Overview

overview

10

Static

static

SVCL 주�...df.exe

windows7_x64

10

SVCL 주�...df.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    169s
  • max time network
    171s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 02:03

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SVCL 주문 문의 #20201305,pdf.exe

  • Size

    284KB

  • MD5

    726053b1a0320bbb7d4401b7c58571ac

  • SHA1

    aee9558877f8f150fbecb331a89311caa7fb33e6

  • SHA256

    9c163291baa89e2279a2ab8c2db63f8566b3d0b49bbd3b5254673ad2708b0866

  • SHA512

    54b286249b4836d7aae4626abcb23a85b10b26939f41fc601b8599657c8018acdb68880435248c21ba8b4d8e38c18b201ebd5560ddb45ad29ee8887152a9ed61

Score
10/10
remcosjah blessrat

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

JAH BLESS

C2

godsfavoured.ddns.net:7213

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-52S6QD

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SVCL 주문 문의 #20201305,pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\SVCL 주문 문의 #20201305,pdf.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2348
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HoUIWPHe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD650.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:4956
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "{path}"
      2⤵
        PID:540
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "{path}"
        2⤵
          PID:1996

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\tmpD650.tmp
        Filesize

        1KB

        MD5

        d97d3081be1ad440a64728f506bb48b7

        SHA1

        5808ecc8e50708b987626d794f78e4ec3016f435

        SHA256

        a9fcf353ea726fd0d01434e885d5189b9d6fbbdfdce3dc0bbce2daf7693ec615

        SHA512

        29e61cc2565e7f2a6d1f154780ef928f2bd36f3bc7861fe70b16d5e94570ffc049a9068fc6860d4cf0eb1e81a74032e76cbdc6d2cd5e630663c94f2d4aa077c8

        Download Submit

      • memory/540-137-0x0000000000000000-mapping.dmp

        Download

      • memory/1996-138-0x0000000000000000-mapping.dmp

        Download

      • memory/1996-139-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1996-141-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/1996-142-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/2348-130-0x00000000000A0000-0x00000000000EC000-memory.dmp

        Filesize

        304KB

        Download

      • memory/2348-131-0x0000000004F90000-0x0000000005534000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/2348-132-0x0000000004AC0000-0x0000000004B52000-memory.dmp

        Filesize

        584KB

        Download

      • memory/2348-133-0x0000000004AA0000-0x0000000004AAA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/2348-134-0x0000000008450000-0x00000000084EC000-memory.dmp

        Filesize

        624KB

        Download

      • memory/4956-135-0x0000000000000000-mapping.dmp

        Download