Overview

overview

10

Static

static

vbc.exe

windows7-x64

10

vbc.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    188s
  • max time network
    181s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-10-2022 20:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    vbc.exe

  • Size

    322KB

  • MD5

    ebb80429c2ab3a4b98092d9681c83a0f

  • SHA1

    ff42b517c77a1e7fd1e8c133cdc3702f455e2a2f

  • SHA256

    4f7e671c26e269961ffa6a6639a5522b66c06c8c119bdfb297797473bb7b4cbc

  • SHA512

    eef552e819bcf016662e3e5bdeeef7c6bba33d8f3d760fec397c464352590a4d7c3a63a1614dc8f5b80af5282b31e39eed512ea933866205c46c84f0675938c4

  • SSDEEP

    6144:HNeZm2smfQ8gA3mXO5cOZuIpkgaB/uPLDmzxxznqJRMVYaWp2Oal0t8FqD:HNl3mfQq3/JX0QLDi/zsaaz

Score
10/10
remcostestpersistenceratupx

Malware Config

Extracted

Family

remcos

Botnet

test

C2

91.192.100.20:7967

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-TIHKWD

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Executes dropped EXE 3 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 61 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\vbc.exe
    "C:\Users\Admin\AppData\Local\Temp\vbc.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4884
    • C:\Users\Admin\AppData\Local\Temp\mzzfe.exe
      "C:\Users\Admin\AppData\Local\Temp\mzzfe.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2244
      • C:\Users\Admin\AppData\Local\Temp\mzzfe.exe
        "C:\Users\Admin\AppData\Local\Temp\mzzfe.exe"
        3⤵
        • Executes dropped EXE
        PID:1196
      • C:\Users\Admin\AppData\Local\Temp\mzzfe.exe
        "C:\Users\Admin\AppData\Local\Temp\mzzfe.exe"
        3⤵
        • Checks computer location settings
        • Loads dropped DLL
        • Adds Run key to start application
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3892
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
          4⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:216
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Remcos\remcos.exe"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3044
            • C:\ProgramData\Remcos\remcos.exe
              C:\ProgramData\Remcos\remcos.exe
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:3472
              • C:\ProgramData\Remcos\remcos.exe
                C:\ProgramData\Remcos\remcos.exe
                7⤵
                • Loads dropped DLL
                • Adds Run key to start application
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of SetWindowsHookEx
                PID:768
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3472 -s 540
                7⤵
                • Program crash
                PID:3864
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 568
        3⤵
        • Program crash
        PID:2708
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2244 -ip 2244
    1⤵
      PID:1432
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3472 -ip 3472
      1⤵
        PID:3636
      • C:\Windows\system32\werfault.exe
        werfault.exe /h /shared Global\4636e2a9beba4654965f334494686e5f /t 2484 /p 2180
        1⤵
          PID:1796
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
          • Modifies Installed Components in the registry
          • Enumerates connected drives
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:1984
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:3672
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Enumerates system info in registry
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:1832

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Remcos\remcos.exe
          Filesize

          125KB

          MD5

          0441aaf5a815eeb2e69a76b1a462fb5a

          SHA1

          c315440ae55e779c8a0c4cf7c6fb9dbb9a03daf5

          SHA256

          a1c19d3a781af8ce19836bf600f4d49b3df02338af7bcab960ea6a6f03ce914d

          SHA512

          960a6ffaaeafd3011304dc1fdfca00ad7177cf2c02ffd1deac6ad609e9745acf15406268b274002d8c0e5c8d691c27c4467539b22ad96c3020827883df70118b

          Download Submit

        • C:\ProgramData\Remcos\remcos.exe
          Filesize

          125KB

          MD5

          0441aaf5a815eeb2e69a76b1a462fb5a

          SHA1

          c315440ae55e779c8a0c4cf7c6fb9dbb9a03daf5

          SHA256

          a1c19d3a781af8ce19836bf600f4d49b3df02338af7bcab960ea6a6f03ce914d

          SHA512

          960a6ffaaeafd3011304dc1fdfca00ad7177cf2c02ffd1deac6ad609e9745acf15406268b274002d8c0e5c8d691c27c4467539b22ad96c3020827883df70118b

          Download Submit

        • C:\ProgramData\Remcos\remcos.exe
          Filesize

          125KB

          MD5

          0441aaf5a815eeb2e69a76b1a462fb5a

          SHA1

          c315440ae55e779c8a0c4cf7c6fb9dbb9a03daf5

          SHA256

          a1c19d3a781af8ce19836bf600f4d49b3df02338af7bcab960ea6a6f03ce914d

          SHA512

          960a6ffaaeafd3011304dc1fdfca00ad7177cf2c02ffd1deac6ad609e9745acf15406268b274002d8c0e5c8d691c27c4467539b22ad96c3020827883df70118b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\install.vbs
          Filesize

          386B

          MD5

          1ec6289c6fd4c2ded6b2836ed28cbeb5

          SHA1

          c4e08195e6c640eb8860acc03fda1d649b4fe070

          SHA256

          6efdc40f9eb217f879607614e928b65bff759e424f3efb31faceb2a043c32dc2

          SHA512

          20bc46f4dee22f75f15c402c7c2eaee60fff7dd92548050585571dcbefd59485cc249c06bc3f1aac7a138e5ae67c0c3918b46ffa24c8b0f1b092e2f6b6e21288

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\mzzfe.exe
          Filesize

          125KB

          MD5

          0441aaf5a815eeb2e69a76b1a462fb5a

          SHA1

          c315440ae55e779c8a0c4cf7c6fb9dbb9a03daf5

          SHA256

          a1c19d3a781af8ce19836bf600f4d49b3df02338af7bcab960ea6a6f03ce914d

          SHA512

          960a6ffaaeafd3011304dc1fdfca00ad7177cf2c02ffd1deac6ad609e9745acf15406268b274002d8c0e5c8d691c27c4467539b22ad96c3020827883df70118b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\mzzfe.exe
          Filesize

          125KB

          MD5

          0441aaf5a815eeb2e69a76b1a462fb5a

          SHA1

          c315440ae55e779c8a0c4cf7c6fb9dbb9a03daf5

          SHA256

          a1c19d3a781af8ce19836bf600f4d49b3df02338af7bcab960ea6a6f03ce914d

          SHA512

          960a6ffaaeafd3011304dc1fdfca00ad7177cf2c02ffd1deac6ad609e9745acf15406268b274002d8c0e5c8d691c27c4467539b22ad96c3020827883df70118b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\mzzfe.exe
          Filesize

          125KB

          MD5

          0441aaf5a815eeb2e69a76b1a462fb5a

          SHA1

          c315440ae55e779c8a0c4cf7c6fb9dbb9a03daf5

          SHA256

          a1c19d3a781af8ce19836bf600f4d49b3df02338af7bcab960ea6a6f03ce914d

          SHA512

          960a6ffaaeafd3011304dc1fdfca00ad7177cf2c02ffd1deac6ad609e9745acf15406268b274002d8c0e5c8d691c27c4467539b22ad96c3020827883df70118b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\mzzfe.exe
          Filesize

          125KB

          MD5

          0441aaf5a815eeb2e69a76b1a462fb5a

          SHA1

          c315440ae55e779c8a0c4cf7c6fb9dbb9a03daf5

          SHA256

          a1c19d3a781af8ce19836bf600f4d49b3df02338af7bcab960ea6a6f03ce914d

          SHA512

          960a6ffaaeafd3011304dc1fdfca00ad7177cf2c02ffd1deac6ad609e9745acf15406268b274002d8c0e5c8d691c27c4467539b22ad96c3020827883df70118b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\nqmbj.w
          Filesize

          228KB

          MD5

          518bf8c18e617f61c2d8e0b6513b925d

          SHA1

          f8fe4041612a0f7384df91cce98051ff3ef2094b

          SHA256

          e15bc33f04d3842be3ce2cba0d5d9bd27862d921f9ac6c1ba3404ffd45f5ebc0

          SHA512

          9613399290f518812c8d2e53154b8afc45509867dc34bdebd449031542b6132e7cc845238b33ebb925384b9f4528aef2e290e74e70a27303351aff0b5994d1b7

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\xrxwuads.j
          Filesize

          4KB

          MD5

          46b2ce2aa4b00ab70940ab9b19942a5e

          SHA1

          10c9ae4c1f1c1fe6ed639a86e7259bf4a8cd361f

          SHA256

          d4185b2719d6ac863275066c26baeedee49b426c7787a44be9af4f44d31f17e3

          SHA512

          bb4003bb3b1ad26c35d7b3846de201e98ea2eb81791fe520601b64db54bb00de385c74dc4fca227a331e20179d1f14c012a3e742a0a887c6bdb4e0e106dcb158

          Download Submit

        • memory/768-151-0x0000000000400000-0x0000000000487000-memory.dmp

          Filesize

          540KB

          Download

        • memory/768-150-0x0000000000400000-0x0000000000487000-memory.dmp

          Filesize

          540KB

          Download

        • memory/1832-164-0x000001C31D400000-0x000001C31D500000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/1832-167-0x000001C30A00C000-0x000001C30A00F000-memory.dmp

          Filesize

          12KB

          Download

        • memory/1832-170-0x000001C30A00C000-0x000001C30A00F000-memory.dmp

          Filesize

          12KB

          Download

        • memory/1832-169-0x000001C30A00C000-0x000001C30A00F000-memory.dmp

          Filesize

          12KB

          Download

        • memory/1832-168-0x000001C30A00C000-0x000001C30A00F000-memory.dmp

          Filesize

          12KB

          Download

        • memory/1832-174-0x000001C3079C0000-0x000001C3079E0000-memory.dmp

          Filesize

          128KB

          Download

        • memory/1832-159-0x000001C307D20000-0x000001C307D28000-memory.dmp

          Filesize

          32KB

          Download

        • memory/1832-160-0x000001C308700000-0x000001C308720000-memory.dmp

          Filesize

          128KB

          Download

        • memory/1832-163-0x000001C308E40000-0x000001C308E60000-memory.dmp

          Filesize

          128KB

          Download

        • memory/1832-173-0x000001C31D400000-0x000001C31D500000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/1832-172-0x000001C306D40000-0x000001C306E40000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/3892-142-0x0000000000400000-0x0000000000487000-memory.dmp

          Filesize

          540KB

          Download

        • memory/3892-140-0x0000000000400000-0x0000000000487000-memory.dmp

          Filesize

          540KB

          Download