Overview

overview

10

Static

static

SecuriteIn...86.exe

windows7-x64

10

SecuriteIn...86.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    05-12-2022 17:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.9839.6586.exe

  • Size

    899KB

  • MD5

    05b2fb25c00fc2625348ba0c2f4aa99e

  • SHA1

    200f289cac848d18c5ef3016a8b513aa9dbbc3b6

  • SHA256

    6aa386bb66df768b6a5b9cd24bc443e157905453ff014863dcd9fdf8b1eb3839

  • SHA512

    bdf0d3abd8a18781808f31069ee8b5d2e09f2c17d39374b6a39c126908c161af96bfac01ce6b135089c4407f29479eb92d0b308e3da9eebf6d8a0584857e223b

  • SSDEEP

    12288:jJbgesRmxckJ+l3wBLiBzwwK2vkUUnFqY3IvqmA4hajIw2yXN4WqMv7sQhgQm4Gg:2Ac93iLozBRGqYYvMEYCMXGkaKbFX

Score
10/10
remcosremotehost reffrat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost Reff

C2

185.136.161.189:1960

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-IPL25E

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9839.6586.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9839.6586.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1248
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ndEkaSZ.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1000
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ndEkaSZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6643.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1848
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9839.6586.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9839.6586.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:1100

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp6643.tmp
    Filesize

    1KB

    MD5

    a20a3fe5d307afb69be1780608f48aef

    SHA1

    94aa4847b16b3d912a6cc8a4ffce6fd0b1c1197b

    SHA256

    f60fbf987c9c78f254abcd14a1b902ed54a782aacf574a4f274fbda7f112c84f

    SHA512

    00491dcf76508ac4237f5d382d7c855273e6d85a12cbd317211d486f65b1dc658e4aad1aa8fe15711cff09ccc35f3a0c410e4810c09663725f8e148b3d28d4e6

    Download Submit
  • memory/1000-60-0x0000000000000000-mapping.dmp
    Download
  • memory/1000-84-0x000000006EA90000-0x000000006F03B000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/1000-83-0x000000006EA90000-0x000000006F03B000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/1100-68-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

    Download
  • memory/1100-73-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

    Download
  • memory/1100-85-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

    Download
  • memory/1100-82-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

    Download
  • memory/1100-81-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

    Download
  • memory/1100-77-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

    Download
  • memory/1100-65-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

    Download
  • memory/1100-66-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

    Download
  • memory/1100-78-0x000000000043292E-mapping.dmp
    Download
  • memory/1100-70-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

    Download
  • memory/1100-71-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

    Download
  • memory/1100-75-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

    Download
  • memory/1100-72-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

    Download
  • memory/1248-59-0x0000000008030000-0x00000000080F0000-memory.dmp
    Filesize

    768KB

    Download
  • memory/1248-54-0x0000000001210000-0x00000000012F8000-memory.dmp
    Filesize

    928KB

    Download
  • memory/1248-64-0x0000000005EF0000-0x0000000005F7A000-memory.dmp
    Filesize

    552KB

    Download
  • memory/1248-57-0x0000000000410000-0x000000000042A000-memory.dmp
    Filesize

    104KB

    Download
  • memory/1248-56-0x0000000005BD0000-0x0000000005CCE000-memory.dmp
    Filesize

    1016KB

    Download
  • memory/1248-55-0x0000000075351000-0x0000000075353000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1248-58-0x0000000000950000-0x000000000095E000-memory.dmp
    Filesize

    56KB

    Download
  • memory/1848-62-0x0000000000000000-mapping.dmp
    Download