Analysis

  • max time kernel
    150s
  • max time network
    169s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    02-12-2022 00:11

General

  • Target

    4d83e58ab22eda61302b755a827ffa57.exe

  • Size

    1.2MB

  • MD5

    4d83e58ab22eda61302b755a827ffa57

  • SHA1

    e1bfd5c9493aac048af6a03d2003abdfbf64d31c

  • SHA256

    0359874ac9be35e969500ffe552298ea0c8056b51c8eac0e3e835c564ef39148

  • SHA512

    bdb653eab74b49f31c4e9519c0812fb60d6cbd78e982deda74a2a5254140cb7e439bc944faef0daae8917df4918def18ceb02683741f742b39653022ebd99d3a

  • SSDEEP

    24576:QwqpTiwAAgEEY4+FsS9ous35qIw9L7Zl1V3fWGKso5KF9Qgs:ATQp+GZJ/w9Ln1VnzuU9Qgs

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

45.139.105.174:3111

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-XI5CH7

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 23 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4d83e58ab22eda61302b755a827ffa57.exe
    "C:\Users\Admin\AppData\Local\Temp\4d83e58ab22eda61302b755a827ffa57.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1392
    • C:\Users\Admin\AppData\Local\Temp\4d83e58ab22eda61302b755a827ffa57.exe
      "C:\Users\Admin\AppData\Local\Temp\4d83e58ab22eda61302b755a827ffa57.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2044
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fybsyvmovphykzlbtxirzbeeuylar.vbs"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1932
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Remcos\remcos.exe"
          4⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2032
          • C:\ProgramData\Remcos\remcos.exe
            C:\ProgramData\Remcos\remcos.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1552
            • C:\ProgramData\Remcos\remcos.exe
              "C:\ProgramData\Remcos\remcos.exe"
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:584
              • \??\c:\program files (x86)\internet explorer\iexplore.exe
                "c:\program files (x86)\internet explorer\iexplore.exe"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:1972
                • C:\Program Files\Internet Explorer\iexplore.exe
                  "C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=iexplore.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
                  8⤵
                  • Modifies Internet Explorer settings
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:880
                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:880 CREDAT:275457 /prefetch:2
                    9⤵
                    • Modifies Internet Explorer settings
                    • Suspicious use of SetWindowsHookEx
                    PID:1000

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Remcos\remcos.exe
    Filesize

    1.2MB

    MD5

    4d83e58ab22eda61302b755a827ffa57

    SHA1

    e1bfd5c9493aac048af6a03d2003abdfbf64d31c

    SHA256

    0359874ac9be35e969500ffe552298ea0c8056b51c8eac0e3e835c564ef39148

    SHA512

    bdb653eab74b49f31c4e9519c0812fb60d6cbd78e982deda74a2a5254140cb7e439bc944faef0daae8917df4918def18ceb02683741f742b39653022ebd99d3a

  • C:\ProgramData\Remcos\remcos.exe
    Filesize

    1.2MB

    MD5

    4d83e58ab22eda61302b755a827ffa57

    SHA1

    e1bfd5c9493aac048af6a03d2003abdfbf64d31c

    SHA256

    0359874ac9be35e969500ffe552298ea0c8056b51c8eac0e3e835c564ef39148

    SHA512

    bdb653eab74b49f31c4e9519c0812fb60d6cbd78e982deda74a2a5254140cb7e439bc944faef0daae8917df4918def18ceb02683741f742b39653022ebd99d3a

  • C:\ProgramData\Remcos\remcos.exe
    Filesize

    1.2MB

    MD5

    4d83e58ab22eda61302b755a827ffa57

    SHA1

    e1bfd5c9493aac048af6a03d2003abdfbf64d31c

    SHA256

    0359874ac9be35e969500ffe552298ea0c8056b51c8eac0e3e835c564ef39148

    SHA512

    bdb653eab74b49f31c4e9519c0812fb60d6cbd78e982deda74a2a5254140cb7e439bc944faef0daae8917df4918def18ceb02683741f742b39653022ebd99d3a

  • C:\Users\Admin\AppData\Local\Temp\fybsyvmovphykzlbtxirzbeeuylar.vbs
    Filesize

    386B

    MD5

    1ec6289c6fd4c2ded6b2836ed28cbeb5

    SHA1

    c4e08195e6c640eb8860acc03fda1d649b4fe070

    SHA256

    6efdc40f9eb217f879607614e928b65bff759e424f3efb31faceb2a043c32dc2

    SHA512

    20bc46f4dee22f75f15c402c7c2eaee60fff7dd92548050585571dcbefd59485cc249c06bc3f1aac7a138e5ae67c0c3918b46ffa24c8b0f1b092e2f6b6e21288

  • \ProgramData\Remcos\remcos.exe
    Filesize

    1.2MB

    MD5

    4d83e58ab22eda61302b755a827ffa57

    SHA1

    e1bfd5c9493aac048af6a03d2003abdfbf64d31c

    SHA256

    0359874ac9be35e969500ffe552298ea0c8056b51c8eac0e3e835c564ef39148

    SHA512

    bdb653eab74b49f31c4e9519c0812fb60d6cbd78e982deda74a2a5254140cb7e439bc944faef0daae8917df4918def18ceb02683741f742b39653022ebd99d3a

  • memory/584-108-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

  • memory/584-110-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

  • memory/584-103-0x000000000043292E-mapping.dmp
  • memory/584-107-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

  • memory/1392-59-0x0000000007F20000-0x0000000007FBE000-memory.dmp
    Filesize

    632KB

  • memory/1392-54-0x0000000000260000-0x0000000000396000-memory.dmp
    Filesize

    1.2MB

  • memory/1392-58-0x0000000005F60000-0x0000000006032000-memory.dmp
    Filesize

    840KB

  • memory/1392-57-0x00000000003B0000-0x00000000003BE000-memory.dmp
    Filesize

    56KB

  • memory/1392-56-0x0000000000250000-0x0000000000266000-memory.dmp
    Filesize

    88KB

  • memory/1392-55-0x0000000075601000-0x0000000075603000-memory.dmp
    Filesize

    8KB

  • memory/1552-89-0x0000000000390000-0x00000000003A6000-memory.dmp
    Filesize

    88KB

  • memory/1552-87-0x0000000001350000-0x0000000001486000-memory.dmp
    Filesize

    1.2MB

  • memory/1552-85-0x0000000000000000-mapping.dmp
  • memory/1932-78-0x0000000000000000-mapping.dmp
  • memory/1972-109-0x00000000003E1ADE-mapping.dmp
  • memory/2032-82-0x0000000000000000-mapping.dmp
  • memory/2044-63-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

  • memory/2044-79-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

  • memory/2044-77-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

  • memory/2044-76-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

  • memory/2044-73-0x000000000043292E-mapping.dmp
  • memory/2044-72-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

  • memory/2044-70-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

  • memory/2044-68-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

  • memory/2044-67-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

  • memory/2044-66-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

  • memory/2044-65-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

  • memory/2044-60-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

  • memory/2044-61-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB