Analysis

  • max time kernel
    145s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220715-en
  • resource tags

    arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
  • submitted
    30-07-2022 20:49

General

  • Target

    618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe

  • Size

    218KB

  • MD5

    25f290634a8092cc13820b1ade6ec33c

  • SHA1

    3d4913172fedc50d9654effeab0fdcec9bb36014

  • SHA256

    618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4

  • SHA512

    22d9aaa2ab0780eab101a7c387e491e36f9672c59dc4b97a92488685dc3b62e585d004d8550f44a17034dc12e2dc6f08a2406991418452cb01e417f2b5e6da29

Score
10/10

Malware Config

Extracted

Family

remcos

Version

2.0.5 Pro

Botnet

RemoteHost

C2

79.172.242.28:2404

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-6PPTSU

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Family

remcos

Botnet

RemoteHost

C2

79.172.242.28:2404

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-6PPTSU

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe
    "C:\Users\Admin\AppData\Local\Temp\618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1112
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe"
      2⤵
      • NTFS ADS
      • Suspicious use of WriteProcessMemory
      PID:884
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\vf45\b9876.exe.lnk" /f
        3⤵
          PID:788
      • C:\Users\Admin\AppData\Roaming\tmp.exe
        "C:\Users\Admin\AppData\Roaming\tmp.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1712
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
          3⤵
            PID:1876
        • C:\Users\Admin\AppData\Local\Temp\.exe
          "C:\Users\Admin\AppData\Local\Temp\.exe"
          2⤵
          • Executes dropped EXE
          PID:1908

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Discovery

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\.exe
        Filesize

        1.6MB

        MD5

        32827e69b293b99013bbbe37d029245d

        SHA1

        bc9f80a38f09354d71467a05b0c5a82c3f7dac53

        SHA256

        9250b89157770e3ab59a2c7e2dd6b12b3c61d9b7c6620c3b4727e4bfff10f01f

        SHA512

        58c9a072e2bea0a8f22b4e69512abafad271ca91f2e3d2b4233796dd3d83021aad1c6da69fc8f7e7ca7919d34bde941cb8b5d185b668168866d1180558b93cf5

      • C:\Users\Admin\AppData\Local\Temp\vf45\b9876.exe
        Filesize

        218KB

        MD5

        25f290634a8092cc13820b1ade6ec33c

        SHA1

        3d4913172fedc50d9654effeab0fdcec9bb36014

        SHA256

        618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4

        SHA512

        22d9aaa2ab0780eab101a7c387e491e36f9672c59dc4b97a92488685dc3b62e585d004d8550f44a17034dc12e2dc6f08a2406991418452cb01e417f2b5e6da29

      • C:\Users\Admin\AppData\Roaming\tmp.exe
        Filesize

        108KB

        MD5

        07dafacf45c8e2fe217985a20c1ee89d

        SHA1

        f62ec5fdd8a397465399b8d20a9196ebbbfe5a1c

        SHA256

        71f4ff98b5c43912e39c9b68c0ae1ed894903e94756f41cf5631445499356527

        SHA512

        08c3a614f2e44bde9610519e0f751f131d80d2dd1c4939921f1b4455d2e7095d96d0c21f9c854dcdc4abf0d1e20c2de4a9e2cb602367f7efa5f4c524909c4074

      • \Users\Admin\AppData\Local\Temp\.exe
        Filesize

        1.6MB

        MD5

        32827e69b293b99013bbbe37d029245d

        SHA1

        bc9f80a38f09354d71467a05b0c5a82c3f7dac53

        SHA256

        9250b89157770e3ab59a2c7e2dd6b12b3c61d9b7c6620c3b4727e4bfff10f01f

        SHA512

        58c9a072e2bea0a8f22b4e69512abafad271ca91f2e3d2b4233796dd3d83021aad1c6da69fc8f7e7ca7919d34bde941cb8b5d185b668168866d1180558b93cf5

      • \Users\Admin\AppData\Local\Temp\vf45\b9876.exe
        Filesize

        218KB

        MD5

        25f290634a8092cc13820b1ade6ec33c

        SHA1

        3d4913172fedc50d9654effeab0fdcec9bb36014

        SHA256

        618cc1db8b0225b15c13df19b184970c0dfc180415c572ee7a12433a106e41e4

        SHA512

        22d9aaa2ab0780eab101a7c387e491e36f9672c59dc4b97a92488685dc3b62e585d004d8550f44a17034dc12e2dc6f08a2406991418452cb01e417f2b5e6da29

      • \Users\Admin\AppData\Roaming\tmp.exe
        Filesize

        108KB

        MD5

        07dafacf45c8e2fe217985a20c1ee89d

        SHA1

        f62ec5fdd8a397465399b8d20a9196ebbbfe5a1c

        SHA256

        71f4ff98b5c43912e39c9b68c0ae1ed894903e94756f41cf5631445499356527

        SHA512

        08c3a614f2e44bde9610519e0f751f131d80d2dd1c4939921f1b4455d2e7095d96d0c21f9c854dcdc4abf0d1e20c2de4a9e2cb602367f7efa5f4c524909c4074

      • \Users\Admin\AppData\Roaming\tmp.exe
        Filesize

        108KB

        MD5

        07dafacf45c8e2fe217985a20c1ee89d

        SHA1

        f62ec5fdd8a397465399b8d20a9196ebbbfe5a1c

        SHA256

        71f4ff98b5c43912e39c9b68c0ae1ed894903e94756f41cf5631445499356527

        SHA512

        08c3a614f2e44bde9610519e0f751f131d80d2dd1c4939921f1b4455d2e7095d96d0c21f9c854dcdc4abf0d1e20c2de4a9e2cb602367f7efa5f4c524909c4074

      • memory/788-58-0x0000000000000000-mapping.dmp
      • memory/884-57-0x0000000000000000-mapping.dmp
      • memory/1112-55-0x0000000074080000-0x000000007462B000-memory.dmp
        Filesize

        5.7MB

      • memory/1112-54-0x0000000075681000-0x0000000075683000-memory.dmp
        Filesize

        8KB

      • memory/1112-56-0x0000000074080000-0x000000007462B000-memory.dmp
        Filesize

        5.7MB

      • memory/1112-80-0x0000000074080000-0x000000007462B000-memory.dmp
        Filesize

        5.7MB

      • memory/1712-63-0x0000000000000000-mapping.dmp
      • memory/1908-67-0x0000000000080000-0x000000000009B000-memory.dmp
        Filesize

        108KB

      • memory/1908-72-0x0000000000080000-0x000000000009B000-memory.dmp
        Filesize

        108KB

      • memory/1908-73-0x0000000000080000-0x000000000009B000-memory.dmp
        Filesize

        108KB

      • memory/1908-77-0x0000000000080000-0x000000000009B000-memory.dmp
        Filesize

        108KB

      • memory/1908-70-0x0000000000080000-0x000000000009B000-memory.dmp
        Filesize

        108KB

      • memory/1908-75-0x0000000000412C84-mapping.dmp
      • memory/1908-68-0x0000000000080000-0x000000000009B000-memory.dmp
        Filesize

        108KB