Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20220715-en
  • resource tags

    arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
  • submitted
    29-07-2022 16:09

General

  • Target

    d959b480824d3f572e43bfdc6662d177353443bac3210448c8b02c9a01a3bec0.pdf

  • Size

    339KB

  • MD5

    80a1c58f87a5546e12d09e5cbbac80e9

  • SHA1

    4e92f9231b72fd64588e07428f84463941ae7355

  • SHA256

    d959b480824d3f572e43bfdc6662d177353443bac3210448c8b02c9a01a3bec0

  • SHA512

    b1bd2df11b6c83aee5aabd7cd2650f9f9bb0b5979501befa478aea8a16c18e6a52fc856c834b2173565c4cf190e644ad82e750f5ca2c94456e21dd9b23a54260

Malware Config

Extracted

Family

remcos

Botnet

XP

C2

xpremcuz300622.ddns.net:3542

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    oos.exe

  • delete_file

    false

  • hide_file

    true

  • hide_keylog_file

    false

  • install_flag

    true

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Remcos-MMP2I7

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    kkl

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 8 IoCs
  • Abuses OpenXML format to download file from external location
  • Loads dropped DLL 5 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\d959b480824d3f572e43bfdc6662d177353443bac3210448c8b02c9a01a3bec0.pdf"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1028
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\A9R60.tmp\has been verified. However PDF, JPEG, xlsx, .docx"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1924
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1348
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:1340
      • C:\Users\Public\vbc.exe
        "C:\Users\Public\vbc.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1860
        • C:\Users\Public\vbc.exe
          "C:\Users\Public\vbc.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:820
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1816
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\oos.exe"
              5⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:524
              • C:\Users\Admin\AppData\Roaming\oos.exe
                C:\Users\Admin\AppData\Roaming\oos.exe
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:952
                • C:\Users\Admin\AppData\Roaming\oos.exe
                  "C:\Users\Admin\AppData\Roaming\oos.exe"
                  7⤵
                  • Executes dropped EXE
                  PID:1964
                • C:\Users\Admin\AppData\Roaming\oos.exe
                  "C:\Users\Admin\AppData\Roaming\oos.exe"
                  7⤵
                  • Executes dropped EXE
                  PID:684
                • C:\Users\Admin\AppData\Roaming\oos.exe
                  "C:\Users\Admin\AppData\Roaming\oos.exe"
                  7⤵
                  • Executes dropped EXE
                  PID:1516
                • C:\Users\Admin\AppData\Roaming\oos.exe
                  "C:\Users\Admin\AppData\Roaming\oos.exe"
                  7⤵
                  • Executes dropped EXE
                  PID:1324
                • C:\Users\Admin\AppData\Roaming\oos.exe
                  "C:\Users\Admin\AppData\Roaming\oos.exe"
                  7⤵
                  • Executes dropped EXE
                  PID:1804

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scripting

    1
    T1064

    Exploitation for Client Execution

    1
    T1203

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Scripting

    1
    T1064

    Modify Registry

    2
    T1112

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\A9R60.tmp\has been verified. However PDF, JPEG, xlsx, .docx
      Filesize

      139KB

      MD5

      ec835425f9ac0a43ef2f5fffd56d2c95

      SHA1

      d36026e6716560212c761744ec301fb265c07634

      SHA256

      503a97b28718e3c1a2e58aa8ad3765ddc33c8d1f97648f253612dde76c585c25

      SHA512

      1198c203977253aa6f7d3f7123c2b94716689a0d8ff3a2f37ce77ce839b040f20ac31d25fd19705d4e61e8bef27235c9d6509363e8b72486295d634d281a8722

    • C:\Users\Admin\AppData\Local\Temp\install.vbs
      Filesize

      398B

      MD5

      a5d3440f90cbfae712166e20870eaed7

      SHA1

      cc1e1a2945eb2ad475234344f7527ad9e9873647

      SHA256

      960a570da95b8d16809cbcc18e8ca4d81e16cb666354ddc1d572daf93f291f02

      SHA512

      d3136a280fbb326ccc5cb5ab1214aed8ccd6baa7f3f89ef9e0b5bf391a957dab2c121640bb056e6cbda0594f83133c4dbb4e1e2f0e290b44a401cd2cf8cfd4aa

    • C:\Users\Admin\AppData\Roaming\oos.exe
      Filesize

      860KB

      MD5

      90b7fc34be5837101ff125bdbe99806a

      SHA1

      43a733cb58aaefffefec0720f1b93dae766a09e1

      SHA256

      703b4d505cd05c228e0cf681a542262dc98211cf2e4eb26102283b5b7efa29ee

      SHA512

      dd590eaad5b95ac4b703d5c36a367fc0517d33408b8f35218a341710411931bac51b97d3f12cbf26e1ba5deacaf8b3ae7390f108524f9a43b5bad3c8e2689658

    • C:\Users\Admin\AppData\Roaming\oos.exe
      Filesize

      860KB

      MD5

      90b7fc34be5837101ff125bdbe99806a

      SHA1

      43a733cb58aaefffefec0720f1b93dae766a09e1

      SHA256

      703b4d505cd05c228e0cf681a542262dc98211cf2e4eb26102283b5b7efa29ee

      SHA512

      dd590eaad5b95ac4b703d5c36a367fc0517d33408b8f35218a341710411931bac51b97d3f12cbf26e1ba5deacaf8b3ae7390f108524f9a43b5bad3c8e2689658

    • C:\Users\Admin\AppData\Roaming\oos.exe
      Filesize

      860KB

      MD5

      90b7fc34be5837101ff125bdbe99806a

      SHA1

      43a733cb58aaefffefec0720f1b93dae766a09e1

      SHA256

      703b4d505cd05c228e0cf681a542262dc98211cf2e4eb26102283b5b7efa29ee

      SHA512

      dd590eaad5b95ac4b703d5c36a367fc0517d33408b8f35218a341710411931bac51b97d3f12cbf26e1ba5deacaf8b3ae7390f108524f9a43b5bad3c8e2689658

    • C:\Users\Admin\AppData\Roaming\oos.exe
      Filesize

      860KB

      MD5

      90b7fc34be5837101ff125bdbe99806a

      SHA1

      43a733cb58aaefffefec0720f1b93dae766a09e1

      SHA256

      703b4d505cd05c228e0cf681a542262dc98211cf2e4eb26102283b5b7efa29ee

      SHA512

      dd590eaad5b95ac4b703d5c36a367fc0517d33408b8f35218a341710411931bac51b97d3f12cbf26e1ba5deacaf8b3ae7390f108524f9a43b5bad3c8e2689658

    • C:\Users\Admin\AppData\Roaming\oos.exe
      Filesize

      860KB

      MD5

      90b7fc34be5837101ff125bdbe99806a

      SHA1

      43a733cb58aaefffefec0720f1b93dae766a09e1

      SHA256

      703b4d505cd05c228e0cf681a542262dc98211cf2e4eb26102283b5b7efa29ee

      SHA512

      dd590eaad5b95ac4b703d5c36a367fc0517d33408b8f35218a341710411931bac51b97d3f12cbf26e1ba5deacaf8b3ae7390f108524f9a43b5bad3c8e2689658

    • C:\Users\Admin\AppData\Roaming\oos.exe
      Filesize

      860KB

      MD5

      90b7fc34be5837101ff125bdbe99806a

      SHA1

      43a733cb58aaefffefec0720f1b93dae766a09e1

      SHA256

      703b4d505cd05c228e0cf681a542262dc98211cf2e4eb26102283b5b7efa29ee

      SHA512

      dd590eaad5b95ac4b703d5c36a367fc0517d33408b8f35218a341710411931bac51b97d3f12cbf26e1ba5deacaf8b3ae7390f108524f9a43b5bad3c8e2689658

    • C:\Users\Admin\AppData\Roaming\oos.exe
      Filesize

      860KB

      MD5

      90b7fc34be5837101ff125bdbe99806a

      SHA1

      43a733cb58aaefffefec0720f1b93dae766a09e1

      SHA256

      703b4d505cd05c228e0cf681a542262dc98211cf2e4eb26102283b5b7efa29ee

      SHA512

      dd590eaad5b95ac4b703d5c36a367fc0517d33408b8f35218a341710411931bac51b97d3f12cbf26e1ba5deacaf8b3ae7390f108524f9a43b5bad3c8e2689658

    • C:\Users\Public\vbc.exe
      Filesize

      860KB

      MD5

      90b7fc34be5837101ff125bdbe99806a

      SHA1

      43a733cb58aaefffefec0720f1b93dae766a09e1

      SHA256

      703b4d505cd05c228e0cf681a542262dc98211cf2e4eb26102283b5b7efa29ee

      SHA512

      dd590eaad5b95ac4b703d5c36a367fc0517d33408b8f35218a341710411931bac51b97d3f12cbf26e1ba5deacaf8b3ae7390f108524f9a43b5bad3c8e2689658

    • C:\Users\Public\vbc.exe
      Filesize

      860KB

      MD5

      90b7fc34be5837101ff125bdbe99806a

      SHA1

      43a733cb58aaefffefec0720f1b93dae766a09e1

      SHA256

      703b4d505cd05c228e0cf681a542262dc98211cf2e4eb26102283b5b7efa29ee

      SHA512

      dd590eaad5b95ac4b703d5c36a367fc0517d33408b8f35218a341710411931bac51b97d3f12cbf26e1ba5deacaf8b3ae7390f108524f9a43b5bad3c8e2689658

    • C:\Users\Public\vbc.exe
      Filesize

      860KB

      MD5

      90b7fc34be5837101ff125bdbe99806a

      SHA1

      43a733cb58aaefffefec0720f1b93dae766a09e1

      SHA256

      703b4d505cd05c228e0cf681a542262dc98211cf2e4eb26102283b5b7efa29ee

      SHA512

      dd590eaad5b95ac4b703d5c36a367fc0517d33408b8f35218a341710411931bac51b97d3f12cbf26e1ba5deacaf8b3ae7390f108524f9a43b5bad3c8e2689658

    • \Users\Admin\AppData\Roaming\oos.exe
      Filesize

      860KB

      MD5

      90b7fc34be5837101ff125bdbe99806a

      SHA1

      43a733cb58aaefffefec0720f1b93dae766a09e1

      SHA256

      703b4d505cd05c228e0cf681a542262dc98211cf2e4eb26102283b5b7efa29ee

      SHA512

      dd590eaad5b95ac4b703d5c36a367fc0517d33408b8f35218a341710411931bac51b97d3f12cbf26e1ba5deacaf8b3ae7390f108524f9a43b5bad3c8e2689658

    • \Users\Public\vbc.exe
      Filesize

      860KB

      MD5

      90b7fc34be5837101ff125bdbe99806a

      SHA1

      43a733cb58aaefffefec0720f1b93dae766a09e1

      SHA256

      703b4d505cd05c228e0cf681a542262dc98211cf2e4eb26102283b5b7efa29ee

      SHA512

      dd590eaad5b95ac4b703d5c36a367fc0517d33408b8f35218a341710411931bac51b97d3f12cbf26e1ba5deacaf8b3ae7390f108524f9a43b5bad3c8e2689658

    • \Users\Public\vbc.exe
      Filesize

      860KB

      MD5

      90b7fc34be5837101ff125bdbe99806a

      SHA1

      43a733cb58aaefffefec0720f1b93dae766a09e1

      SHA256

      703b4d505cd05c228e0cf681a542262dc98211cf2e4eb26102283b5b7efa29ee

      SHA512

      dd590eaad5b95ac4b703d5c36a367fc0517d33408b8f35218a341710411931bac51b97d3f12cbf26e1ba5deacaf8b3ae7390f108524f9a43b5bad3c8e2689658

    • \Users\Public\vbc.exe
      Filesize

      860KB

      MD5

      90b7fc34be5837101ff125bdbe99806a

      SHA1

      43a733cb58aaefffefec0720f1b93dae766a09e1

      SHA256

      703b4d505cd05c228e0cf681a542262dc98211cf2e4eb26102283b5b7efa29ee

      SHA512

      dd590eaad5b95ac4b703d5c36a367fc0517d33408b8f35218a341710411931bac51b97d3f12cbf26e1ba5deacaf8b3ae7390f108524f9a43b5bad3c8e2689658

    • \Users\Public\vbc.exe
      Filesize

      860KB

      MD5

      90b7fc34be5837101ff125bdbe99806a

      SHA1

      43a733cb58aaefffefec0720f1b93dae766a09e1

      SHA256

      703b4d505cd05c228e0cf681a542262dc98211cf2e4eb26102283b5b7efa29ee

      SHA512

      dd590eaad5b95ac4b703d5c36a367fc0517d33408b8f35218a341710411931bac51b97d3f12cbf26e1ba5deacaf8b3ae7390f108524f9a43b5bad3c8e2689658

    • memory/524-101-0x0000000000000000-mapping.dmp
    • memory/820-88-0x0000000000400000-0x000000000047E000-memory.dmp
      Filesize

      504KB

    • memory/820-96-0x0000000000400000-0x000000000047E000-memory.dmp
      Filesize

      504KB

    • memory/820-98-0x0000000000400000-0x000000000047E000-memory.dmp
      Filesize

      504KB

    • memory/820-78-0x0000000000400000-0x000000000047E000-memory.dmp
      Filesize

      504KB

    • memory/820-79-0x0000000000400000-0x000000000047E000-memory.dmp
      Filesize

      504KB

    • memory/820-81-0x0000000000400000-0x000000000047E000-memory.dmp
      Filesize

      504KB

    • memory/820-83-0x0000000000400000-0x000000000047E000-memory.dmp
      Filesize

      504KB

    • memory/820-85-0x0000000000400000-0x000000000047E000-memory.dmp
      Filesize

      504KB

    • memory/820-84-0x0000000000400000-0x000000000047E000-memory.dmp
      Filesize

      504KB

    • memory/820-86-0x0000000000400000-0x000000000047E000-memory.dmp
      Filesize

      504KB

    • memory/820-95-0x0000000000400000-0x000000000047E000-memory.dmp
      Filesize

      504KB

    • memory/820-91-0x000000000043168C-mapping.dmp
    • memory/820-90-0x0000000000400000-0x000000000047E000-memory.dmp
      Filesize

      504KB

    • memory/952-106-0x0000000000230000-0x000000000030C000-memory.dmp
      Filesize

      880KB

    • memory/952-104-0x0000000000000000-mapping.dmp
    • memory/1028-54-0x0000000076C01000-0x0000000076C03000-memory.dmp
      Filesize

      8KB

    • memory/1348-75-0x000007FEFC451000-0x000007FEFC453000-memory.dmp
      Filesize

      8KB

    • memory/1348-74-0x0000000000000000-mapping.dmp
    • memory/1816-97-0x0000000000000000-mapping.dmp
    • memory/1860-77-0x0000000005280000-0x00000000052FA000-memory.dmp
      Filesize

      488KB

    • memory/1860-70-0x0000000000B60000-0x0000000000C3C000-memory.dmp
      Filesize

      880KB

    • memory/1860-72-0x0000000000510000-0x0000000000528000-memory.dmp
      Filesize

      96KB

    • memory/1860-67-0x0000000000000000-mapping.dmp
    • memory/1860-76-0x0000000005640000-0x0000000005704000-memory.dmp
      Filesize

      784KB

    • memory/1924-73-0x000000006EBBD000-0x000000006EBC8000-memory.dmp
      Filesize

      44KB

    • memory/1924-61-0x000000006EBBD000-0x000000006EBC8000-memory.dmp
      Filesize

      44KB

    • memory/1924-58-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1924-57-0x000000006DBD1000-0x000000006DBD3000-memory.dmp
      Filesize

      8KB

    • memory/1924-56-0x0000000070301000-0x0000000070304000-memory.dmp
      Filesize

      12KB

    • memory/1924-55-0x0000000000000000-mapping.dmp