Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    07-09-2021 06:01

General

  • Target

    RFQ 090701-2021-PTSC-HTS-03 - 001.js

  • Size

    27KB

  • MD5

    cc01cf8d821a2c3059fe6598d81c8037

  • SHA1

    cbc52f57491f1f11c12d6ab3ee515c5149aaeeb1

  • SHA256

    a745eea0381b55cf2efe28cd6172d38bb1284d49f3f1d506bc010c7be4cb8546

  • SHA512

    d552bc4fd264805a48b33241d34b22cdc995bd8081a596da09c52fc085f79108c045611f839c1689ecc37d3ec75a4afe1e2f20b1ae93bd31985783966070de3b

Malware Config

Extracted

Family

remcos

Version

3.2.0 Pro

Botnet

Reed

C2

ezfax2021.home-webserver.de:24133

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    iuis.exe

  • copy_folder

    oiujhy

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    true

  • keylog_file

    uhyg.dat

  • keylog_flag

    false

  • keylog_folder

    juhg

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    iuyhg-XOY14N

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    oiu

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    notepad;solitaire;

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • suricata: ET MALWARE Remocs 3.x Unencrypted Checkin

    suricata: ET MALWARE Remocs 3.x Unencrypted Checkin

  • suricata: ET MALWARE Remocs 3.x Unencrypted Server Response

    suricata: ET MALWARE Remocs 3.x Unencrypted Server Response

  • Blocklisted process makes network request 20 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\RFQ 090701-2021-PTSC-HTS-03 - 001.js"
    1⤵
    • Blocklisted process makes network request
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:908
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\DAnQFuQTxS.js"
      2⤵
      • Blocklisted process makes network request
      • Drops startup file
      • Adds Run key to start application
      PID:3568
    • C:\Users\Admin\AppData\Roaming\RealTD.exe
      "C:\Users\Admin\AppData\Roaming\RealTD.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3396
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3752
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3144
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2964
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3936
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4680
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Yxhsejzjeoyikbzsvpou.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4708
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Application\88chrome.exe'
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4364
      • C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
        C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4756

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    MD5

    e71a0a7e48b10bde0a9c54387762f33e

    SHA1

    fed75947f1163b00096e24a46e67d9c21e7eeebd

    SHA256

    83d7be67d0eb544d655cc8e8eb687c26f772d6a40ebf8394e5c12b248976a2de

    SHA512

    394c25daef6143de894505189b1edcdffb82fd6ab9de1c9e43865fb790803ff5c384debfe16236d4a9d95a78d3eea548d3cef332ed5a6881ac9c50d252c3c34a

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

    MD5

    c2d06c11dd1f1a8b1dedc1a311ca8cdc

    SHA1

    75c07243f9cb80a9c7aed2865f9c5192cc920e7e

    SHA256

    91ac15f1f176f74f02ce89ecdc443d8e33e0064c7bc69a87c7b2da145449d586

    SHA512

    db00860292c3e7430b1534f459c2f0f9778df3a94c51d622dcf1cde390a5539bdc6d60a0d41e6f1ed99a989f17ecb109abd4c17faac4cd398945536f1d0ebb4d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

    MD5

    c2d06c11dd1f1a8b1dedc1a311ca8cdc

    SHA1

    75c07243f9cb80a9c7aed2865f9c5192cc920e7e

    SHA256

    91ac15f1f176f74f02ce89ecdc443d8e33e0064c7bc69a87c7b2da145449d586

    SHA512

    db00860292c3e7430b1534f459c2f0f9778df3a94c51d622dcf1cde390a5539bdc6d60a0d41e6f1ed99a989f17ecb109abd4c17faac4cd398945536f1d0ebb4d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

    MD5

    c2d06c11dd1f1a8b1dedc1a311ca8cdc

    SHA1

    75c07243f9cb80a9c7aed2865f9c5192cc920e7e

    SHA256

    91ac15f1f176f74f02ce89ecdc443d8e33e0064c7bc69a87c7b2da145449d586

    SHA512

    db00860292c3e7430b1534f459c2f0f9778df3a94c51d622dcf1cde390a5539bdc6d60a0d41e6f1ed99a989f17ecb109abd4c17faac4cd398945536f1d0ebb4d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

    MD5

    c2d06c11dd1f1a8b1dedc1a311ca8cdc

    SHA1

    75c07243f9cb80a9c7aed2865f9c5192cc920e7e

    SHA256

    91ac15f1f176f74f02ce89ecdc443d8e33e0064c7bc69a87c7b2da145449d586

    SHA512

    db00860292c3e7430b1534f459c2f0f9778df3a94c51d622dcf1cde390a5539bdc6d60a0d41e6f1ed99a989f17ecb109abd4c17faac4cd398945536f1d0ebb4d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    MD5

    34ff02ad9256c1eb1fcc85313d150ae5

    SHA1

    81fe5653ea6a27c56be105cfc2dae630dca8910c

    SHA256

    0cbe99cf8f0fb76b6b99c7b8879a9a68c38a5dc288f7303b1bd6cec1cbdda749

    SHA512

    b5c3b1b757c8a68b8d3c38eaf889961af1fd39414cb02407e6a33099bbd272b81e54ce8c6f7af2f77f4068b7596a81b3c57f4b7240a2162ad4a763bca9025e80

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    MD5

    8a198c24aa1a556e2c5d939afa1cda37

    SHA1

    86d33dfb8b4ff0ba61e0224b6e46019c488c12da

    SHA256

    1cbd16a3a0ada4ae15ee4c999d87b36c4247d8a7bb542d807b4e3aba966b4a9a

    SHA512

    f1e74e8e5fbcd029adfa232ed59a875453a61c233032260073a65075ac60c2ea8ee1c1ee5704171fb4ce82908b4aa9b3a7e46c5d7d17dfd8dc53208e5a579460

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    MD5

    cd92f97818a797e1ddab27ca6724f1c4

    SHA1

    e40240ec50b672ee894e41aa777d30f7f17c25a3

    SHA256

    1f4e9fc873f2c95f637aea5168094fc67ade61b1addf9340dd0703ad8a6b9519

    SHA512

    1d64cb88d5207ee299232c046306821059d10bd754d5d5d5a565429ad37f9052cdb8d3f92724d72a3de798c6c7b5fd946ff3ea930bbb65319631e7c15be456af

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    MD5

    cd92f97818a797e1ddab27ca6724f1c4

    SHA1

    e40240ec50b672ee894e41aa777d30f7f17c25a3

    SHA256

    1f4e9fc873f2c95f637aea5168094fc67ade61b1addf9340dd0703ad8a6b9519

    SHA512

    1d64cb88d5207ee299232c046306821059d10bd754d5d5d5a565429ad37f9052cdb8d3f92724d72a3de798c6c7b5fd946ff3ea930bbb65319631e7c15be456af

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    MD5

    6c7a01ea377e6bf286914b074f4826cc

    SHA1

    0e74f75a8dff063c1962defdd10e94c95536faae

    SHA256

    313c20751ec306d36ed127462ba90f975187da408a1268db725c61460c114a3d

    SHA512

    39870e1ae048fc31a11cfea7197f31bc767f24c90ad7198937e9991ab0df3f49f034911974e9abf5f4823ca72f31a89ca88f1e8440870ce0789c80eb05d35c87

  • C:\Users\Admin\AppData\Local\Temp\RegAsm.exe

    MD5

    b58b926c3574d28d5b7fdd2ca3ec30d5

    SHA1

    d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

    SHA256

    6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

    SHA512

    b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

  • C:\Users\Admin\AppData\Local\Temp\RegAsm.exe

    MD5

    b58b926c3574d28d5b7fdd2ca3ec30d5

    SHA1

    d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

    SHA256

    6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

    SHA512

    b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

  • C:\Users\Admin\AppData\Local\Temp\_Yxhsejzjeoyikbzsvpou.vbs

    MD5

    58110be0ac011269eed3af47649b186e

    SHA1

    a101dfc0b418a0881b8c9ac84905a2c09f7c259a

    SHA256

    7a806bad9bd7ed3e18754b5e4e59a364e0811a714b2ff0218f59062f872c01cd

    SHA512

    abaa07f2996aeca4cf810405d80804affa8d2a9153be71c6c8453000aa2e734edcb0b4cc611241caea5e41abf40b0aa777b4e4cc43518e145a81b39f66fe4819

  • C:\Users\Admin\AppData\Roaming\DAnQFuQTxS.js

    MD5

    5999fd94493466a8f93e917e7f3cfbd4

    SHA1

    d987297b21fcfdb9bad18338acaebb8f33b12a02

    SHA256

    8d1d8fb0d337eed819801d7c389aeb0f66371c23c33c825fe59bb15109914545

    SHA512

    2ce5a93376652ff25689492ba714dddab310ef0ccfcee2ef916caeeca21448e1731001db4777e9bbfce49958b4fe2e5a7e15f39206b4c763859ae1df237da350

  • C:\Users\Admin\AppData\Roaming\RealTD.exe

    MD5

    ef31adabfc53d3d23ca2535918db2cc6

    SHA1

    7479e2e39cb52e3972ef8b60bd51570ffcdb3a31

    SHA256

    05c81dca5026782b10339282d62291ee4153d1e4952c6062be97481849ac1d2a

    SHA512

    4f6ba8a83cafa8e15fd0711a2b99865190be52d09fb60fa6c1d5e63d13421caa1a6141d090e2c44bf0e070328d47a116d5c5cedbbd728ad0f66a13851cac3943

  • C:\Users\Admin\AppData\Roaming\RealTD.exe

    MD5

    ef31adabfc53d3d23ca2535918db2cc6

    SHA1

    7479e2e39cb52e3972ef8b60bd51570ffcdb3a31

    SHA256

    05c81dca5026782b10339282d62291ee4153d1e4952c6062be97481849ac1d2a

    SHA512

    4f6ba8a83cafa8e15fd0711a2b99865190be52d09fb60fa6c1d5e63d13421caa1a6141d090e2c44bf0e070328d47a116d5c5cedbbd728ad0f66a13851cac3943

  • memory/2964-292-0x0000000006650000-0x0000000006651000-memory.dmp

    Filesize

    4KB

  • memory/2964-358-0x0000000006653000-0x0000000006654000-memory.dmp

    Filesize

    4KB

  • memory/2964-294-0x0000000006652000-0x0000000006653000-memory.dmp

    Filesize

    4KB

  • memory/2964-265-0x0000000000000000-mapping.dmp

  • memory/3144-197-0x0000000004273000-0x0000000004274000-memory.dmp

    Filesize

    4KB

  • memory/3144-158-0x0000000004270000-0x0000000004271000-memory.dmp

    Filesize

    4KB

  • memory/3144-159-0x0000000004272000-0x0000000004273000-memory.dmp

    Filesize

    4KB

  • memory/3144-147-0x0000000000000000-mapping.dmp

  • memory/3396-121-0x00000000051F0000-0x00000000051F1000-memory.dmp

    Filesize

    4KB

  • memory/3396-124-0x0000000004CF0000-0x00000000051EE000-memory.dmp

    Filesize

    5.0MB

  • memory/3396-123-0x0000000004C70000-0x0000000004C71000-memory.dmp

    Filesize

    4KB

  • memory/3396-122-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

    Filesize

    4KB

  • memory/3396-119-0x00000000003B0000-0x00000000003B1000-memory.dmp

    Filesize

    4KB

  • memory/3396-116-0x0000000000000000-mapping.dmp

  • memory/3568-114-0x0000000000000000-mapping.dmp

  • memory/3752-169-0x0000000006D63000-0x0000000006D64000-memory.dmp

    Filesize

    4KB

  • memory/3752-170-0x000000000A610000-0x000000000A611000-memory.dmp

    Filesize

    4KB

  • memory/3752-134-0x0000000007C50000-0x0000000007C51000-memory.dmp

    Filesize

    4KB

  • memory/3752-145-0x00000000091E0000-0x00000000091E1000-memory.dmp

    Filesize

    4KB

  • memory/3752-135-0x0000000007CE0000-0x0000000007CE1000-memory.dmp

    Filesize

    4KB

  • memory/3752-136-0x0000000008080000-0x0000000008081000-memory.dmp

    Filesize

    4KB

  • memory/3752-137-0x00000000081C0000-0x00000000081C1000-memory.dmp

    Filesize

    4KB

  • memory/3752-133-0x0000000007AE0000-0x0000000007AE1000-memory.dmp

    Filesize

    4KB

  • memory/3752-138-0x00000000084F0000-0x00000000084F1000-memory.dmp

    Filesize

    4KB

  • memory/3752-128-0x0000000006D00000-0x0000000006D01000-memory.dmp

    Filesize

    4KB

  • memory/3752-143-0x00000000094F0000-0x00000000094F1000-memory.dmp

    Filesize

    4KB

  • memory/3752-144-0x0000000009170000-0x0000000009171000-memory.dmp

    Filesize

    4KB

  • memory/3752-132-0x0000000007A40000-0x0000000007A41000-memory.dmp

    Filesize

    4KB

  • memory/3752-125-0x0000000000000000-mapping.dmp

  • memory/3752-131-0x0000000006D62000-0x0000000006D63000-memory.dmp

    Filesize

    4KB

  • memory/3752-130-0x0000000006D60000-0x0000000006D61000-memory.dmp

    Filesize

    4KB

  • memory/3752-129-0x00000000073A0000-0x00000000073A1000-memory.dmp

    Filesize

    4KB

  • memory/3936-561-0x0000000004263000-0x0000000004264000-memory.dmp

    Filesize

    4KB

  • memory/3936-429-0x0000000004260000-0x0000000004261000-memory.dmp

    Filesize

    4KB

  • memory/3936-423-0x0000000000000000-mapping.dmp

  • memory/3936-430-0x0000000004262000-0x0000000004263000-memory.dmp

    Filesize

    4KB

  • memory/4364-1343-0x0000000004653000-0x0000000004654000-memory.dmp

    Filesize

    4KB

  • memory/4364-1342-0x000000007EA40000-0x000000007EA41000-memory.dmp

    Filesize

    4KB

  • memory/4364-1271-0x0000000004652000-0x0000000004653000-memory.dmp

    Filesize

    4KB

  • memory/4364-1270-0x0000000004650000-0x0000000004651000-memory.dmp

    Filesize

    4KB

  • memory/4364-1258-0x0000000000000000-mapping.dmp

  • memory/4680-616-0x00000000072A0000-0x00000000072A1000-memory.dmp

    Filesize

    4KB

  • memory/4680-549-0x0000000000000000-mapping.dmp

  • memory/4680-708-0x00000000072A3000-0x00000000072A4000-memory.dmp

    Filesize

    4KB

  • memory/4680-619-0x00000000072A2000-0x00000000072A3000-memory.dmp

    Filesize

    4KB

  • memory/4708-1252-0x0000000000000000-mapping.dmp

  • memory/4756-1269-0x0000000000400000-0x0000000000479000-memory.dmp

    Filesize

    484KB

  • memory/4756-1255-0x000000000042F76C-mapping.dmp