Overview

overview

10

Static

static

SecuriteIn...86.exe

windows7-x64

10

SecuriteIn...86.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    179s
  • max time network
    188s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-12-2022 17:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Win32.PWSX-gen.9839.6586.exe

  • Size

    899KB

  • MD5

    05b2fb25c00fc2625348ba0c2f4aa99e

  • SHA1

    200f289cac848d18c5ef3016a8b513aa9dbbc3b6

  • SHA256

    6aa386bb66df768b6a5b9cd24bc443e157905453ff014863dcd9fdf8b1eb3839

  • SHA512

    bdf0d3abd8a18781808f31069ee8b5d2e09f2c17d39374b6a39c126908c161af96bfac01ce6b135089c4407f29479eb92d0b308e3da9eebf6d8a0584857e223b

  • SSDEEP

    12288:jJbgesRmxckJ+l3wBLiBzwwK2vkUUnFqY3IvqmA4hajIw2yXN4WqMv7sQhgQm4Gg:2Ac93iLozBRGqYYvMEYCMXGkaKbFX

Score
10/10
remcosremotehost reffrat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost Reff

C2

185.136.161.189:1960

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-IPL25E

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9839.6586.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9839.6586.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5044
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ndEkaSZ.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2152
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ndEkaSZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4AFE.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:4316
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9839.6586.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9839.6586.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:3600

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp4AFE.tmp
    Filesize

    1KB

    MD5

    9a1d54d6ead8e501097299aca05aaea0

    SHA1

    907baf5306d014a01c1ba414217d872573c279ba

    SHA256

    d4b63f6133083dcf16b530d0ca6475ae8a9ece3ddfd055c8d047c01dfed11128

    SHA512

    582accb99bd21545cc6d38647027afcee6d6746813af3625bc4f6b80d6e8f6ac10aa6da41703a382ad3c3b760804bd447153f0d9bb39e981b886c32dcf8c749a

    Download Submit
  • memory/2152-146-0x0000000004CC0000-0x0000000004CE2000-memory.dmp
    Filesize

    136KB

    Download
  • memory/2152-137-0x0000000000000000-mapping.dmp
    Download
  • memory/2152-147-0x00000000055B0000-0x0000000005616000-memory.dmp
    Filesize

    408KB

    Download
  • memory/2152-160-0x00000000072A0000-0x00000000072A8000-memory.dmp
    Filesize

    32KB

    Download
  • memory/2152-148-0x0000000005620000-0x0000000005686000-memory.dmp
    Filesize

    408KB

    Download
  • memory/2152-159-0x00000000072C0000-0x00000000072DA000-memory.dmp
    Filesize

    104KB

    Download
  • memory/2152-139-0x00000000046B0000-0x00000000046E6000-memory.dmp
    Filesize

    216KB

    Download
  • memory/2152-158-0x00000000071B0000-0x00000000071BE000-memory.dmp
    Filesize

    56KB

    Download
  • memory/2152-142-0x0000000004E10000-0x0000000005438000-memory.dmp
    Filesize

    6.2MB

    Download
  • memory/2152-157-0x0000000007200000-0x0000000007296000-memory.dmp
    Filesize

    600KB

    Download
  • memory/2152-156-0x0000000006FF0000-0x0000000006FFA000-memory.dmp
    Filesize

    40KB

    Download
  • memory/2152-155-0x0000000006F80000-0x0000000006F9A000-memory.dmp
    Filesize

    104KB

    Download
  • memory/2152-154-0x00000000075C0000-0x0000000007C3A000-memory.dmp
    Filesize

    6.5MB

    Download
  • memory/2152-153-0x0000000006230000-0x000000000624E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/2152-152-0x00000000711A0000-0x00000000711EC000-memory.dmp
    Filesize

    304KB

    Download
  • memory/2152-151-0x0000000006250000-0x0000000006282000-memory.dmp
    Filesize

    200KB

    Download
  • memory/2152-150-0x0000000005C70000-0x0000000005C8E000-memory.dmp
    Filesize

    120KB

    Download
  • memory/3600-144-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

    Download
  • memory/3600-145-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

    Download
  • memory/3600-149-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

    Download
  • memory/3600-143-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

    Download
  • memory/3600-141-0x0000000000000000-mapping.dmp
    Download
  • memory/3600-161-0x0000000000400000-0x000000000047F000-memory.dmp
    Filesize

    508KB

    Download
  • memory/4316-138-0x0000000000000000-mapping.dmp
    Download
  • memory/5044-134-0x0000000005370000-0x0000000005402000-memory.dmp
    Filesize

    584KB

    Download
  • memory/5044-135-0x0000000005420000-0x000000000542A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/5044-132-0x00000000008F0000-0x00000000009D8000-memory.dmp
    Filesize

    928KB

    Download
  • memory/5044-133-0x0000000005870000-0x0000000005E14000-memory.dmp
    Filesize

    5.6MB

    Download
  • memory/5044-136-0x0000000009AB0000-0x0000000009B4C000-memory.dmp
    Filesize

    624KB

    Download