Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/02/2023, 20:33

General

  • Target

    tmp.exe

  • Size

    29KB

  • MD5

    1496b98fe0530da47982105a87a69bce

  • SHA1

    00719a1b168c8baa3827a161326b157713f9a07a

  • SHA256

    c7c03c2d6a78eb79409a53304bfaf8a69334d2f6a5928db641092bcc39dc8e8d

  • SHA512

    286c28a228dda2d589e7e5a75027c27fcc69244b8fec2ae1019d66a8fe6aa00ef245682a1e2dd3f37722c9c4220f2ddc52ab8750369842da028970c59513dcc6

  • SSDEEP

    768:en3FjOzFQjRuGjXi2nZFwn3SGTfMve9L0hPOZ:eaQ3Xi2ni3SKfMkLw

Malware Config

Extracted

Family

remcos

Botnet

N

C2

173.212.217.108:1050

zab4ever.no-ip.org:1050

1zab4ever.no-ip.org:1050

1zab4ever.duckdns.org:1050

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    svhost.exe

  • delete_file

    false

  • hide_file

    true

  • hide_keylog_file

    true

  • install_flag

    true

  • install_path

    %WinDir%

  • keylog_crypt

    false

  • keylog_file

    psibos.dat

  • keylog_flag

    false

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    hgfjioupsc-UDD5UN

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Windows VHost

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    notepad;solitaire;

Signatures

  • Detects Smokeloader packer 2 IoCs
  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4476
  • C:\Users\Admin\AppData\Local\Temp\D15E.exe
    C:\Users\Admin\AppData\Local\Temp\D15E.exe
    1⤵
    • Adds policy Run key to start application
    • Checks computer location settings
    • Executes dropped EXE
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2416
    • C:\Windows\svhost.exe
      "C:\Windows\svhost.exe"
      2⤵
      • Adds policy Run key to start application
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1296
      • C:\Windows\SysWOW64\svchost.exe
        svchost.exe
        3⤵
          PID:2116
    • C:\Users\Admin\AppData\Local\Temp\D20B.exe
      C:\Users\Admin\AppData\Local\Temp\D20B.exe
      1⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:4496
    • C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      1⤵
      • Accesses Microsoft Outlook profiles
      • outlook_office_path
      • outlook_win_path
      PID:4708
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe
      1⤵
        PID:3336
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        1⤵
          PID:1432
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          1⤵
            PID:2300
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe
            1⤵
              PID:2108

            Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\D15E.exe

                    Filesize

                    458KB

                    MD5

                    eefc82bd1babcace31d1823bf8974852

                    SHA1

                    ea1e7ffb166b2c12a95fad1c7398d5e2ff74ed52

                    SHA256

                    970833813b7677c96a5ac2b136a982bc32c1179cf77aee729a0f4993f23c1f34

                    SHA512

                    6b21c156df25befe6b884761288092c680590d6cd9f52434c01404d3ee4e7a769de2766075be2b4f160266c382966d3ea36a415ba7b4b0de84e347c2fd4713dc

                  • C:\Users\Admin\AppData\Local\Temp\D15E.exe

                    Filesize

                    458KB

                    MD5

                    eefc82bd1babcace31d1823bf8974852

                    SHA1

                    ea1e7ffb166b2c12a95fad1c7398d5e2ff74ed52

                    SHA256

                    970833813b7677c96a5ac2b136a982bc32c1179cf77aee729a0f4993f23c1f34

                    SHA512

                    6b21c156df25befe6b884761288092c680590d6cd9f52434c01404d3ee4e7a769de2766075be2b4f160266c382966d3ea36a415ba7b4b0de84e347c2fd4713dc

                  • C:\Users\Admin\AppData\Local\Temp\D20B.exe

                    Filesize

                    141KB

                    MD5

                    4da855885a48a88b2b99abdaf7dbaddb

                    SHA1

                    95be38902672a4f729325f4322449fafe52791c4

                    SHA256

                    e6e5fa379b321d66c93d236eadc5c81478c821b545a7ff9ac6d07e14ed5a8983

                    SHA512

                    4f5855573c3d08d8a11325775230544ecf79f884009a94c30c8bd4547e2ad873224ef1d34fd15b9e91423a5cf4351f22d4aa50be7c14cc2bdc2260c009e61c93

                  • C:\Users\Admin\AppData\Local\Temp\D20B.exe

                    Filesize

                    141KB

                    MD5

                    4da855885a48a88b2b99abdaf7dbaddb

                    SHA1

                    95be38902672a4f729325f4322449fafe52791c4

                    SHA256

                    e6e5fa379b321d66c93d236eadc5c81478c821b545a7ff9ac6d07e14ed5a8983

                    SHA512

                    4f5855573c3d08d8a11325775230544ecf79f884009a94c30c8bd4547e2ad873224ef1d34fd15b9e91423a5cf4351f22d4aa50be7c14cc2bdc2260c009e61c93

                  • C:\Windows\svhost.exe

                    Filesize

                    458KB

                    MD5

                    eefc82bd1babcace31d1823bf8974852

                    SHA1

                    ea1e7ffb166b2c12a95fad1c7398d5e2ff74ed52

                    SHA256

                    970833813b7677c96a5ac2b136a982bc32c1179cf77aee729a0f4993f23c1f34

                    SHA512

                    6b21c156df25befe6b884761288092c680590d6cd9f52434c01404d3ee4e7a769de2766075be2b4f160266c382966d3ea36a415ba7b4b0de84e347c2fd4713dc

                  • C:\Windows\svhost.exe

                    Filesize

                    458KB

                    MD5

                    eefc82bd1babcace31d1823bf8974852

                    SHA1

                    ea1e7ffb166b2c12a95fad1c7398d5e2ff74ed52

                    SHA256

                    970833813b7677c96a5ac2b136a982bc32c1179cf77aee729a0f4993f23c1f34

                    SHA512

                    6b21c156df25befe6b884761288092c680590d6cd9f52434c01404d3ee4e7a769de2766075be2b4f160266c382966d3ea36a415ba7b4b0de84e347c2fd4713dc

                  • C:\Windows\svhost.exe

                    Filesize

                    458KB

                    MD5

                    eefc82bd1babcace31d1823bf8974852

                    SHA1

                    ea1e7ffb166b2c12a95fad1c7398d5e2ff74ed52

                    SHA256

                    970833813b7677c96a5ac2b136a982bc32c1179cf77aee729a0f4993f23c1f34

                    SHA512

                    6b21c156df25befe6b884761288092c680590d6cd9f52434c01404d3ee4e7a769de2766075be2b4f160266c382966d3ea36a415ba7b4b0de84e347c2fd4713dc

                  • memory/1432-226-0x0000000000380000-0x0000000000384000-memory.dmp

                    Filesize

                    16KB

                  • memory/1432-217-0x0000000000370000-0x0000000000379000-memory.dmp

                    Filesize

                    36KB

                  • memory/1432-216-0x0000000000380000-0x0000000000384000-memory.dmp

                    Filesize

                    16KB

                  • memory/1432-214-0x0000000000370000-0x0000000000379000-memory.dmp

                    Filesize

                    36KB

                  • memory/2108-228-0x0000000000570000-0x0000000000575000-memory.dmp

                    Filesize

                    20KB

                  • memory/2108-223-0x0000000000560000-0x0000000000569000-memory.dmp

                    Filesize

                    36KB

                  • memory/2108-222-0x0000000000570000-0x0000000000575000-memory.dmp

                    Filesize

                    20KB

                  • memory/2108-221-0x0000000000560000-0x0000000000569000-memory.dmp

                    Filesize

                    36KB

                  • memory/2116-210-0x0000000001000000-0x000000000107C000-memory.dmp

                    Filesize

                    496KB

                  • memory/2116-211-0x0000000001000000-0x000000000107C000-memory.dmp

                    Filesize

                    496KB

                  • memory/2116-212-0x0000000001000000-0x000000000107C000-memory.dmp

                    Filesize

                    496KB

                  • memory/2116-213-0x0000000001000000-0x000000000107C000-memory.dmp

                    Filesize

                    496KB

                  • memory/2300-218-0x0000000001040000-0x0000000001049000-memory.dmp

                    Filesize

                    36KB

                  • memory/2300-219-0x0000000001050000-0x0000000001054000-memory.dmp

                    Filesize

                    16KB

                  • memory/2300-220-0x0000000001040000-0x0000000001049000-memory.dmp

                    Filesize

                    36KB

                  • memory/2300-227-0x0000000001050000-0x0000000001054000-memory.dmp

                    Filesize

                    16KB

                  • memory/3160-134-0x00000000005C0000-0x00000000005D6000-memory.dmp

                    Filesize

                    88KB

                  • memory/3336-192-0x0000000000A20000-0x0000000000A2C000-memory.dmp

                    Filesize

                    48KB

                  • memory/3336-185-0x0000000000A20000-0x0000000000A2C000-memory.dmp

                    Filesize

                    48KB

                  • memory/4476-135-0x0000000000400000-0x0000000000409000-memory.dmp

                    Filesize

                    36KB

                  • memory/4476-133-0x0000000000400000-0x0000000000409000-memory.dmp

                    Filesize

                    36KB

                  • memory/4708-206-0x0000000000400000-0x000000000046B000-memory.dmp

                    Filesize

                    428KB

                  • memory/4708-155-0x0000000000400000-0x000000000046B000-memory.dmp

                    Filesize

                    428KB

                  • memory/4708-183-0x0000000000470000-0x00000000004F0000-memory.dmp

                    Filesize

                    512KB

                  • memory/4708-184-0x0000000000400000-0x000000000046B000-memory.dmp

                    Filesize

                    428KB