Overview

overview

10

Static

static

93276a3646...3c.exe

windows7_x64

10

93276a3646...3c.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    158s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    12-07-2022 12:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    93276a3646988961ec65fc1b860f227454c60f143c9d1736f5ab3fdc30a7443c.exe

  • Size

    267KB

  • MD5

    af36518f0a97d140dfcd5afbb9740d8a

  • SHA1

    3b8c31dcf501d7e93bf6b3e5ffaf1638942cd47c

  • SHA256

    93276a3646988961ec65fc1b860f227454c60f143c9d1736f5ab3fdc30a7443c

  • SHA512

    95cff48acc0e72127f096b0d66d97299433a9a13e4f322195754bd59cef689badf1ec7f447dc3dd25b36cfde665a05c7251c8fa149e0bb5fe3aec97812df9fa8

Score
10/10
remcossalitysalesbackdoorevasionpersistencerattrojanupx

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

sales

C2

178.175.138.219:200

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    microsoft

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    remcos_yyaopwkkmmuwfrk

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screens

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 2 TTPs 6 IoCs
    evasion
  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 12 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 2 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Executes dropped EXE 3 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification 2 TTPs 14 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 11 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:784
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:788
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:332
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2352
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:3512
            • C:\Windows\System32\RuntimeBroker.exe
              C:\Windows\System32\RuntimeBroker.exe -Embedding
              1⤵
                PID:3428
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:3356
                • C:\Windows\system32\DllHost.exe
                  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                  1⤵
                    PID:3268
                  • C:\Windows\System32\RuntimeBroker.exe
                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                    1⤵
                      PID:4212
                    • C:\Windows\System32\RuntimeBroker.exe
                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                      1⤵
                        PID:3836
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                        1⤵
                          PID:2888
                        • C:\Windows\Explorer.EXE
                          C:\Windows\Explorer.EXE
                          1⤵
                            PID:2940
                            • C:\Users\Admin\AppData\Local\Temp\93276a3646988961ec65fc1b860f227454c60f143c9d1736f5ab3fdc30a7443c.exe
                              "C:\Users\Admin\AppData\Local\Temp\93276a3646988961ec65fc1b860f227454c60f143c9d1736f5ab3fdc30a7443c.exe"
                              2⤵
                              • Checks computer location settings
                              • Suspicious use of WriteProcessMemory
                              PID:3204
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\xxawaeszfers43s3d43ec.bat" "
                                3⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4144
                                • C:\Windows\System32\Conhost.exe
                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                  4⤵
                                    PID:1360
                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\serverbb.sfx.exe
                                    serverbb.sfx.exe -piiasedfdsegg09o0i8i0i -dC:\Users\Admin\AppData\Local\Temp
                                    4⤵
                                    • Executes dropped EXE
                                    • Checks computer location settings
                                    • Suspicious use of WriteProcessMemory
                                    PID:1316
                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX1\serverbb.exe
                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\serverbb.exe"
                                      5⤵
                                      • Modifies firewall policy service
                                      • UAC bypass
                                      • Windows security bypass
                                      • Disables RegEdit via registry modification
                                      • Executes dropped EXE
                                      • Checks computer location settings
                                      • Windows security modification
                                      • Adds Run key to start application
                                      • Checks whether UAC is enabled
                                      • Drops file in Windows directory
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      • System policy modification
                                      PID:3284
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
                                        6⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:2440
                                        • C:\Windows\SysWOW64\PING.EXE
                                          PING 127.0.0.1 -n 2
                                          7⤵
                                          • Runs ping.exe
                                          PID:4624
                                        • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                          "C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
                                          7⤵
                                          • Modifies firewall policy service
                                          • UAC bypass
                                          • Windows security bypass
                                          • Disables RegEdit via registry modification
                                          • Executes dropped EXE
                                          • Windows security modification
                                          • Adds Run key to start application
                                          • Checks whether UAC is enabled
                                          • Enumerates connected drives
                                          • Drops autorun.inf file
                                          • Drops file in Program Files directory
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of SetWindowsHookEx
                                          • Suspicious use of WriteProcessMemory
                                          • System policy modification
                                          PID:4528
                            • C:\Windows\system32\taskhostw.exe
                              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                              1⤵
                                PID:2456
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                1⤵
                                  PID:2368

                                Network

                                MITRE ATT&CK Matrix ATT&CK v6

                                Initial Access

                                Replication Through Removable Media

                                1
                                T1091

                                Execution

                                Persistence

                                Modify Existing Service

                                1
                                T1031

                                Registry Run Keys / Startup Folder

                                1
                                T1060

                                Privilege Escalation

                                Bypass User Account Control

                                1
                                T1088

                                Defense Evasion

                                Modify Registry

                                6
                                T1112

                                Bypass User Account Control

                                1
                                T1088

                                Disabling Security Tools

                                3
                                T1089

                                Credential Access

                                Discovery

                                Query Registry

                                2
                                T1012

                                System Information Discovery

                                4
                                T1082

                                Peripheral Device Discovery

                                1
                                T1120

                                Remote System Discovery

                                1
                                T1018

                                Lateral Movement

                                Replication Through Removable Media

                                1
                                T1091

                                Collection

                                Exfiltration

                                Command and Control

                                Impact

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\serverbb.sfx.exe
                                  Filesize

                                  207KB

                                  MD5

                                  e6121feb0325525065baad0db96fee62

                                  SHA1

                                  0f1a671a5d360c33648e065c4f19a0a8fef276ff

                                  SHA256

                                  1d72b61cc04f1f4da847b4950e6cf70aaac16a05677e4f0635c06e7ff376ae59

                                  SHA512

                                  72e4eb808e896cf9ffb03b7f97948c7fc98662b71fece805acdcd9c7c3e0c787f1ee939eef4e26dc7558d83ad00cbd0784e5dc5a8dca8e82181e947e8f8a69f3

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\serverbb.sfx.exe
                                  Filesize

                                  207KB

                                  MD5

                                  e6121feb0325525065baad0db96fee62

                                  SHA1

                                  0f1a671a5d360c33648e065c4f19a0a8fef276ff

                                  SHA256

                                  1d72b61cc04f1f4da847b4950e6cf70aaac16a05677e4f0635c06e7ff376ae59

                                  SHA512

                                  72e4eb808e896cf9ffb03b7f97948c7fc98662b71fece805acdcd9c7c3e0c787f1ee939eef4e26dc7558d83ad00cbd0784e5dc5a8dca8e82181e947e8f8a69f3

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\xxawaeszfers43s3d43ec.bat
                                  Filesize

                                  49B

                                  MD5

                                  e06f4ac29c4328f453637b572b8aeb0d

                                  SHA1

                                  c8a87ca47c44938b374ee225d6df5b86facc6af9

                                  SHA256

                                  6700e5fdb3c3c29c207d0c456d94b9e18536d77839724e94da6c34491f96c927

                                  SHA512

                                  42e9430a80af2c400440ae259b752e69f665048352dcacd558f0e3f4096bcdeccd81ecf129e3c3533831fa5187faf4fc28efd2b8f2c671f90137c216bd6d2eec

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\serverbb.exe
                                  Filesize

                                  164KB

                                  MD5

                                  e59cef15630374087f1223583760f64c

                                  SHA1

                                  b3b4449055b6f6da3c14a01785ce95ac817179d5

                                  SHA256

                                  38d8f89f5478c51f2c3662fc52282d16ce38d6c78823bca726306b0d9bb7c9c6

                                  SHA512

                                  9928bcdd296be8f3de666e1a440cdd778cb6d6621c62a6d5c4e104d5df25f7ab445c0d3ddc552c9847bb0c149e00fb7992233d2ce279178f6866e8b89eae9652

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\serverbb.exe
                                  Filesize

                                  164KB

                                  MD5

                                  e59cef15630374087f1223583760f64c

                                  SHA1

                                  b3b4449055b6f6da3c14a01785ce95ac817179d5

                                  SHA256

                                  38d8f89f5478c51f2c3662fc52282d16ce38d6c78823bca726306b0d9bb7c9c6

                                  SHA512

                                  9928bcdd296be8f3de666e1a440cdd778cb6d6621c62a6d5c4e104d5df25f7ab445c0d3ddc552c9847bb0c149e00fb7992233d2ce279178f6866e8b89eae9652

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\install.bat
                                  Filesize

                                  99B

                                  MD5

                                  76c1687d97dfdbcea62ef1490bec5001

                                  SHA1

                                  5f4d1aeafa7d840cde67b76f97416dd68efd1bed

                                  SHA256

                                  79f04ea049979ffd2232c459fdd57fae97a5255aea9b4a2c7dce7ead856f37a4

                                  SHA512

                                  da250f0628632a644f159d818a82a8b9cca8224e46843bddbe0f6f9c32a2d04f7736a620af49ab6d77616317ca7d68285e60043965fe86c03d940835bd30a925

                                  Download Submit
                                • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                  Filesize

                                  164KB

                                  MD5

                                  e59cef15630374087f1223583760f64c

                                  SHA1

                                  b3b4449055b6f6da3c14a01785ce95ac817179d5

                                  SHA256

                                  38d8f89f5478c51f2c3662fc52282d16ce38d6c78823bca726306b0d9bb7c9c6

                                  SHA512

                                  9928bcdd296be8f3de666e1a440cdd778cb6d6621c62a6d5c4e104d5df25f7ab445c0d3ddc552c9847bb0c149e00fb7992233d2ce279178f6866e8b89eae9652

                                  Download Submit
                                • C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
                                  Filesize

                                  164KB

                                  MD5

                                  e59cef15630374087f1223583760f64c

                                  SHA1

                                  b3b4449055b6f6da3c14a01785ce95ac817179d5

                                  SHA256

                                  38d8f89f5478c51f2c3662fc52282d16ce38d6c78823bca726306b0d9bb7c9c6

                                  SHA512

                                  9928bcdd296be8f3de666e1a440cdd778cb6d6621c62a6d5c4e104d5df25f7ab445c0d3ddc552c9847bb0c149e00fb7992233d2ce279178f6866e8b89eae9652

                                  Download Submit
                                • C:\Windows\SYSTEM.INI
                                  Filesize

                                  257B

                                  MD5

                                  ab8b2fb042b251e5b57aa62bde8154f5

                                  SHA1

                                  009b86757bf5b2ce3dc117e38e84f227f2c3f680

                                  SHA256

                                  8ca04349b2a41a8cb23b73925b9be076f79ba31dd11bec56543f2636ea9f2cba

                                  SHA512

                                  945b69a81db3249168f4b83cd9e2a511215d4f5d8fb846b64f201490c33e7097e2af940f3c502d90ce49487a4030d44d23caecfbc4d1f0dc46aa49389b7f407f

                                  Download Submit
                                • memory/1316-132-0x0000000000000000-mapping.dmp
                                  Download
                                • memory/2440-139-0x0000000000000000-mapping.dmp
                                  Download
                                • memory/3284-142-0x0000000000400000-0x0000000000429000-memory.dmp
                                  Filesize

                                  164KB

                                  Download
                                • memory/3284-141-0x0000000002310000-0x000000000339E000-memory.dmp
                                  Filesize

                                  16.6MB

                                  Download
                                • memory/3284-140-0x0000000000400000-0x0000000000429000-memory.dmp
                                  Filesize

                                  164KB

                                  Download
                                • memory/3284-138-0x0000000002310000-0x000000000339E000-memory.dmp
                                  Filesize

                                  16.6MB

                                  Download
                                • memory/3284-135-0x0000000000000000-mapping.dmp
                                  Download
                                • memory/4144-130-0x0000000000000000-mapping.dmp
                                  Download
                                • memory/4528-145-0x0000000000000000-mapping.dmp
                                  Download
                                • memory/4528-148-0x00000000021E0000-0x000000000326E000-memory.dmp
                                  Filesize

                                  16.6MB

                                  Download
                                • memory/4528-150-0x0000000000400000-0x0000000000429000-memory.dmp
                                  Filesize

                                  164KB

                                  Download
                                • memory/4528-151-0x00000000021E0000-0x000000000326E000-memory.dmp
                                  Filesize

                                  16.6MB

                                  Download
                                • memory/4528-152-0x00000000021E0000-0x000000000326E000-memory.dmp
                                  Filesize

                                  16.6MB

                                  Download
                                • memory/4528-153-0x0000000000400000-0x0000000000429000-memory.dmp
                                  Filesize

                                  164KB

                                  Download
                                • memory/4624-144-0x0000000000000000-mapping.dmp
                                  Download