Analysis

  • max time kernel
    259s
  • max time network
    359s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    03-02-2023 19:14

General

  • Target

    d7fa6d87594ea4d8b5740d54fdc204b08f4e9439.exe

  • Size

    7KB

  • MD5

    b359f4af5c88b1e237db9738415b7682

  • SHA1

    d7fa6d87594ea4d8b5740d54fdc204b08f4e9439

  • SHA256

    53ddb9a75bca1115a66745b28086afbd394cef38f8437dda641b1219111df8cd

  • SHA512

    6d4f06f36c608d3202d29629f9d9a70eadfbffbb23c7c074fbb610ed9e1926bf6e04c8dfecbbaf1d575fb2d0385d237aff2dbda322b092d4ef7728091eb596cb

  • SSDEEP

    96:xtEsKVeCVIP7bLp8LAn5c8aY1ej/kKV+J2qzNt:xUVVIP7bLrEOejcKYx

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

194.180.49.17:28282

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    rdfghfgjkgoighjc.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-PC1DJ2

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Detect PureCrypter injector 1 IoCs
  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 10 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d7fa6d87594ea4d8b5740d54fdc204b08f4e9439.exe
    "C:\Users\Admin\AppData\Local\Temp\d7fa6d87594ea4d8b5740d54fdc204b08f4e9439.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1028
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1076
    • C:\Users\Admin\AppData\Local\Temp\d7fa6d87594ea4d8b5740d54fdc204b08f4e9439.exe
      C:\Users\Admin\AppData\Local\Temp\d7fa6d87594ea4d8b5740d54fdc204b08f4e9439.exe
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1524
      • C:\ProgramData\Remcos\rdfghfgjkgoighjc.exe
        "C:\ProgramData\Remcos\rdfghfgjkgoighjc.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1604
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1960
        • C:\ProgramData\Remcos\rdfghfgjkgoighjc.exe
          C:\ProgramData\Remcos\rdfghfgjkgoighjc.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of SetWindowsHookEx
          PID:1884

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Remcos\rdfghfgjkgoighjc.exe
    Filesize

    7KB

    MD5

    b359f4af5c88b1e237db9738415b7682

    SHA1

    d7fa6d87594ea4d8b5740d54fdc204b08f4e9439

    SHA256

    53ddb9a75bca1115a66745b28086afbd394cef38f8437dda641b1219111df8cd

    SHA512

    6d4f06f36c608d3202d29629f9d9a70eadfbffbb23c7c074fbb610ed9e1926bf6e04c8dfecbbaf1d575fb2d0385d237aff2dbda322b092d4ef7728091eb596cb

  • C:\ProgramData\Remcos\rdfghfgjkgoighjc.exe
    Filesize

    7KB

    MD5

    b359f4af5c88b1e237db9738415b7682

    SHA1

    d7fa6d87594ea4d8b5740d54fdc204b08f4e9439

    SHA256

    53ddb9a75bca1115a66745b28086afbd394cef38f8437dda641b1219111df8cd

    SHA512

    6d4f06f36c608d3202d29629f9d9a70eadfbffbb23c7c074fbb610ed9e1926bf6e04c8dfecbbaf1d575fb2d0385d237aff2dbda322b092d4ef7728091eb596cb

  • C:\ProgramData\Remcos\rdfghfgjkgoighjc.exe
    Filesize

    7KB

    MD5

    b359f4af5c88b1e237db9738415b7682

    SHA1

    d7fa6d87594ea4d8b5740d54fdc204b08f4e9439

    SHA256

    53ddb9a75bca1115a66745b28086afbd394cef38f8437dda641b1219111df8cd

    SHA512

    6d4f06f36c608d3202d29629f9d9a70eadfbffbb23c7c074fbb610ed9e1926bf6e04c8dfecbbaf1d575fb2d0385d237aff2dbda322b092d4ef7728091eb596cb

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
    Filesize

    7KB

    MD5

    6f420cd02962a3f66fa9b82382e17a14

    SHA1

    93fffcb7f602f2e3771564bd78cd645df4efa396

    SHA256

    58735c07b1394806656210c63a8a423b6aa7cb482dc3b73d0933ed4a4a7ec26a

    SHA512

    180d49c103f561878e1f0f5cecbc3bdbe5bfc7a3434fd5431028b39fb4e558a664440edea30a116055a248c39cae87bd6b3d6a6276c5251d1550b015db3622fd

  • C:\Users\Admin\AppData\Roaming\Zwpfblvosjv\Phecxlkxbf.exe
    Filesize

    7KB

    MD5

    21eb7229dde310fab9cd2dbec6208123

    SHA1

    df728df8c047ff7589d48aaa00c65cd88d0550c5

    SHA256

    1aae2dda4016febd2765e64d20dd992319d388cc8a8690f1ae5f7984a4734dd3

    SHA512

    6a72767944f6eb84b1564044eabd33c2aaa75297263dfa4aac8a1c60afddb3846ee10cd0d81739b36f3cb7be97f88f92a0b5223b61fa5bf36a82127fc0af75f2

  • \ProgramData\Remcos\rdfghfgjkgoighjc.exe
    Filesize

    7KB

    MD5

    b359f4af5c88b1e237db9738415b7682

    SHA1

    d7fa6d87594ea4d8b5740d54fdc204b08f4e9439

    SHA256

    53ddb9a75bca1115a66745b28086afbd394cef38f8437dda641b1219111df8cd

    SHA512

    6d4f06f36c608d3202d29629f9d9a70eadfbffbb23c7c074fbb610ed9e1926bf6e04c8dfecbbaf1d575fb2d0385d237aff2dbda322b092d4ef7728091eb596cb

  • memory/1028-55-0x0000000075E01000-0x0000000075E03000-memory.dmp
    Filesize

    8KB

  • memory/1028-56-0x0000000007520000-0x00000000077BE000-memory.dmp
    Filesize

    2.6MB

  • memory/1028-54-0x0000000000E60000-0x0000000000E68000-memory.dmp
    Filesize

    32KB

  • memory/1028-62-0x0000000005050000-0x00000000050D0000-memory.dmp
    Filesize

    512KB

  • memory/1076-57-0x0000000000000000-mapping.dmp
  • memory/1076-61-0x000000006F6D0000-0x000000006FC7B000-memory.dmp
    Filesize

    5.7MB

  • memory/1076-60-0x000000006F6D0000-0x000000006FC7B000-memory.dmp
    Filesize

    5.7MB

  • memory/1076-59-0x000000006F6D0000-0x000000006FC7B000-memory.dmp
    Filesize

    5.7MB

  • memory/1524-79-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/1524-64-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/1524-75-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/1524-76-0x0000000000432E48-mapping.dmp
  • memory/1524-71-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/1524-63-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/1524-70-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/1524-69-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/1524-68-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/1524-84-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/1524-73-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/1524-66-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/1604-85-0x0000000000990000-0x0000000000998000-memory.dmp
    Filesize

    32KB

  • memory/1604-81-0x0000000000000000-mapping.dmp
  • memory/1884-107-0x0000000000432E48-mapping.dmp
  • memory/1884-111-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/1884-112-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/1884-113-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/1960-87-0x0000000000000000-mapping.dmp
  • memory/1960-90-0x000000006F6B0000-0x000000006FC5B000-memory.dmp
    Filesize

    5.7MB

  • memory/1960-91-0x000000006F6B0000-0x000000006FC5B000-memory.dmp
    Filesize

    5.7MB

  • memory/1960-92-0x000000006F6B0000-0x000000006FC5B000-memory.dmp
    Filesize

    5.7MB