Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-03-2023 02:19

General

  • Target

    e71210a8cb9a16fe0b777e20ab8750cf.exe

  • Size

    490KB

  • MD5

    e71210a8cb9a16fe0b777e20ab8750cf

  • SHA1

    16ed028a56c4a6b008f66062e574664020cf1d30

  • SHA256

    a65de678bfc68fa18936e353ba96fed7f00134a30ead01a45f88e10adb33be9b

  • SHA512

    6fa9b47082d9212f669563806108e682fda1fdd71b343e21fd93e2163512024d560524bf2b8ebde927035447d85ca0ce8aa925b6b216c0dcb38743b2ea3e42ab

  • SSDEEP

    12288:OYyF6L25vWOfQqxa0snt/Rt/04kRVCkv2ey9bdA6NT1:OYyIKNWOYqxZstkXRVCk+B9a6NB

Malware Config

Extracted

Family

remcos

Botnet

First-Send

C2

top.not4abuse1.xyz:1558

sub.not4abuse1.xyz:1558

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    rmcs

  • mouse_option

    false

  • mutex

    Rmc-4RNJ4J

  • screenshot_crypt

    false

  • screenshot_flag

    true

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    20

  • startup_value

    Remcos

  • take_screenshot_option

    true

  • take_screenshot_time

    5

  • take_screenshot_title

    Mail;Payment;Bank

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • NirSoft MailPassView 3 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 4 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 10 IoCs
  • Executes dropped EXE 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e71210a8cb9a16fe0b777e20ab8750cf.exe
    "C:\Users\Admin\AppData\Local\Temp\e71210a8cb9a16fe0b777e20ab8750cf.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2092
    • C:\Users\Admin\AppData\Local\Temp\accpwujww.exe
      "C:\Users\Admin\AppData\Local\Temp\accpwujww.exe" C:\Users\Admin\AppData\Local\Temp\whgyqbmwow.k
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:4120
      • C:\Users\Admin\AppData\Local\Temp\accpwujww.exe
        "C:\Users\Admin\AppData\Local\Temp\accpwujww.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3508
        • C:\Users\Admin\AppData\Local\Temp\accpwujww.exe
          C:\Users\Admin\AppData\Local\Temp\accpwujww.exe /stext "C:\Users\Admin\AppData\Local\Temp\ahdhxarsewjbxetgrgtddkuegp"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2336
        • C:\Users\Admin\AppData\Local\Temp\accpwujww.exe
          C:\Users\Admin\AppData\Local\Temp\accpwujww.exe /stext "C:\Users\Admin\AppData\Local\Temp\kkqaytcusebgakpsirgeoxonpwanrl"
          4⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook accounts
          PID:4488
        • C:\Users\Admin\AppData\Local\Temp\accpwujww.exe
          C:\Users\Admin\AppData\Local\Temp\accpwujww.exe /stext "C:\Users\Admin\AppData\Local\Temp\uewsylvnomttkyewrctgrcjeykswkwnbf"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4788
        • C:\Users\Admin\AppData\Local\Temp\accpwujww.exe
          C:\Users\Admin\AppData\Local\Temp\accpwujww.exe /stext "C:\Users\Admin\AppData\Local\Temp\olnq"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:4656
        • C:\Users\Admin\AppData\Local\Temp\accpwujww.exe
          C:\Users\Admin\AppData\Local\Temp\accpwujww.exe /stext "C:\Users\Admin\AppData\Local\Temp\zgajyqr"
          4⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook accounts
          PID:3760
        • C:\Users\Admin\AppData\Local\Temp\accpwujww.exe
          C:\Users\Admin\AppData\Local\Temp\accpwujww.exe /stext "C:\Users\Admin\AppData\Local\Temp\jigbrjckpf"
          4⤵
          • Executes dropped EXE
          PID:4408

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\rmcs\logs.dat
    Filesize

    144B

    MD5

    90804612cc356ec872c22995f8204d40

    SHA1

    ab2d439beccef28970e9e3dedc2d72b8b915068f

    SHA256

    5e3e05ddfb1d99192fb6cc527b11d70501a3254e0f3a0741dc585f59d76df63e

    SHA512

    48549a6c323d821de224e2e1d2487957b245b97c4a0bfa540fd2be519c35e5302043a3c48edabce5b015c416602ec3df364e6d386a615870cde4d108beceb276

  • C:\Users\Admin\AppData\Local\Temp\accpwujww.exe
    Filesize

    5KB

    MD5

    03ae60a2d54117341e743be868497268

    SHA1

    abc4d195b5ad951058714cb38bf1ef62ca51086b

    SHA256

    0eddc8ff857b24e8c71428baa866fe6e1f3b40de1b7b51145fdb0037e8eee295

    SHA512

    b5ccddb7d3b2a110ed909146a255b627178c1dd1c80079758bd11d7919c7552d4e339407b695650a1b22426d98149cd0ba7545b4aad9fd5e5d16bff2cc77ea8a

  • C:\Users\Admin\AppData\Local\Temp\accpwujww.exe
    Filesize

    5KB

    MD5

    03ae60a2d54117341e743be868497268

    SHA1

    abc4d195b5ad951058714cb38bf1ef62ca51086b

    SHA256

    0eddc8ff857b24e8c71428baa866fe6e1f3b40de1b7b51145fdb0037e8eee295

    SHA512

    b5ccddb7d3b2a110ed909146a255b627178c1dd1c80079758bd11d7919c7552d4e339407b695650a1b22426d98149cd0ba7545b4aad9fd5e5d16bff2cc77ea8a

  • C:\Users\Admin\AppData\Local\Temp\accpwujww.exe
    Filesize

    5KB

    MD5

    03ae60a2d54117341e743be868497268

    SHA1

    abc4d195b5ad951058714cb38bf1ef62ca51086b

    SHA256

    0eddc8ff857b24e8c71428baa866fe6e1f3b40de1b7b51145fdb0037e8eee295

    SHA512

    b5ccddb7d3b2a110ed909146a255b627178c1dd1c80079758bd11d7919c7552d4e339407b695650a1b22426d98149cd0ba7545b4aad9fd5e5d16bff2cc77ea8a

  • C:\Users\Admin\AppData\Local\Temp\accpwujww.exe
    Filesize

    5KB

    MD5

    03ae60a2d54117341e743be868497268

    SHA1

    abc4d195b5ad951058714cb38bf1ef62ca51086b

    SHA256

    0eddc8ff857b24e8c71428baa866fe6e1f3b40de1b7b51145fdb0037e8eee295

    SHA512

    b5ccddb7d3b2a110ed909146a255b627178c1dd1c80079758bd11d7919c7552d4e339407b695650a1b22426d98149cd0ba7545b4aad9fd5e5d16bff2cc77ea8a

  • C:\Users\Admin\AppData\Local\Temp\accpwujww.exe
    Filesize

    5KB

    MD5

    03ae60a2d54117341e743be868497268

    SHA1

    abc4d195b5ad951058714cb38bf1ef62ca51086b

    SHA256

    0eddc8ff857b24e8c71428baa866fe6e1f3b40de1b7b51145fdb0037e8eee295

    SHA512

    b5ccddb7d3b2a110ed909146a255b627178c1dd1c80079758bd11d7919c7552d4e339407b695650a1b22426d98149cd0ba7545b4aad9fd5e5d16bff2cc77ea8a

  • C:\Users\Admin\AppData\Local\Temp\accpwujww.exe
    Filesize

    5KB

    MD5

    03ae60a2d54117341e743be868497268

    SHA1

    abc4d195b5ad951058714cb38bf1ef62ca51086b

    SHA256

    0eddc8ff857b24e8c71428baa866fe6e1f3b40de1b7b51145fdb0037e8eee295

    SHA512

    b5ccddb7d3b2a110ed909146a255b627178c1dd1c80079758bd11d7919c7552d4e339407b695650a1b22426d98149cd0ba7545b4aad9fd5e5d16bff2cc77ea8a

  • C:\Users\Admin\AppData\Local\Temp\accpwujww.exe
    Filesize

    5KB

    MD5

    03ae60a2d54117341e743be868497268

    SHA1

    abc4d195b5ad951058714cb38bf1ef62ca51086b

    SHA256

    0eddc8ff857b24e8c71428baa866fe6e1f3b40de1b7b51145fdb0037e8eee295

    SHA512

    b5ccddb7d3b2a110ed909146a255b627178c1dd1c80079758bd11d7919c7552d4e339407b695650a1b22426d98149cd0ba7545b4aad9fd5e5d16bff2cc77ea8a

  • C:\Users\Admin\AppData\Local\Temp\accpwujww.exe
    Filesize

    5KB

    MD5

    03ae60a2d54117341e743be868497268

    SHA1

    abc4d195b5ad951058714cb38bf1ef62ca51086b

    SHA256

    0eddc8ff857b24e8c71428baa866fe6e1f3b40de1b7b51145fdb0037e8eee295

    SHA512

    b5ccddb7d3b2a110ed909146a255b627178c1dd1c80079758bd11d7919c7552d4e339407b695650a1b22426d98149cd0ba7545b4aad9fd5e5d16bff2cc77ea8a

  • C:\Users\Admin\AppData\Local\Temp\accpwujww.exe
    Filesize

    5KB

    MD5

    03ae60a2d54117341e743be868497268

    SHA1

    abc4d195b5ad951058714cb38bf1ef62ca51086b

    SHA256

    0eddc8ff857b24e8c71428baa866fe6e1f3b40de1b7b51145fdb0037e8eee295

    SHA512

    b5ccddb7d3b2a110ed909146a255b627178c1dd1c80079758bd11d7919c7552d4e339407b695650a1b22426d98149cd0ba7545b4aad9fd5e5d16bff2cc77ea8a

  • C:\Users\Admin\AppData\Local\Temp\ahdhxarsewjbxetgrgtddkuegp
    Filesize

    4KB

    MD5

    b891b5489cce16fc87e912561bde5993

    SHA1

    08a8441427e19e47c4bd412c89d43b9904ac57bb

    SHA256

    f0743811f753d2fe3176907e4388d752b1d3e62a16863b31638f8dcf98767235

    SHA512

    6a81ff2e45f86c377614ee8696ca86a0ccbdcb3edd9225b70808aca45eaf3e2fc18cfa67486f46be30ef1862579cb1d1016c4b2368c94fb6432d80f4b9f5dd43

  • C:\Users\Admin\AppData\Local\Temp\gzqeznlmgbv.nua
    Filesize

    495KB

    MD5

    7871964204bbe6aad682859785968397

    SHA1

    13e83bf6a1bac3f1779610f4ac47235cd47bb9b4

    SHA256

    b41f8b955f6f159ff0d5065d855d89d5528f5a27f0d06c5d15748ad62c2d71da

    SHA512

    85b87885ab152d667cc0df2626275ada680224d4c8d686e985d578fed12be524215bb8392528af818b734b2f994979893b44e6694863fe2976959960f7f280ed

  • C:\Users\Admin\AppData\Local\Temp\olnq
    Filesize

    4KB

    MD5

    b891b5489cce16fc87e912561bde5993

    SHA1

    08a8441427e19e47c4bd412c89d43b9904ac57bb

    SHA256

    f0743811f753d2fe3176907e4388d752b1d3e62a16863b31638f8dcf98767235

    SHA512

    6a81ff2e45f86c377614ee8696ca86a0ccbdcb3edd9225b70808aca45eaf3e2fc18cfa67486f46be30ef1862579cb1d1016c4b2368c94fb6432d80f4b9f5dd43

  • C:\Users\Admin\AppData\Local\Temp\whgyqbmwow.k
    Filesize

    7KB

    MD5

    efd98d26091eabe73cae73972699c29e

    SHA1

    2b9d4cc399b13d10fe7ddc1cb84df4145c4b7ed4

    SHA256

    c7a7d9d6aacbce80718605b692fe8c5e13cf3410c1e2ab44ff979a790c918e54

    SHA512

    718a5efffa704ad2bc38a06fbfb749cef018c86177e5de91574b3a5593a303f8a2b0320ba1db16e96f4ba2d331976938e3a399f0e1031d00646eacebfee82bc7

  • memory/2336-196-0x0000000000400000-0x0000000000478000-memory.dmp
    Filesize

    480KB

  • memory/2336-194-0x0000000000400000-0x0000000000478000-memory.dmp
    Filesize

    480KB

  • memory/2336-210-0x0000000000400000-0x0000000000478000-memory.dmp
    Filesize

    480KB

  • memory/2336-212-0x0000000000400000-0x0000000000478000-memory.dmp
    Filesize

    480KB

  • memory/2336-188-0x0000000000400000-0x0000000000478000-memory.dmp
    Filesize

    480KB

  • memory/3508-181-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-155-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-167-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-168-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-169-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-170-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-171-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-173-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-174-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-175-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-176-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-178-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-180-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-160-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-182-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-183-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-185-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-187-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-158-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-142-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-157-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-156-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-144-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-164-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-154-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-152-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-145-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-228-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-147-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-222-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-220-0x0000000010000000-0x0000000010019000-memory.dmp
    Filesize

    100KB

  • memory/3508-219-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-151-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-150-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-149-0x0000000000400000-0x0000000000480000-memory.dmp
    Filesize

    512KB

  • memory/3508-215-0x0000000010000000-0x0000000010019000-memory.dmp
    Filesize

    100KB

  • memory/3508-218-0x0000000010000000-0x0000000010019000-memory.dmp
    Filesize

    100KB

  • memory/3760-251-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

  • memory/4408-250-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

  • memory/4488-207-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

  • memory/4488-204-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

  • memory/4488-199-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

  • memory/4488-190-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

  • memory/4656-248-0x0000000000400000-0x0000000000478000-memory.dmp
    Filesize

    480KB

  • memory/4788-206-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

  • memory/4788-205-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

  • memory/4788-200-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

  • memory/4788-195-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB