Analysis

  • max time kernel
    76s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-03-2023 17:44

General

  • Target

    DOCX_F0067193508.exe

  • Size

    1024.0MB

  • MD5

    932f4060cc31b4dbaffa1bb6d3991c20

  • SHA1

    989f4fb91c3a30a0789c0d61c1b8c5dad659747e

  • SHA256

    a40084ddc1d6655c2f78365a9ef6a9b81997cfa98a6f81c8d7dfe9619ef6b853

  • SHA512

    7bb952847d5bacff9275415ba02a6fbeb180d16b2ef23591a60f9fe302f51301d7c967af5eaa5dc9135ceb108cdf25afdf745a3875b5b0655924452d1f753ba5

  • SSDEEP

    6144:AxjCbYJafbpsBSM/HVFku/7AGLr5lw2H3SgoXraFjvVpQ+QW8uR3OoJWwvTTZlIY:+PozpsBzkuHPgDsvELuv7ZlIgCjIDF

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

BILLETE

C2

cactus.con-ip.com:7770

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-9927QM

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DOCX_F0067193508.exe
    "C:\Users\Admin\AppData\Local\Temp\DOCX_F0067193508.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2496
    • C:\Windows\SysWOW64\cmd.exe
      "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\AppData.exe'" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5000
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\AppData.exe'" /f
        3⤵
        • Creates scheduled task(s)
        PID:2292
    • C:\Windows\SysWOW64\cmd.exe
      "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\DOCX_F0067193508.exe" "C:\Users\Admin\AppData\Roaming\AppData.exe"
      2⤵
        PID:2916
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "'C:\Users\Admin\AppData\Local\Temp\DOCX_F0067193508.exe'"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2900
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
        2⤵
        • Suspicious use of SetWindowsHookEx
        PID:2540
    • C:\Users\Admin\AppData\Roaming\AppData.exe
      C:\Users\Admin\AppData\Roaming\AppData.exe
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2792
      • C:\Windows\SysWOW64\cmd.exe
        "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\AppData.exe'" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3340
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\AppData.exe'" /f
          3⤵
          • Creates scheduled task(s)
          PID:3300
      • C:\Windows\SysWOW64\cmd.exe
        "cmd" /c copy "C:\Users\Admin\AppData\Roaming\AppData.exe" "C:\Users\Admin\AppData\Roaming\AppData.exe"
        2⤵
          PID:904
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "'C:\Users\Admin\AppData\Roaming\AppData.exe'"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2728
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
          2⤵
            PID:5076
        • C:\Users\Admin\AppData\Roaming\AppData.exe
          C:\Users\Admin\AppData\Roaming\AppData.exe
          1⤵
            PID:4420
            • C:\Windows\SysWOW64\cmd.exe
              "cmd" /c copy "C:\Users\Admin\AppData\Roaming\AppData.exe" "C:\Users\Admin\AppData\Roaming\AppData.exe"
              2⤵
                PID:2572
              • C:\Windows\SysWOW64\cmd.exe
                "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\AppData.exe'" /f
                2⤵
                  PID:996
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\AppData.exe'" /f
                    3⤵
                    • Creates scheduled task(s)
                    PID:3400
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "'C:\Users\Admin\AppData\Roaming\AppData.exe'"
                  2⤵
                    PID:4104
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                    2⤵
                      PID:4364

                  Network

                  MITRE ATT&CK Matrix ATT&CK v6

                  Execution

                  Scheduled Task

                  1
                  T1053

                  Persistence

                  Scheduled Task

                  1
                  T1053

                  Privilege Escalation

                  Scheduled Task

                  1
                  T1053

                  Discovery

                  Query Registry

                  1
                  T1012

                  System Information Discovery

                  2
                  T1082

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\ProgramData\remcos\logs.dat
                    Filesize

                    144B

                    MD5

                    0064be61d972df61f4f0c0006ea59af9

                    SHA1

                    59789a9f0959efa5c3777f7fcd0142fc6a1caab3

                    SHA256

                    102e869b1bb154fec6e31713ee71d18e4c3e9af6964dda12c6d0465af07b7905

                    SHA512

                    fa7caca4dddf24d44b9ce525dd0be2513b702f22ba61d5d1d021cb1adcc5809658515a44697538c2cd133fa54fd803c38617c2d9b6c0abad99b9ff28b07c6fa1

                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppData.exe.log
                    Filesize

                    520B

                    MD5

                    03febbff58da1d3318c31657d89c8542

                    SHA1

                    c9e017bd9d0a4fe533795b227c855935d86c2092

                    SHA256

                    5164770a37b199a79ccd23b399bb3309228973d9f74c589bc2623dc613b37ac4

                    SHA512

                    3750c372bbca1892e9c1b34681d592c693e725a8b149c3d6938079cd467628cec42c4293b0d886b57a786abf45f5e7229247b3445001774e3e793ff5a3accfa3

                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                    Filesize

                    2KB

                    MD5

                    968cb9309758126772781b83adb8a28f

                    SHA1

                    8da30e71accf186b2ba11da1797cf67f8f78b47c

                    SHA256

                    92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                    SHA512

                    4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    Filesize

                    16KB

                    MD5

                    4b333e9cca3b8b16e2206fc271c6bea2

                    SHA1

                    6dc75f6608df8be67d2a86db4c8f12cc49dd4fca

                    SHA256

                    6e59ec05607e2b34b68c1c037c627d2119b2d26190a661cff396e8dbd44575cf

                    SHA512

                    c827bf2a1b3192a6e172168f8eca9ebabadee92d6f3c761fd0cc65a5843fff2b39ad9a440e8421c7897a9bf63ecdb1054b5403a4ed0636f81ff0c54aed232c99

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    Filesize

                    16KB

                    MD5

                    ce8bba31432b91d1c0f8b42a3ab1a6a7

                    SHA1

                    e51900e65c7e572853cc492bc2f8e88a4288096a

                    SHA256

                    5b72f2e4f57331a7c53b7a80df2d7d5622a7dcdfd480c51afd7f8bf17f99386a

                    SHA512

                    5b34650b2e7c47176fafc25ecce1f7df400dbab39659cd8c0766a26526ff094a1dbd998deeded78e1e67b242ddee62f4391870238c3fe9e670bb42f14e594c33

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r5f23xfe.qdh.ps1
                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  • C:\Users\Admin\AppData\Roaming\AppData.exe
                    Filesize

                    641.9MB

                    MD5

                    7ffedb8dfca19a081bd6441f03527eed

                    SHA1

                    0fa8bd9e33f496fe7764463d41e7d85d98464ec9

                    SHA256

                    7e7ba5a4795c063d4400c2ec25667cb108073277047771f3383565577c684564

                    SHA512

                    869b8440c195b1e8b463b1282ebbdf4aee11f0e5a771ab27230bdfacda5a1626f908578dfdc8fd8359249a8674a02b52690ecb1b81862f6ac7ffb98ab584cc16

                  • C:\Users\Admin\AppData\Roaming\AppData.exe
                    Filesize

                    714.7MB

                    MD5

                    e6dd1650307aa151a1ca60a9c545699d

                    SHA1

                    f28e82ace3501ef2aa207fb82a1f45309e740e26

                    SHA256

                    e53f1c8d75989376361faffb74af511ca1876de74836aa04b7db22ef578976cc

                    SHA512

                    2e3e2db6f440369be6bcc975504ebbcf7f2bd28ecdabad980d3b08831241c85d0acded68c69d304f858890503957af608261af4a177036dbf1c4f8317799b001

                  • C:\Users\Admin\AppData\Roaming\AppData.exe
                    Filesize

                    214.2MB

                    MD5

                    e9bd27793634dddd10c8c5d858f52760

                    SHA1

                    bea33240a875a215cda8490363f229a700118fbe

                    SHA256

                    3cd7d064d72da75fdd2c473211e64c28da9640e8fce08a7fa1d9b300c9bb692b

                    SHA512

                    a65a6d656357a724db4ea42a4921e595a07edfa577dac1e4c0f0098690225f846869cc5063759ea8e2121d2784393942f1538e8cfde0be1098e08d2072f26da6

                  • memory/2496-134-0x0000000005200000-0x00000000057A4000-memory.dmp
                    Filesize

                    5.6MB

                  • memory/2496-133-0x00000000001D0000-0x0000000000302000-memory.dmp
                    Filesize

                    1.2MB

                  • memory/2540-280-0x0000000000400000-0x0000000000480000-memory.dmp
                    Filesize

                    512KB

                  • memory/2540-282-0x0000000000400000-0x0000000000480000-memory.dmp
                    Filesize

                    512KB

                  • memory/2540-197-0x0000000000400000-0x0000000000480000-memory.dmp
                    Filesize

                    512KB

                  • memory/2540-143-0x0000000000400000-0x0000000000480000-memory.dmp
                    Filesize

                    512KB

                  • memory/2540-141-0x0000000000400000-0x0000000000480000-memory.dmp
                    Filesize

                    512KB

                  • memory/2540-246-0x0000000000400000-0x0000000000480000-memory.dmp
                    Filesize

                    512KB

                  • memory/2540-162-0x0000000000400000-0x0000000000480000-memory.dmp
                    Filesize

                    512KB

                  • memory/2540-163-0x0000000000400000-0x0000000000480000-memory.dmp
                    Filesize

                    512KB

                  • memory/2540-164-0x0000000000400000-0x0000000000480000-memory.dmp
                    Filesize

                    512KB

                  • memory/2540-165-0x0000000000400000-0x0000000000480000-memory.dmp
                    Filesize

                    512KB

                  • memory/2540-168-0x0000000000400000-0x0000000000480000-memory.dmp
                    Filesize

                    512KB

                  • memory/2540-245-0x0000000000400000-0x0000000000480000-memory.dmp
                    Filesize

                    512KB

                  • memory/2540-193-0x0000000000400000-0x0000000000480000-memory.dmp
                    Filesize

                    512KB

                  • memory/2540-198-0x0000000000400000-0x0000000000480000-memory.dmp
                    Filesize

                    512KB

                  • memory/2540-136-0x0000000000400000-0x0000000000480000-memory.dmp
                    Filesize

                    512KB

                  • memory/2540-225-0x0000000000400000-0x0000000000480000-memory.dmp
                    Filesize

                    512KB

                  • memory/2540-140-0x0000000000400000-0x0000000000480000-memory.dmp
                    Filesize

                    512KB

                  • memory/2540-138-0x0000000000400000-0x0000000000480000-memory.dmp
                    Filesize

                    512KB

                  • memory/2540-146-0x0000000000400000-0x0000000000480000-memory.dmp
                    Filesize

                    512KB

                  • memory/2728-222-0x00000000032A0000-0x00000000032B0000-memory.dmp
                    Filesize

                    64KB

                  • memory/2728-223-0x00000000032A0000-0x00000000032B0000-memory.dmp
                    Filesize

                    64KB

                  • memory/2728-228-0x00000000756F0000-0x000000007573C000-memory.dmp
                    Filesize

                    304KB

                  • memory/2728-238-0x00000000032A0000-0x00000000032B0000-memory.dmp
                    Filesize

                    64KB

                  • memory/2728-239-0x000000007F5B0000-0x000000007F5C0000-memory.dmp
                    Filesize

                    64KB

                  • memory/2728-284-0x000000007F5B0000-0x000000007F5C0000-memory.dmp
                    Filesize

                    64KB

                  • memory/2900-154-0x0000000006150000-0x00000000061B6000-memory.dmp
                    Filesize

                    408KB

                  • memory/2900-171-0x0000000070650000-0x000000007069C000-memory.dmp
                    Filesize

                    304KB

                  • memory/2900-188-0x0000000007DD0000-0x0000000007DEA000-memory.dmp
                    Filesize

                    104KB

                  • memory/2900-187-0x0000000007CD0000-0x0000000007CDE000-memory.dmp
                    Filesize

                    56KB

                  • memory/2900-135-0x00000000051F0000-0x0000000005226000-memory.dmp
                    Filesize

                    216KB

                  • memory/2900-139-0x0000000005940000-0x0000000005F68000-memory.dmp
                    Filesize

                    6.2MB

                  • memory/2900-144-0x0000000005300000-0x0000000005310000-memory.dmp
                    Filesize

                    64KB

                  • memory/2900-186-0x0000000007D10000-0x0000000007DA6000-memory.dmp
                    Filesize

                    600KB

                  • memory/2900-185-0x0000000007B20000-0x0000000007B2A000-memory.dmp
                    Filesize

                    40KB

                  • memory/2900-184-0x000000007F7A0000-0x000000007F7B0000-memory.dmp
                    Filesize

                    64KB

                  • memory/2900-183-0x00000000077E0000-0x00000000077FA000-memory.dmp
                    Filesize

                    104KB

                  • memory/2900-182-0x0000000008160000-0x00000000087DA000-memory.dmp
                    Filesize

                    6.5MB

                  • memory/2900-181-0x0000000006D40000-0x0000000006D5E000-memory.dmp
                    Filesize

                    120KB

                  • memory/2900-189-0x0000000007DC0000-0x0000000007DC8000-memory.dmp
                    Filesize

                    32KB

                  • memory/2900-170-0x0000000007750000-0x0000000007782000-memory.dmp
                    Filesize

                    200KB

                  • memory/2900-169-0x0000000005300000-0x0000000005310000-memory.dmp
                    Filesize

                    64KB

                  • memory/2900-159-0x00000000067B0000-0x00000000067CE000-memory.dmp
                    Filesize

                    120KB

                  • memory/2900-148-0x00000000060E0000-0x0000000006146000-memory.dmp
                    Filesize

                    408KB

                  • memory/2900-147-0x00000000057D0000-0x00000000057F2000-memory.dmp
                    Filesize

                    136KB

                  • memory/2900-145-0x0000000005300000-0x0000000005310000-memory.dmp
                    Filesize

                    64KB

                  • memory/4104-267-0x0000000072740000-0x000000007278C000-memory.dmp
                    Filesize

                    304KB

                  • memory/4104-277-0x0000000005440000-0x0000000005450000-memory.dmp
                    Filesize

                    64KB

                  • memory/4364-256-0x0000000000400000-0x0000000000480000-memory.dmp
                    Filesize

                    512KB

                  • memory/4364-254-0x0000000000400000-0x0000000000480000-memory.dmp
                    Filesize

                    512KB

                  • memory/4364-255-0x0000000000400000-0x0000000000480000-memory.dmp
                    Filesize

                    512KB

                  • memory/5076-211-0x0000000000400000-0x0000000000480000-memory.dmp
                    Filesize

                    512KB

                  • memory/5076-210-0x0000000000400000-0x0000000000480000-memory.dmp
                    Filesize

                    512KB

                  • memory/5076-209-0x0000000000400000-0x0000000000480000-memory.dmp
                    Filesize

                    512KB