Analysis
- max time kernel
156s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
09/02/2022, 15:19
Static task
static1
Behavioral task
behavioral1
Sample
Xhsjvezljjvyeubpsyvkjosttfnghnibfs.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Xhsjvezljjvyeubpsyvkjosttfnghnibfs.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target Xhsjvezljjvyeubpsyvkjosttfnghnibfs.exe
- Size 963KB
- Sample220209-sp67nsagb2
- SHA256 8b7ae9f195b075a789d6d8277d500d27754bfa3c53ecca8db7beac8ccd07884f
- MD5 97d9d216f2627cb238ca6637580b1739
- SHA1 55cbf8dae95d350ad7e5a63b418f6cd203488f51
- SHA512 358dfda59c2d89d0457b91fb94ad812ec03edd693adde60bcdea598d12cae48637449dfc864b7980b2f92c3fb1459c6444dbf9d7e69be4114dbabca504572384
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
remcos
Botnet
-
bitrem2022
C2
-
u864243.northcentralus.cloudapp.azure.com:2404
-
bitrem2022.northcentralus.cloudapp.azure.com:2404
Attributes
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
bitrem2022
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
bitrem2022-2AU1R6
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
notepad;solitaire;
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3604 easinvoker.exe - Loads dropped DLL 1 IoCs
pid Process 3604 easinvoker.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Xhsjvezl = "C:\\Users\\Admin\\lzevjshX.url" Xhsjvezljjvyeubpsyvkjosttfnghnibfs.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 1544 PING.EXE - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2748 powershell.exe 2748 powershell.exe 2748 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2188 svchost.exe Token: SeCreatePagefilePrivilege 2188 svchost.exe Token: SeShutdownPrivilege 2188 svchost.exe Token: SeCreatePagefilePrivilege 2188 svchost.exe Token: SeShutdownPrivilege 2188 svchost.exe Token: SeCreatePagefilePrivilege 2188 svchost.exe Token: SeDebugPrivilege 2748 powershell.exe Token: SeSecurityPrivilege 4568 TiWorker.exe Token: SeRestorePrivilege 4568 TiWorker.exe Token: SeBackupPrivilege 4568 TiWorker.exe Token: SeBackupPrivilege 4568 TiWorker.exe Token: SeRestorePrivilege 4568 TiWorker.exe Token: SeSecurityPrivilege 4568 TiWorker.exe Token: SeBackupPrivilege 4568 TiWorker.exe Token: SeRestorePrivilege 4568 TiWorker.exe Token: SeSecurityPrivilege 4568 TiWorker.exe Token: SeBackupPrivilege 4568 TiWorker.exe Token: SeRestorePrivilege 4568 TiWorker.exe Token: SeSecurityPrivilege 4568 TiWorker.exe Token: SeBackupPrivilege 4568 TiWorker.exe Token: SeRestorePrivilege 4568 TiWorker.exe Token: SeSecurityPrivilege 4568 TiWorker.exe Token: SeBackupPrivilege 4568 TiWorker.exe Token: SeRestorePrivilege 4568 TiWorker.exe Token: SeSecurityPrivilege 4568 TiWorker.exe Token: SeBackupPrivilege 4568 TiWorker.exe Token: SeRestorePrivilege 4568 TiWorker.exe Token: SeSecurityPrivilege 4568 TiWorker.exe Token: SeBackupPrivilege 4568 TiWorker.exe Token: SeRestorePrivilege 4568 TiWorker.exe Token: SeSecurityPrivilege 4568 TiWorker.exe Token: SeBackupPrivilege 4568 TiWorker.exe Token: SeRestorePrivilege 4568 TiWorker.exe Token: SeSecurityPrivilege 4568 TiWorker.exe Token: SeBackupPrivilege 4568 TiWorker.exe Token: SeRestorePrivilege 4568 TiWorker.exe Token: SeSecurityPrivilege 4568 TiWorker.exe Token: SeBackupPrivilege 4568 TiWorker.exe Token: SeRestorePrivilege 4568 TiWorker.exe Token: SeSecurityPrivilege 4568 TiWorker.exe Token: SeBackupPrivilege 4568 TiWorker.exe Token: SeRestorePrivilege 4568 TiWorker.exe Token: SeSecurityPrivilege 4568 TiWorker.exe Token: SeBackupPrivilege 4568 TiWorker.exe Token: SeRestorePrivilege 4568 TiWorker.exe Token: SeSecurityPrivilege 4568 TiWorker.exe Token: SeBackupPrivilege 4568 TiWorker.exe Token: SeRestorePrivilege 4568 TiWorker.exe Token: SeSecurityPrivilege 4568 TiWorker.exe Token: SeBackupPrivilege 4568 TiWorker.exe Token: SeRestorePrivilege 4568 TiWorker.exe Token: SeSecurityPrivilege 4568 TiWorker.exe Token: SeBackupPrivilege 4568 TiWorker.exe Token: SeRestorePrivilege 4568 TiWorker.exe Token: SeSecurityPrivilege 4568 TiWorker.exe Token: SeBackupPrivilege 4568 TiWorker.exe Token: SeRestorePrivilege 4568 TiWorker.exe Token: SeSecurityPrivilege 4568 TiWorker.exe Token: SeBackupPrivilege 4568 TiWorker.exe Token: SeRestorePrivilege 4568 TiWorker.exe Token: SeSecurityPrivilege 4568 TiWorker.exe Token: SeBackupPrivilege 4568 TiWorker.exe Token: SeRestorePrivilege 4568 TiWorker.exe Token: SeSecurityPrivilege 4568 TiWorker.exe - Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 1016 wrote to memory of 3184 1016 Xhsjvezljjvyeubpsyvkjosttfnghnibfs.exe 87 PID 1016 wrote to memory of 3184 1016 Xhsjvezljjvyeubpsyvkjosttfnghnibfs.exe 87 PID 1016 wrote to memory of 3184 1016 Xhsjvezljjvyeubpsyvkjosttfnghnibfs.exe 87 PID 1016 wrote to memory of 3184 1016 Xhsjvezljjvyeubpsyvkjosttfnghnibfs.exe 87 PID 1016 wrote to memory of 3184 1016 Xhsjvezljjvyeubpsyvkjosttfnghnibfs.exe 87 PID 1016 wrote to memory of 3184 1016 Xhsjvezljjvyeubpsyvkjosttfnghnibfs.exe 87 PID 1016 wrote to memory of 3184 1016 Xhsjvezljjvyeubpsyvkjosttfnghnibfs.exe 87 PID 1016 wrote to memory of 3184 1016 Xhsjvezljjvyeubpsyvkjosttfnghnibfs.exe 87 PID 1016 wrote to memory of 3184 1016 Xhsjvezljjvyeubpsyvkjosttfnghnibfs.exe 87 PID 1016 wrote to memory of 3184 1016 Xhsjvezljjvyeubpsyvkjosttfnghnibfs.exe 87 PID 1016 wrote to memory of 3184 1016 Xhsjvezljjvyeubpsyvkjosttfnghnibfs.exe 87 PID 1016 wrote to memory of 3184 1016 Xhsjvezljjvyeubpsyvkjosttfnghnibfs.exe 87 PID 1016 wrote to memory of 3184 1016 Xhsjvezljjvyeubpsyvkjosttfnghnibfs.exe 87 PID 1016 wrote to memory of 3184 1016 Xhsjvezljjvyeubpsyvkjosttfnghnibfs.exe 87 PID 1016 wrote to memory of 3184 1016 Xhsjvezljjvyeubpsyvkjosttfnghnibfs.exe 87 PID 1016 wrote to memory of 1816 1016 Xhsjvezljjvyeubpsyvkjosttfnghnibfs.exe 89 PID 1016 wrote to memory of 1816 1016 Xhsjvezljjvyeubpsyvkjosttfnghnibfs.exe 89 PID 1016 wrote to memory of 1816 1016 Xhsjvezljjvyeubpsyvkjosttfnghnibfs.exe 89 PID 1816 wrote to memory of 2016 1816 cmd.exe 91 PID 1816 wrote to memory of 2016 1816 cmd.exe 91 PID 1816 wrote to memory of 2016 1816 cmd.exe 91 PID 2016 wrote to memory of 2812 2016 cmd.exe 93 PID 2016 wrote to memory of 2812 2016 cmd.exe 93 PID 2016 wrote to memory of 2812 2016 cmd.exe 93 PID 2016 wrote to memory of 3048 2016 cmd.exe 94 PID 2016 wrote to memory of 3048 2016 cmd.exe 94 PID 2016 wrote to memory of 3048 2016 cmd.exe 94 PID 2016 wrote to memory of 3976 2016 cmd.exe 95 PID 2016 wrote to memory of 3976 2016 cmd.exe 95 PID 2016 wrote to memory of 3976 2016 cmd.exe 95 PID 2016 wrote to memory of 1816 2016 cmd.exe 96 PID 2016 wrote to memory of 1816 2016 cmd.exe 96 PID 2016 wrote to memory of 1816 2016 cmd.exe 96 PID 2016 wrote to memory of 2300 2016 cmd.exe 97 PID 2016 wrote to memory of 2300 2016 cmd.exe 97 PID 2016 wrote to memory of 2300 2016 cmd.exe 97 PID 2016 wrote to memory of 384 2016 cmd.exe 98 PID 2016 wrote to memory of 384 2016 cmd.exe 98 PID 2016 wrote to memory of 384 2016 cmd.exe 98 PID 2016 wrote to memory of 3604 2016 cmd.exe 99 PID 2016 wrote to memory of 3604 2016 cmd.exe 99 PID 3604 wrote to memory of 2776 3604 easinvoker.exe 100 PID 3604 wrote to memory of 2776 3604 easinvoker.exe 100 PID 2016 wrote to memory of 1544 2016 cmd.exe 102 PID 2016 wrote to memory of 1544 2016 cmd.exe 102 PID 2016 wrote to memory of 1544 2016 cmd.exe 102 PID 2776 wrote to memory of 2748 2776 cmd.exe 103 PID 2776 wrote to memory of 2748 2776 cmd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xhsjvezljjvyeubpsyvkjosttfnghnibfs.exe"C:\Users\Admin\AppData\Local\Temp\Xhsjvezljjvyeubpsyvkjosttfnghnibfs.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe2⤵PID:3184
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Xhsjvezlt.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\XhsjvezlO.bat3⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO F"4⤵PID:2812
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "easinvoker.exe" "C:\Windows \System32\" /K /D /H /Y4⤵
- Enumerates system info in registry
PID:3048
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO F"4⤵PID:3976
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "netutils.dll" "C:\Windows \System32\" /K /D /H /Y4⤵
- Enumerates system info in registry
PID:1816
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO F"4⤵PID:2300
-
-
C:\Windows\SysWOW64\xcopy.exexcopy "KDECO.bat" "C:\Windows \System32\" /K /D /H /Y4⤵
- Enumerates system info in registry
PID:384
-
-
C:\Windows \System32\easinvoker.exe"C:\Windows \System32\easinvoker.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""5⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 64⤵
- Runs ping.exe
PID:1544
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2188
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4568