caf2d94db2235

  • SHA1

    3746a3696094d98a4f91103b045b894c38b04d37

  • SHA256

    40ef0ea8d499ef74760da82a71c8cf548149e01826b62767c75431cc4cdad67f

  • SHA512

    c47467c0af42160971b648564868b66d2870658eebfd68388f8b04208788f2ec753f9b3331a78041d68603eec2813c7ace7a624975b80146fda4eb63b8802eb3

Malware Config

Extracted

Family

remcos

Version

3.2.0 Pro

Botnet

RemoteHost

C2

ostriuyer.myddns.me:7116

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.txt

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-MSOKMD

  • screenshot_crypt

    false

  • screenshot_flag

    true

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    2

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    notepad;solitaire;

Extracted

Family

oski

C2

marbellacabs.com/hao/

Signatures

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

  • NirSoft MailPassView 1 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 1 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
    "C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1072
    • C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
      "C:\Users\Admin\AppData\Local\Temp\gunzipped.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:468
      • C:\Users\Admin\AppData\Roaming\srsc.exe
        "C:\Users\Admin\AppData\Roaming\srsc.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1836
        • C:\Users\Admin\AppData\Roaming\srsc.exe
          "C:\Users\Admin\AppData\Roaming\srsc.exe"
          4⤵
          • Executes dropped EXE
          PID:900
        • C:\Users\Admin\AppData\Roaming\srsc.exe
          "C:\Users\Admin\AppData\Roaming\srsc.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious use of WriteProcessMemory
          PID:1352
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c taskkill /pid 1352 & erase C:\Users\Admin\AppData\Roaming\srsc.exe & RD /S /Q C:\\ProgramData\\246363220654038\\* & exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1992
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /pid 1352
              6⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1072
      • C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
        C:\Users\Admin\AppData\Local\Temp\gunzipped.exe /stext "C:\Users\Admin\AppData\Local\Temp\ssfzqggawsykuiwtf"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:968
      • C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
        C:\Users\Admin\AppData\Local\Temp\gunzipped.exe /stext "C:\Users\Admin\AppData\Local\Temp\vmsrqzrtjaqpwosxoypbf"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:360
      • C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
        C:\Users\Admin\AppData\Local\Temp\gunzipped.exe /stext "C:\Users\Admin\AppData\Local\Temp\foxkrrcvfiicgugbyjjdqmjy"
        3⤵
          PID:824
        • C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
          C:\Users\Admin\AppData\Local\Temp\gunzipped.exe /stext "C:\Users\Admin\AppData\Local\Temp\zfdhtw"
          3⤵
            PID:1948
          • C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
            C:\Users\Admin\AppData\Local\Temp\gunzipped.exe /stext "C:\Users\Admin\AppData\Local\Temp\czrzuocgj"
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:800
          • C:\Users\Admin\AppData\Local\Temp\gunzipped.exe
            C:\Users\Admin\AppData\Local\Temp\gunzipped.exe /stext "C:\Users\Admin\AppData\Local\Temp\mbwsvhnifulfr"
            3⤵
              PID:1880

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/360-80-0x0000000000400000-0x0000000000424000-memory.dmp

                Filesize

                144KB

              • memory/360-87-0x0000000000400000-0x0000000000424000-memory.dmp

                Filesize

                144KB

              • memory/468-65-0x0000000000400000-0x0000000000479000-memory.dmp

                Filesize

                484KB

              • memory/468-68-0x0000000000400000-0x0000000000479000-memory.dmp

                Filesize

                484KB

              • memory/468-67-0x00000000768B1000-0x00000000768B3000-memory.dmp

                Filesize

                8KB

              • memory/800-111-0x0000000000400000-0x0000000000424000-memory.dmp

                Filesize

                144KB

              • memory/824-83-0x0000000000400000-0x0000000000457000-memory.dmp

                Filesize

                348KB

              • memory/824-89-0x0000000000400000-0x0000000000457000-memory.dmp

                Filesize

                348KB

              • memory/968-77-0x0000000000400000-0x0000000000478000-memory.dmp

                Filesize

                480KB

              • memory/968-86-0x0000000000400000-0x0000000000478000-memory.dmp

                Filesize

                480KB

              • memory/1072-64-0x0000000005E70000-0x0000000005EE5000-memory.dmp

                Filesize

                468KB

              • memory/1072-59-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

                Filesize

                4KB

              • memory/1072-61-0x0000000004F10000-0x0000000004F11000-memory.dmp

                Filesize

                4KB

              • memory/1072-62-0x0000000000440000-0x0000000000453000-memory.dmp

                Filesize

                76KB

              • memory/1072-63-0x0000000009210000-0x00000000092E1000-memory.dmp

                Filesize

                836KB

              • memory/1352-97-0x0000000000400000-0x0000000000438000-memory.dmp

                Filesize

                224KB

              • memory/1352-93-0x0000000000400000-0x0000000000438000-memory.dmp

                Filesize

                224KB

              • memory/1836-73-0x0000000000930000-0x0000000000931000-memory.dmp

                Filesize

                4KB

              • memory/1836-75-0x0000000004C60000-0x0000000004C61000-memory.dmp

                Filesize

                4KB

              • memory/1836-91-0x0000000002030000-0x0000000002064000-memory.dmp

                Filesize

                208KB

              • memory/1836-90-0x00000000073D0000-0x0000000007463000-memory.dmp

                Filesize

                588KB

              • memory/1880-112-0x0000000000400000-0x0000000000457000-memory.dmp

                Filesize

                348KB