Overview

overview

10

Static

static

c052f22aca...95.exe

windows10_x64

10

Analysis

  • max time kernel
    58s
  • max time network
    63s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    23-01-2022 13:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c052f22acab9a9a413f996e88e8d86029ec5b80b5f182e7140871ccbe8a14a95.exe

  • Size

    320KB

  • MD5

    95312ffb418f599490bcfbe0ec0d79fd

  • SHA1

    142960086945f1e2b00027d659a0a149eee6414c

  • SHA256

    c052f22acab9a9a413f996e88e8d86029ec5b80b5f182e7140871ccbe8a14a95

  • SHA512

    9df9db299fc216d98e3d28fef9abb0cf217bad3ac2241c004b6e789d7c27a9a8c1305aa68a876561a646ad303b69d55c957450b0a4b5c2da0e70df59565ce140

Score
10/10
remcosremotehostrat

Malware Config

Extracted

Family

remcos

Version

3.3.2 Pro

Botnet

RemoteHost

C2

generem.hopto.org:2404

generem1.hopto.org:2404

hendersonk.hopto.org:2404

hendersonk1.hopto.org:2404

gene.ddnsgeek.com:2404

henderson.camdvr.org:2404

henderson1.camdvr.org:2404
Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    MediaGallery-7W4I14

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    notepad;solitaire;

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Downloads MZ/PE file
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 48 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c052f22acab9a9a413f996e88e8d86029ec5b80b5f182e7140871ccbe8a14a95.exe
    "C:\Users\Admin\AppData\Local\Temp\c052f22acab9a9a413f996e88e8d86029ec5b80b5f182e7140871ccbe8a14a95.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2764
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:988
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • Suspicious use of SetWindowsHookEx
        PID:2972
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\Admin\Desktop\StepExpand.shtml
      1⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1144
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xd0,0xd4,0xd8,0xcc,0xdc,0x7ffdabf84f50,0x7ffdabf84f60,0x7ffdabf84f70
        2⤵
          PID:2240
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1516,13157855691632134627,17747079904828692940,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1540 /prefetch:2
          2⤵
            PID:1664
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1516,13157855691632134627,17747079904828692940,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1732 /prefetch:8
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:1792
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1516,13157855691632134627,17747079904828692940,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2112 /prefetch:8
            2⤵
              PID:836
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,13157855691632134627,17747079904828692940,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2672 /prefetch:1
              2⤵
                PID:2216
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1516,13157855691632134627,17747079904828692940,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2680 /prefetch:1
                2⤵
                  PID:2500
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1516,13157855691632134627,17747079904828692940,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4136 /prefetch:8
                  2⤵
                    PID:696
                • C:\Windows\system32\taskmgr.exe
                  "C:\Windows\system32\taskmgr.exe" /4
                  1⤵
                  • Checks SCSI registry key(s)
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:1968
                • C:\Windows\system32\werfault.exe
                  werfault.exe /h /shared Global\165cc6877fb54aab9167ba4654102eaf /t 2316 /p 1968
                  1⤵
                    PID:1700
                  • C:\Windows\System32\SystemSettingsBroker.exe
                    C:\Windows\System32\SystemSettingsBroker.exe -Embedding
                    1⤵
                      PID:3820
                    • \??\c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc
                      1⤵
                        PID:2824
                      • \??\c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k localservice -s SstpSvc
                        1⤵
                          PID:1248
                        • \??\c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
                          1⤵
                          • Drops file in Windows directory
                          • Checks SCSI registry key(s)
                          PID:3668
                        • \??\c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
                          1⤵
                          • Drops file in Windows directory
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3772
                        • \??\c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s RasMan
                          1⤵
                            PID:2324
                          • C:\Windows\system32\taskmgr.exe
                            "C:\Windows\system32\taskmgr.exe" /4
                            1⤵
                              PID:1056

                            Network

                            MITRE ATT&CK Matrix ATT&CK v6

                            Initial Access

                            Execution

                            Persistence

                            Privilege Escalation

                            Defense Evasion

                            Credential Access

                            Discovery

                            Query Registry

                            2
                            T1012

                            Peripheral Device Discovery

                            1
                            T1120

                            System Information Discovery

                            2
                            T1082

                            Lateral Movement

                            Collection

                            Exfiltration

                            Command and Control

                            Impact

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Windows\INF\netrasa.PNF
                              MD5

                              2f824bb2a5c94294cda5cbee4472e21f

                              SHA1

                              adc83c262ada398c3bf095e7c6061aea0f93e00b

                              SHA256

                              d8176fc8defa31b394579b79333229dff4061745c87833a9d674c11af08cda23

                              SHA512

                              e4b31f526b171e717ff23231b77e07420cb7d1cc1637dd943d167b800c9d6afd3a793bde1c2f767791723b2825cff9e4083c0756a441fee21abe413767095f86

                              Download Submit
                            • C:\Windows\INF\netsstpa.PNF
                              MD5

                              01e21456e8000bab92907eec3b3aeea9

                              SHA1

                              39b34fe438352f7b095e24c89968fca48b8ce11c

                              SHA256

                              35ad0403fdef3fce3ef5cd311c72fef2a95a317297a53c02735cda4bd6e0c74f

                              SHA512

                              9d5153450e8fe3f51f20472bae4a2ab2fed43fad61a89b04a70325559f6ffed935dd72212671cc6cfc0288458d359bc71567f0d9af8e5770d696adc5bdadd7ec

                              Download Submit
                            • \??\pipe\crashpad_1144_CXOCSBCUFIIUCWFM
                              MD5

                              d41d8cd98f00b204e9800998ecf8427e

                              SHA1

                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                              SHA256

                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                              SHA512

                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                              Download Submit
                            • memory/2764-121-0x0000000009310000-0x000000000935C000-memory.dmp
                              Filesize

                              304KB

                              Download
                            • memory/2764-119-0x00000000050E0000-0x00000000050EA000-memory.dmp
                              Filesize

                              40KB

                              Download
                            • memory/2764-120-0x0000000005050000-0x000000000554E000-memory.dmp
                              Filesize

                              5.0MB

                              Download
                            • memory/2764-115-0x0000000000710000-0x0000000000766000-memory.dmp
                              Filesize

                              344KB

                              Download
                            • memory/2764-118-0x0000000005050000-0x000000000554E000-memory.dmp
                              Filesize

                              5.0MB

                              Download
                            • memory/2764-117-0x00000000050F0000-0x0000000005182000-memory.dmp
                              Filesize

                              584KB

                              Download
                            • memory/2764-116-0x0000000005550000-0x0000000005A4E000-memory.dmp
                              Filesize

                              5.0MB

                              Download
                            • memory/2972-122-0x0000000000400000-0x000000000047B000-memory.dmp
                              Filesize

                              492KB

                              Download
                            • memory/2972-124-0x0000000000400000-0x000000000047B000-memory.dmp
                              Filesize

                              492KB

                              Download
                            • memory/2972-125-0x0000000000400000-0x000000000047B000-memory.dmp
                              Filesize

                              492KB

                              Download