Analysis

  • max time kernel
    188s
  • max time network
    284s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-03-2023 23:18

General

  • Target

    60793dd7cdaf080ab5ba21a3c1294e32.exe

  • Size

    1024.0MB

  • MD5

    932f4060cc31b4dbaffa1bb6d3991c20

  • SHA1

    989f4fb91c3a30a0789c0d61c1b8c5dad659747e

  • SHA256

    a40084ddc1d6655c2f78365a9ef6a9b81997cfa98a6f81c8d7dfe9619ef6b853

  • SHA512

    7bb952847d5bacff9275415ba02a6fbeb180d16b2ef23591a60f9fe302f51301d7c967af5eaa5dc9135ceb108cdf25afdf745a3875b5b0655924452d1f753ba5

  • SSDEEP

    6144:AxjCbYJafbpsBSM/HVFku/7AGLr5lw2H3SgoXraFjvVpQ+QW8uR3OoJWwvTTZlIY:+PozpsBzkuHPgDsvELuv7ZlIgCjIDF

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

BILLETE

C2

cactus.con-ip.com:7770

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-9927QM

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 5 IoCs
  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\60793dd7cdaf080ab5ba21a3c1294e32.exe
    "C:\Users\Admin\AppData\Local\Temp\60793dd7cdaf080ab5ba21a3c1294e32.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:228
    • C:\Windows\SysWOW64\cmd.exe
      "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\AppData.exe'" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1232
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\AppData.exe'" /f
        3⤵
        • Creates scheduled task(s)
        PID:1608
    • C:\Windows\SysWOW64\cmd.exe
      "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\60793dd7cdaf080ab5ba21a3c1294e32.exe" "C:\Users\Admin\AppData\Roaming\AppData.exe"
      2⤵
        PID:1280
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "'C:\Users\Admin\AppData\Local\Temp\60793dd7cdaf080ab5ba21a3c1294e32.exe'"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1584
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
        2⤵
          PID:524
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 508
            3⤵
            • Program crash
            PID:4344
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 512
            3⤵
            • Program crash
            PID:4460
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 524 -ip 524
        1⤵
          PID:1360
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 524 -ip 524
          1⤵
            PID:5112
          • C:\Users\Admin\AppData\Roaming\AppData.exe
            C:\Users\Admin\AppData\Roaming\AppData.exe
            1⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2240
            • C:\Windows\SysWOW64\cmd.exe
              "cmd" /c copy "C:\Users\Admin\AppData\Roaming\AppData.exe" "C:\Users\Admin\AppData\Roaming\AppData.exe"
              2⤵
                PID:2204
              • C:\Windows\SysWOW64\cmd.exe
                "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\AppData.exe'" /f
                2⤵
                  PID:3124
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\AppData.exe'" /f
                    3⤵
                    • Creates scheduled task(s)
                    PID:4476
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "'C:\Users\Admin\AppData\Roaming\AppData.exe'"
                  2⤵
                    PID:916
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                    2⤵
                      PID:5064
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 508
                        3⤵
                        • Program crash
                        PID:4592
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 512
                        3⤵
                        • Program crash
                        PID:1748
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5064 -ip 5064
                    1⤵
                      PID:2248
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5064 -ip 5064
                      1⤵
                        PID:4880
                      • C:\Users\Admin\AppData\Roaming\AppData.exe
                        C:\Users\Admin\AppData\Roaming\AppData.exe
                        1⤵
                          PID:1516
                          • C:\Windows\SysWOW64\cmd.exe
                            "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\AppData.exe'" /f
                            2⤵
                              PID:396
                              • C:\Windows\SysWOW64\schtasks.exe
                                schtasks /create /sc minute /mo 1 /tn "Nafdfnasia" /tr "'C:\Users\Admin\AppData\Roaming\AppData.exe'" /f
                                3⤵
                                • Creates scheduled task(s)
                                PID:1152
                            • C:\Windows\SysWOW64\cmd.exe
                              "cmd" /c copy "C:\Users\Admin\AppData\Roaming\AppData.exe" "C:\Users\Admin\AppData\Roaming\AppData.exe"
                              2⤵
                                PID:680
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
                                2⤵
                                  PID:4112
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4112 -s 508
                                    3⤵
                                    • Program crash
                                    PID:4544
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "'C:\Users\Admin\AppData\Roaming\AppData.exe'"
                                  2⤵
                                    PID:4424
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4112 -ip 4112
                                  1⤵
                                    PID:1924

                                  Network

                                  MITRE ATT&CK Matrix ATT&CK v6

                                  Execution

                                  Scheduled Task

                                  1
                                  T1053

                                  Persistence

                                  Scheduled Task

                                  1
                                  T1053

                                  Privilege Escalation

                                  Scheduled Task

                                  1
                                  T1053

                                  Discovery

                                  Query Registry

                                  1
                                  T1012

                                  System Information Discovery

                                  2
                                  T1082

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppData.exe.log
                                    Filesize

                                    520B

                                    MD5

                                    03febbff58da1d3318c31657d89c8542

                                    SHA1

                                    c9e017bd9d0a4fe533795b227c855935d86c2092

                                    SHA256

                                    5164770a37b199a79ccd23b399bb3309228973d9f74c589bc2623dc613b37ac4

                                    SHA512

                                    3750c372bbca1892e9c1b34681d592c693e725a8b149c3d6938079cd467628cec42c4293b0d886b57a786abf45f5e7229247b3445001774e3e793ff5a3accfa3

                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                    Filesize

                                    2KB

                                    MD5

                                    32adf4666e1ecad83d3cebbd99fde9e2

                                    SHA1

                                    e993ccbddf6b15f9e590dbd71009a0d07b8aa16a

                                    SHA256

                                    03ee4d16a211f1651e34288cb55823714dd0b6204d052835ac75f6ceab1cf066

                                    SHA512

                                    ee38b72ed5364f110e04cd250af5ab6f7f2f56275ead351efab4066d818ce69c4783aee7490006a2c02dde1fcca7f218816ad349945c91e8c331e248a6f4c96b

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                                    Filesize

                                    55KB

                                    MD5

                                    439668a96a8db3334d947c7d1db72748

                                    SHA1

                                    c16b3bc1bc4ce41a215b503fa5a03363968446fc

                                    SHA256

                                    57f7a80c6615e1d73075184b2c2a2a1e94decccb908bc2b98e454a2137b9814b

                                    SHA512

                                    95b8457c3797359edd51892c1798ac77effaddee874d927442694fae1db1b60b6abed130e7a750c3d7986761238ee700c578a6b9716f3ab82e5030975f1d7f18

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    Filesize

                                    16KB

                                    MD5

                                    3a7774d6c6c1b527df1a6b77d5014eb2

                                    SHA1

                                    79659dc156c78354621bd4d493c438e05e87407e

                                    SHA256

                                    42815350013dc5376def6cd9c364924434136bdd3b865c33616e11b490444d6c

                                    SHA512

                                    9837afdc0dadb8e3972b714f0a2d7720c05158c5256aee7446a1320eb362e69ac8612d856db97d06d80d70291d94de25e06d04e12e31f5f9641f0855dd50bfe4

                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                    Filesize

                                    16KB

                                    MD5

                                    3a7774d6c6c1b527df1a6b77d5014eb2

                                    SHA1

                                    79659dc156c78354621bd4d493c438e05e87407e

                                    SHA256

                                    42815350013dc5376def6cd9c364924434136bdd3b865c33616e11b490444d6c

                                    SHA512

                                    9837afdc0dadb8e3972b714f0a2d7720c05158c5256aee7446a1320eb362e69ac8612d856db97d06d80d70291d94de25e06d04e12e31f5f9641f0855dd50bfe4

                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_scvlymhp.f50.ps1
                                    Filesize

                                    60B

                                    MD5

                                    d17fe0a3f47be24a6453e9ef58c94641

                                    SHA1

                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                    SHA256

                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                    SHA512

                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                  • C:\Users\Admin\AppData\Roaming\AppData.exe
                                    Filesize

                                    431.1MB

                                    MD5

                                    2a76de65c26685ae661c0fb6faf52752

                                    SHA1

                                    439b44a04409c68f7c4048c431058c8f7c8fc795

                                    SHA256

                                    15ad89aca7fc84add5b6233139317baee15eb5d67ee1fc8578252766298ebd63

                                    SHA512

                                    a06cf7d4fadd697bfb13ac2aaadcaeed6963f1d21634a5d69c24137c281445aedc7d62254b357176e2f3a8d21ebb8ec4736ad0153bb4941d56983ac4ed8fe54a

                                  • C:\Users\Admin\AppData\Roaming\AppData.exe
                                    Filesize

                                    429.1MB

                                    MD5

                                    63f40626f932de6b6717966e0976a20c

                                    SHA1

                                    afccde826b6ab3e840214d5fa864b235d51261ac

                                    SHA256

                                    fed8581cbb2cbb11796f088a79d9fe82e6f5b1a1e883bbb338dc98abc10bbd48

                                    SHA512

                                    58b25e27b65a40bb6e466416db622099e55f3900c4563f63ac9b54893007f616b32872d9ccf26d94dc954088e4998e52b674cb2db319d77fe4ac63f3b63b9472

                                  • C:\Users\Admin\AppData\Roaming\AppData.exe
                                    Filesize

                                    61.9MB

                                    MD5

                                    9fa29133d65c1035ab7a75ca9f20b4c2

                                    SHA1

                                    bdb619de40bfc8cc7e1dd1bf95c046ae99fe1eaf

                                    SHA256

                                    06ff8902fd84dc40e3d42fdf8e5f7e12157114f24fb89ba74ed3a06a8d1ef819

                                    SHA512

                                    3bcc22b48ca635071e14f67edd7b43a5df0753d057e08acf08218656f1e573ddf6a7417087751d1178b9a4ced78a1be0088a63807ba6301bbe7a194a4b3db807

                                  • memory/228-133-0x00000000000A0000-0x00000000001D2000-memory.dmp
                                    Filesize

                                    1.2MB

                                  • memory/228-134-0x0000000005030000-0x00000000055D4000-memory.dmp
                                    Filesize

                                    5.6MB

                                  • memory/228-141-0x0000000004A00000-0x0000000004A10000-memory.dmp
                                    Filesize

                                    64KB

                                  • memory/524-153-0x0000000000ED0000-0x0000000000F50000-memory.dmp
                                    Filesize

                                    512KB

                                  • memory/524-148-0x0000000000ED0000-0x0000000000F50000-memory.dmp
                                    Filesize

                                    512KB

                                  • memory/524-137-0x0000000000ED0000-0x0000000000F50000-memory.dmp
                                    Filesize

                                    512KB

                                  • memory/916-230-0x0000000004770000-0x0000000004780000-memory.dmp
                                    Filesize

                                    64KB

                                  • memory/916-232-0x000000007F660000-0x000000007F670000-memory.dmp
                                    Filesize

                                    64KB

                                  • memory/916-231-0x0000000004770000-0x0000000004780000-memory.dmp
                                    Filesize

                                    64KB

                                  • memory/916-233-0x00000000061A0000-0x00000000061AE000-memory.dmp
                                    Filesize

                                    56KB

                                  • memory/916-229-0x0000000004770000-0x0000000004780000-memory.dmp
                                    Filesize

                                    64KB

                                  • memory/916-227-0x000000007F660000-0x000000007F670000-memory.dmp
                                    Filesize

                                    64KB

                                  • memory/916-217-0x0000000071570000-0x00000000715BC000-memory.dmp
                                    Filesize

                                    304KB

                                  • memory/916-214-0x0000000004770000-0x0000000004780000-memory.dmp
                                    Filesize

                                    64KB

                                  • memory/916-234-0x0000000006FE0000-0x0000000006FFA000-memory.dmp
                                    Filesize

                                    104KB

                                  • memory/916-213-0x0000000004770000-0x0000000004780000-memory.dmp
                                    Filesize

                                    64KB

                                  • memory/916-235-0x0000000007030000-0x0000000007038000-memory.dmp
                                    Filesize

                                    32KB

                                  • memory/1584-156-0x0000000005580000-0x00000000055E6000-memory.dmp
                                    Filesize

                                    408KB

                                  • memory/1584-170-0x0000000006A00000-0x0000000006A32000-memory.dmp
                                    Filesize

                                    200KB

                                  • memory/1584-187-0x000000007EFB0000-0x000000007EFC0000-memory.dmp
                                    Filesize

                                    64KB

                                  • memory/1584-186-0x0000000004630000-0x0000000004640000-memory.dmp
                                    Filesize

                                    64KB

                                  • memory/1584-135-0x0000000004520000-0x0000000004556000-memory.dmp
                                    Filesize

                                    216KB

                                  • memory/1584-138-0x0000000004C70000-0x0000000005298000-memory.dmp
                                    Filesize

                                    6.2MB

                                  • memory/1584-139-0x0000000004630000-0x0000000004640000-memory.dmp
                                    Filesize

                                    64KB

                                  • memory/1584-185-0x0000000006D70000-0x0000000006D7A000-memory.dmp
                                    Filesize

                                    40KB

                                  • memory/1584-184-0x0000000006D10000-0x0000000006D2A000-memory.dmp
                                    Filesize

                                    104KB

                                  • memory/1584-183-0x00000000073D0000-0x0000000007A4A000-memory.dmp
                                    Filesize

                                    6.5MB

                                  • memory/1584-182-0x00000000069C0000-0x00000000069DE000-memory.dmp
                                    Filesize

                                    120KB

                                  • memory/1584-172-0x0000000071570000-0x00000000715BC000-memory.dmp
                                    Filesize

                                    304KB

                                  • memory/1584-171-0x000000007EFB0000-0x000000007EFC0000-memory.dmp
                                    Filesize

                                    64KB

                                  • memory/1584-189-0x0000000007010000-0x00000000070A6000-memory.dmp
                                    Filesize

                                    600KB

                                  • memory/1584-169-0x0000000004630000-0x0000000004640000-memory.dmp
                                    Filesize

                                    64KB

                                  • memory/1584-168-0x0000000000710000-0x000000000072E000-memory.dmp
                                    Filesize

                                    120KB

                                  • memory/1584-167-0x0000000004630000-0x0000000004640000-memory.dmp
                                    Filesize

                                    64KB

                                  • memory/1584-166-0x0000000004630000-0x0000000004640000-memory.dmp
                                    Filesize

                                    64KB

                                  • memory/1584-155-0x0000000005510000-0x0000000005576000-memory.dmp
                                    Filesize

                                    408KB

                                  • memory/1584-154-0x00000000048A0000-0x00000000048C2000-memory.dmp
                                    Filesize

                                    136KB

                                  • memory/1584-145-0x0000000004630000-0x0000000004640000-memory.dmp
                                    Filesize

                                    64KB

                                  • memory/2240-192-0x00000000017E0000-0x00000000017F0000-memory.dmp
                                    Filesize

                                    64KB

                                  • memory/4112-253-0x00000000002C0000-0x0000000000340000-memory.dmp
                                    Filesize

                                    512KB

                                  • memory/4112-248-0x00000000002C0000-0x0000000000340000-memory.dmp
                                    Filesize

                                    512KB

                                  • memory/4424-265-0x00000000030D0000-0x00000000030E0000-memory.dmp
                                    Filesize

                                    64KB

                                  • memory/4424-264-0x00000000030D0000-0x00000000030E0000-memory.dmp
                                    Filesize

                                    64KB

                                  • memory/5064-203-0x00000000010A0000-0x0000000001120000-memory.dmp
                                    Filesize

                                    512KB

                                  • memory/5064-198-0x00000000010A0000-0x0000000001120000-memory.dmp
                                    Filesize

                                    512KB