Resubmissions
01-02-2023 17:02
230201-vj6p3aah39 1001-02-2023 17:00
230201-vjf5eacg4s 1001-02-2023 16:57
230201-vgbrxacg2y 10Analysis
-
max time kernel
602s -
max time network
606s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
01-02-2023 17:02
General
-
Target
DHL SHIPPING DOC PDF.exe
-
Size
1.0MB
-
MD5
6d452842eeb2efa505763049d59c553a
-
SHA1
e13f2202155e12573a985b5df24319e5320f588e
-
SHA256
52e2a0d6ec4940ac71db48d62f8de4fa9ea7ea4a0abfaff91175ea2e0ec0d998
-
SHA512
c37faf01a77690351e6cd47196821dddca39a3df07a9286b17e2916fc107429ddadc5dc9fa695bfb52ab8105a1e41b1367c6d68472dac64ecb47f9a9be4add54
-
SSDEEP
24576:uL5mA6W5L4EAyxtiH5wkm99RtPK7TQXQyRU5JqG4yPa:eJ41OtiH5wbbRucXQyRU8
Malware Config
Extracted
remcos
RemoteHost
51.75.209.245:2406
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-52YOYG
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe"C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gpnAwW.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gpnAwW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6C18.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe"C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe"2⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD505d2797c5ae85fe5f3e904def3b17728
SHA1dbd89911834423f0c78e2b2f2a21c4ba5a9bb034
SHA2566068d34d3338301cd43e750f13643ffa91b90161c92c34a7986ba6657142a3df
SHA512ce0fd474b9086579791a13a961affcef8aa01c438ca8c96084a73bc4204fd101c166301b795266641265245cf8cb91a14ae812bba215ced51fe6bc78ebc0db8f
-
C:\Users\Admin\AppData\Local\Temp\tmp6C18.tmpFilesize
1KB
MD56478fd68cca69606cccd5cb4ee8f4ab5
SHA13a079fc5bb33d25ed8c5b3d96f3fe1600089e153
SHA2564cd6cdeb0bd856e05d80cc27a574f67482192c0d01d1e865003c9e68488af2be
SHA512ac19e3616292803c859f4ea9797c4ebc3c4941fcfe1e89e7fd935a5e29affa9f159dfb44da09fdbd0300a9c59230e60446762023b0eae47aedb5dd9f189257ac
-
memory/1048-165-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1048-151-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1048-149-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1048-147-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1048-148-0x0000000000400000-0x000000000047F000-memory.dmpFilesize
508KB
-
memory/1048-146-0x0000000000000000-mapping.dmp
-
memory/1372-137-0x0000000000000000-mapping.dmp
-
memory/1372-142-0x0000000005340000-0x0000000005362000-memory.dmpFilesize
136KB
-
memory/1372-141-0x0000000005380000-0x00000000059A8000-memory.dmpFilesize
6.2MB
-
memory/1372-158-0x0000000007470000-0x000000000747A000-memory.dmpFilesize
40KB
-
memory/1372-145-0x0000000005B00000-0x0000000005B66000-memory.dmpFilesize
408KB
-
memory/1372-159-0x0000000007680000-0x0000000007716000-memory.dmpFilesize
600KB
-
memory/1372-139-0x00000000027B0000-0x00000000027E6000-memory.dmpFilesize
216KB
-
memory/1372-160-0x0000000007630000-0x000000000763E000-memory.dmpFilesize
56KB
-
memory/1372-154-0x0000000074DA0000-0x0000000074DEC000-memory.dmpFilesize
304KB
-
memory/1372-150-0x00000000060F0000-0x000000000610E000-memory.dmpFilesize
120KB
-
memory/1372-162-0x0000000007720000-0x0000000007728000-memory.dmpFilesize
32KB
-
memory/1372-152-0x00000000066B0000-0x00000000066E2000-memory.dmpFilesize
200KB
-
memory/1372-157-0x0000000007410000-0x000000000742A000-memory.dmpFilesize
104KB
-
memory/1636-156-0x00000000078A0000-0x0000000007F1A000-memory.dmpFilesize
6.5MB
-
memory/1636-155-0x0000000006510000-0x000000000652E000-memory.dmpFilesize
120KB
-
memory/1636-153-0x0000000074DA0000-0x0000000074DEC000-memory.dmpFilesize
304KB
-
memory/1636-144-0x0000000005760000-0x00000000057C6000-memory.dmpFilesize
408KB
-
memory/1636-138-0x0000000000000000-mapping.dmp
-
memory/1636-161-0x00000000075A0000-0x00000000075BA000-memory.dmpFilesize
104KB
-
memory/3664-140-0x0000000000000000-mapping.dmp
-
memory/4756-132-0x0000000000D80000-0x0000000000E88000-memory.dmpFilesize
1.0MB
-
memory/4756-136-0x0000000009250000-0x00000000092EC000-memory.dmpFilesize
624KB
-
memory/4756-135-0x00000000058D0000-0x00000000058DA000-memory.dmpFilesize
40KB
-
memory/4756-134-0x0000000005700000-0x0000000005792000-memory.dmpFilesize
584KB
-
memory/4756-133-0x0000000005C10000-0x00000000061B4000-memory.dmpFilesize
5.6MB