PI20200206AP,pdf.iso

General
Target

PI20200206AP,pdf.exe

Filesize

973KB

Completed

21-10-2021 13:07

Score
10/10
MD5

d96b6070b2724d3d7a47cbb59d414c9d

SHA1

ec6221a6ff1cd193c4d12e2b932f5ae2bc86abba

SHA256

3bfb18b65c870e3c012f8d38fa70ea7441d6b09530e5f77d837d636c0e2abd0d

Malware Config

Extracted

Family remcos
Version 3.2.0 Pro
Botnet ZUBBY
C2

newlogs.ddns.net:7143

Attributes
audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-0OL7CZ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;
Signatures 4

Filter: none

Defense Evasion
Persistence
  • Remcos

    Description

    Remcos is a closed-source remote control and surveillance software.

    Tags

  • Adds Run key to start application
    PI20200206AP,pdf.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\Krgrgu = "C:\\Users\\Public\\ugrgrK.url"PI20200206AP,pdf.exe
  • Modifies registry key
    reg.exereg.exereg.exe

    TTPs

    Modify Registry

    Reported IOCs

    pidprocess
    604reg.exe
    852reg.exe
    1248reg.exe
  • Suspicious use of WriteProcessMemory
    PI20200206AP,pdf.execmd.execmd.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4028 wrote to memory of 15004028PI20200206AP,pdf.exemobsync.exe
    PID 4028 wrote to memory of 15004028PI20200206AP,pdf.exemobsync.exe
    PID 4028 wrote to memory of 15004028PI20200206AP,pdf.exemobsync.exe
    PID 4028 wrote to memory of 15004028PI20200206AP,pdf.exemobsync.exe
    PID 4028 wrote to memory of 15004028PI20200206AP,pdf.exemobsync.exe
    PID 4028 wrote to memory of 15004028PI20200206AP,pdf.exemobsync.exe
    PID 4028 wrote to memory of 15004028PI20200206AP,pdf.exemobsync.exe
    PID 4028 wrote to memory of 15004028PI20200206AP,pdf.exemobsync.exe
    PID 4028 wrote to memory of 15004028PI20200206AP,pdf.exemobsync.exe
    PID 4028 wrote to memory of 15004028PI20200206AP,pdf.exemobsync.exe
    PID 4028 wrote to memory of 15004028PI20200206AP,pdf.exemobsync.exe
    PID 4028 wrote to memory of 15004028PI20200206AP,pdf.exemobsync.exe
    PID 4028 wrote to memory of 15004028PI20200206AP,pdf.exemobsync.exe
    PID 4028 wrote to memory of 15004028PI20200206AP,pdf.exemobsync.exe
    PID 4028 wrote to memory of 15004028PI20200206AP,pdf.exemobsync.exe
    PID 4028 wrote to memory of 14244028PI20200206AP,pdf.execmd.exe
    PID 4028 wrote to memory of 14244028PI20200206AP,pdf.execmd.exe
    PID 4028 wrote to memory of 14244028PI20200206AP,pdf.execmd.exe
    PID 1424 wrote to memory of 18161424cmd.execmd.exe
    PID 1424 wrote to memory of 18161424cmd.execmd.exe
    PID 1424 wrote to memory of 18161424cmd.execmd.exe
    PID 1816 wrote to memory of 6041816cmd.exereg.exe
    PID 1816 wrote to memory of 6041816cmd.exereg.exe
    PID 1816 wrote to memory of 6041816cmd.exereg.exe
    PID 1816 wrote to memory of 8521816cmd.exereg.exe
    PID 1816 wrote to memory of 8521816cmd.exereg.exe
    PID 1816 wrote to memory of 8521816cmd.exereg.exe
    PID 1816 wrote to memory of 8961816cmd.exeschtasks.exe
    PID 1816 wrote to memory of 8961816cmd.exeschtasks.exe
    PID 1816 wrote to memory of 8961816cmd.exeschtasks.exe
    PID 4028 wrote to memory of 13204028PI20200206AP,pdf.execmd.exe
    PID 4028 wrote to memory of 13204028PI20200206AP,pdf.execmd.exe
    PID 4028 wrote to memory of 13204028PI20200206AP,pdf.execmd.exe
    PID 1320 wrote to memory of 12481320cmd.exereg.exe
    PID 1320 wrote to memory of 12481320cmd.exereg.exe
    PID 1320 wrote to memory of 12481320cmd.exereg.exe
Processes 9
  • C:\Users\Admin\AppData\Local\Temp\PI20200206AP,pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\PI20200206AP,pdf.exe"
    Adds Run key to start application
    Suspicious use of WriteProcessMemory
    PID:4028
    • C:\Windows\SysWOW64\mobsync.exe
      C:\Windows\System32\mobsync.exe
      PID:1500
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Trast.bat" "
      Suspicious use of WriteProcessMemory
      PID:1424
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
        Suspicious use of WriteProcessMemory
        PID:1816
        • C:\Windows\SysWOW64\reg.exe
          reg delete hkcu\Environment /v windir /f
          Modifies registry key
          PID:604
        • C:\Windows\SysWOW64\reg.exe
          reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
          Modifies registry key
          PID:852
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
          PID:896
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Public\nest.bat" "
      Suspicious use of WriteProcessMemory
      PID:1320
      • C:\Windows\SysWOW64\reg.exe
        reg delete hkcu\Environment /v windir /f
        Modifies registry key
        PID:1248
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Public\Trast.bat

                        MD5

                        4068c9f69fcd8a171c67f81d4a952a54

                        SHA1

                        4d2536a8c28cdcc17465e20d6693fb9e8e713b36

                        SHA256

                        24222300c78180b50ed1f8361ba63cb27316ec994c1c9079708a51b4a1a9d810

                        SHA512

                        a64f9319acc51fffd0491c74dcd9c9084c2783b82f95727e4bfe387a8528c6dcf68f11418e88f1e133d115daf907549c86dd7ad866b2a7938add5225fbb2811d

                      • C:\Users\Public\UKO.bat

                        MD5

                        eaf8d967454c3bbddbf2e05a421411f8

                        SHA1

                        6170880409b24de75c2dc3d56a506fbff7f6622c

                        SHA256

                        f35f2658455a2e40f151549a7d6465a836c33fa9109e67623916f889849eac56

                        SHA512

                        fe5be5c673e99f70c93019d01abb0a29dd2ecf25b2d895190ff551f020c28e7d8f99f65007f440f0f76c5bcac343b2a179a94d190c938ea3b9e1197890a412e9

                      • C:\Users\Public\nest.bat

                        MD5

                        8ada51400b7915de2124baaf75e3414c

                        SHA1

                        1a7b9db12184ab7fd7fce1c383f9670a00adb081

                        SHA256

                        45aa3957c29865260a78f03eef18ae9aebdbf7bea751ecc88be4a799f2bb46c7

                        SHA512

                        9afc138157a4565294ca49942579cdb6f5d8084e56f9354738de62b585f4c0fa3e7f2cbc9541827f2084e3ff36c46eed29b46f5dd2444062ffcd05c599992e68

                      • memory/604-122-0x0000000000000000-mapping.dmp

                      • memory/852-123-0x0000000000000000-mapping.dmp

                      • memory/896-124-0x0000000000000000-mapping.dmp

                      • memory/1248-132-0x0000000000000000-mapping.dmp

                      • memory/1320-130-0x0000000000000000-mapping.dmp

                      • memory/1424-118-0x0000000000000000-mapping.dmp

                      • memory/1500-128-0x0000000072600000-0x000000007267C000-memory.dmp

                      • memory/1500-126-0x00000000030D0000-0x00000000030D1000-memory.dmp

                      • memory/1500-125-0x0000000003010000-0x0000000003011000-memory.dmp

                      • memory/1500-127-0x0000000003030000-0x0000000003031000-memory.dmp

                      • memory/1500-129-0x0000000000400000-0x0000000000479000-memory.dmp

                      • memory/1500-117-0x0000000000000000-mapping.dmp

                      • memory/1816-120-0x0000000000000000-mapping.dmp

                      • memory/4028-116-0x00000000006A1000-0x00000000006B5000-memory.dmp

                      • memory/4028-115-0x0000000000500000-0x00000000005AE000-memory.dmp