Overview

overview

10

Static

static

c052f22aca...95.exe

windows10_x64

10

Analysis

  • max time kernel
    64s
  • max time network
    67s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    23-01-2022 13:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c052f22acab9a9a413f996e88e8d86029ec5b80b5f182e7140871ccbe8a14a95.exe

  • Size

    320KB

  • MD5

    95312ffb418f599490bcfbe0ec0d79fd

  • SHA1

    142960086945f1e2b00027d659a0a149eee6414c

  • SHA256

    c052f22acab9a9a413f996e88e8d86029ec5b80b5f182e7140871ccbe8a14a95

  • SHA512

    9df9db299fc216d98e3d28fef9abb0cf217bad3ac2241c004b6e789d7c27a9a8c1305aa68a876561a646ad303b69d55c957450b0a4b5c2da0e70df59565ce140

Score
10/10
remcosremotehostrat

Malware Config

Extracted

Family

remcos

Version

3.3.2 Pro

Botnet

RemoteHost

C2

generem.hopto.org:2404

generem1.hopto.org:2404

hendersonk.hopto.org:2404

hendersonk1.hopto.org:2404

gene.ddnsgeek.com:2404

henderson.camdvr.org:2404

henderson1.camdvr.org:2404
Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    MediaGallery-7W4I14

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    notepad;solitaire;

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Downloads MZ/PE file
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 45 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c052f22acab9a9a413f996e88e8d86029ec5b80b5f182e7140871ccbe8a14a95.exe
    "C:\Users\Admin\AppData\Local\Temp\c052f22acab9a9a413f996e88e8d86029ec5b80b5f182e7140871ccbe8a14a95.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2372
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:668
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3644

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/668-122-0x0000000000400000-0x000000000047B000-memory.dmp
    Filesize

    492KB

    Download
  • memory/668-123-0x0000000000400000-0x000000000047B000-memory.dmp
    Filesize

    492KB

    Download
  • memory/668-124-0x0000000000400000-0x000000000047B000-memory.dmp
    Filesize

    492KB

    Download
  • memory/2372-115-0x0000000000F80000-0x0000000000FD6000-memory.dmp
    Filesize

    344KB

    Download
  • memory/2372-116-0x0000000005CC0000-0x00000000061BE000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/2372-117-0x0000000005860000-0x00000000058F2000-memory.dmp
    Filesize

    584KB

    Download
  • memory/2372-118-0x0000000005810000-0x000000000581A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/2372-119-0x00000000057C0000-0x0000000005CBE000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/2372-120-0x00000000057C0000-0x0000000005CBE000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/2372-121-0x0000000009A70000-0x0000000009ABC000-memory.dmp
    Filesize

    304KB

    Download