Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-01-2023 08:01

General

  • Target

    ubabalo logs.exe

  • Size

    1.8MB

  • MD5

    84528fbc769f9d1f9858ac7f3e2b771e

  • SHA1

    2facdf0f04ac13a31a463fec11c1a96b97ba95a8

  • SHA256

    6256a9de45ff5b2c8f1f0462de2f96e730df80bed12f227caff765646b730e80

  • SHA512

    be8bc54e340898ed9e97029deea743349475080b5ce3197917fd77258f8bfdc8418457a45c938eed05bd945eed6b9879fd7e8c2e22255022ba589ef1975337c1

  • SSDEEP

    24576:Srps73f4UQJjDDlGQ5kRQ6o0p54F28zsmlVFLA8FiHV2T7PajK7/rwd1lI7KWTe+:CiSP5NNrL5I23PN/v9eIFDei

Malware Config

Extracted

Family

remcos

Version

2.7.1 Pro

Botnet

MIMIBOY

C2

91.231.84.41:52651

127.0.0.1:52651

10.5.175.21:52651

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Remcos-SURYWD

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ubabalo logs.exe
    "C:\Users\Admin\AppData\Local\Temp\ubabalo logs.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3608
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3040
    • C:\Users\Admin\AppData\Local\Temp\ubabalo logs.exe
      "C:\Users\Admin\AppData\Local\Temp\ubabalo logs.exe"
      2⤵
        PID:1216
      • C:\Users\Admin\AppData\Local\Temp\ubabalo logs.exe
        "C:\Users\Admin\AppData\Local\Temp\ubabalo logs.exe"
        2⤵
          PID:3908

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Defense Evasion

      Modify Registry

      1
      T1112

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      2
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1216-145-0x0000000000000000-mapping.dmp
      • memory/3040-144-0x0000000006340000-0x000000000635A000-memory.dmp
        Filesize

        104KB

      • memory/3040-141-0x0000000005810000-0x0000000005876000-memory.dmp
        Filesize

        408KB

      • memory/3040-142-0x0000000005E30000-0x0000000005E4E000-memory.dmp
        Filesize

        120KB

      • memory/3040-143-0x00000000074B0000-0x0000000007B2A000-memory.dmp
        Filesize

        6.5MB

      • memory/3040-137-0x0000000000000000-mapping.dmp
      • memory/3040-138-0x0000000002840000-0x0000000002876000-memory.dmp
        Filesize

        216KB

      • memory/3040-139-0x00000000051E0000-0x0000000005808000-memory.dmp
        Filesize

        6.2MB

      • memory/3040-140-0x0000000005090000-0x00000000050F6000-memory.dmp
        Filesize

        408KB

      • memory/3608-135-0x0000000005220000-0x000000000522A000-memory.dmp
        Filesize

        40KB

      • memory/3608-134-0x00000000052C0000-0x0000000005352000-memory.dmp
        Filesize

        584KB

      • memory/3608-136-0x00000000060E0000-0x0000000006102000-memory.dmp
        Filesize

        136KB

      • memory/3608-132-0x00000000006A0000-0x0000000000880000-memory.dmp
        Filesize

        1.9MB

      • memory/3608-133-0x00000000057D0000-0x0000000005D74000-memory.dmp
        Filesize

        5.6MB

      • memory/3908-146-0x0000000000000000-mapping.dmp
      • memory/3908-147-0x0000000000400000-0x0000000000421000-memory.dmp
        Filesize

        132KB

      • memory/3908-149-0x0000000000400000-0x0000000000421000-memory.dmp
        Filesize

        132KB

      • memory/3908-150-0x0000000000400000-0x0000000000421000-memory.dmp
        Filesize

        132KB

      • memory/3908-151-0x0000000000400000-0x0000000000421000-memory.dmp
        Filesize

        132KB