Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-05-2023 17:17

General

  • Target

    Urgent Inquiry_Purchase order June 2023_PDF.exe

  • Size

    1023KB

  • MD5

    d25e61a090ba1f949df8e01c61301b6f

  • SHA1

    082cea061e945c15812e123d40794031382d8eb8

  • SHA256

    de33fd9d4c89f8d5ffad69cb7743922d8d22f54890f9ca69161edce001cba9ad

  • SHA512

    eb952335eead9f188f49fd4e1c3930542c0ac449c6c2ad10d78257a41097468134a61459f2e1dd3fbf7921a365d921fde37dea30bbb0c46d130728f9d0f20d63

  • SSDEEP

    12288:jRmIcCn67ZSgSZcKqe5aITzOFjHYsHlTs6EJqdvcFsymAkm4crYFoT:jR8zS0GTzA48InMvamcrYS

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

146.70.158.105:9138

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-EDGKM0

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • ModiLoader Second Stage 1 IoCs
  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 3 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 7 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Script User-Agent 3 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Urgent Inquiry_Purchase order June 2023_PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\Urgent Inquiry_Purchase order June 2023_PDF.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4076
    • C:\Users\Public\Libraries\ioccszmD.pif
      "C:\Users\Public\Libraries\ioccszmD.pif"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2012
      • C:\Users\Public\Libraries\ioccszmD.pif
        C:\Users\Public\Libraries\ioccszmD.pif /stext "C:\Users\Admin\AppData\Local\Temp\jegzdehvqgojuscwczpl"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1824
      • C:\Users\Public\Libraries\ioccszmD.pif
        C:\Users\Public\Libraries\ioccszmD.pif /stext "C:\Users\Admin\AppData\Local\Temp\tglsexroeogneyqaljcfuiwi"
        3⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook accounts
        PID:740
      • C:\Users\Public\Libraries\ioccszmD.pif
        C:\Users\Public\Libraries\ioccszmD.pif /stext "C:\Users\Admin\AppData\Local\Temp\vaycwpcqswzshemecupgfvrqatf"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3576

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\jegzdehvqgojuscwczpl
    Filesize

    4KB

    MD5

    33cb11983bebbd43f9ddfe8d26cf9a35

    SHA1

    f505ae1e507c227d9aafcf7f95fd6ccffd56e187

    SHA256

    568f3bb004b8a52e856fbf4630cd582f3e8452bb96377b5998fc97c0705d04d0

    SHA512

    4566580ecf0b95894bdbe5a1288743509052cfa13b1f53da8fc524779a404e893b1846218ba0027309d3c7c987478123cf0381c2abff658cf179b53b6a06b5f6

  • C:\Users\Public\Libraries\ioccszmD.pif
    Filesize

    66KB

    MD5

    c116d3604ceafe7057d77ff27552c215

    SHA1

    452b14432fb5758b46f2897aeccd89f7c82a727d

    SHA256

    7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301

    SHA512

    9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

  • C:\Users\Public\Libraries\ioccszmD.pif
    Filesize

    66KB

    MD5

    c116d3604ceafe7057d77ff27552c215

    SHA1

    452b14432fb5758b46f2897aeccd89f7c82a727d

    SHA256

    7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301

    SHA512

    9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

  • C:\Users\Public\Libraries\ioccszmD.pif
    Filesize

    66KB

    MD5

    c116d3604ceafe7057d77ff27552c215

    SHA1

    452b14432fb5758b46f2897aeccd89f7c82a727d

    SHA256

    7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301

    SHA512

    9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

  • C:\Users\Public\Libraries\ioccszmD.pif
    Filesize

    66KB

    MD5

    c116d3604ceafe7057d77ff27552c215

    SHA1

    452b14432fb5758b46f2897aeccd89f7c82a727d

    SHA256

    7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301

    SHA512

    9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

  • C:\Users\Public\Libraries\ioccszmD.pif
    Filesize

    66KB

    MD5

    c116d3604ceafe7057d77ff27552c215

    SHA1

    452b14432fb5758b46f2897aeccd89f7c82a727d

    SHA256

    7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301

    SHA512

    9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

  • memory/740-176-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

  • memory/740-181-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

  • memory/740-174-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

  • memory/740-165-0x0000000000400000-0x0000000000457000-memory.dmp
    Filesize

    348KB

  • memory/1824-185-0x0000000000400000-0x0000000000478000-memory.dmp
    Filesize

    480KB

  • memory/1824-163-0x0000000000400000-0x0000000000478000-memory.dmp
    Filesize

    480KB

  • memory/1824-173-0x0000000000400000-0x0000000000478000-memory.dmp
    Filesize

    480KB

  • memory/1824-170-0x0000000000400000-0x0000000000478000-memory.dmp
    Filesize

    480KB

  • memory/1824-187-0x0000000000400000-0x0000000000478000-memory.dmp
    Filesize

    480KB

  • memory/2012-155-0x00000000105A0000-0x0000000010667000-memory.dmp
    Filesize

    796KB

  • memory/2012-196-0x0000000000400000-0x000000000041A000-memory.dmp
    Filesize

    104KB

  • memory/2012-160-0x0000000000630000-0x00000000006B1000-memory.dmp
    Filesize

    516KB

  • memory/2012-162-0x0000000000630000-0x00000000006B1000-memory.dmp
    Filesize

    516KB

  • memory/2012-158-0x0000000000630000-0x00000000006B1000-memory.dmp
    Filesize

    516KB

  • memory/2012-157-0x0000000000630000-0x00000000006B1000-memory.dmp
    Filesize

    516KB

  • memory/2012-156-0x0000000000630000-0x00000000006B1000-memory.dmp
    Filesize

    516KB

  • memory/2012-214-0x0000000000630000-0x00000000006B1000-memory.dmp
    Filesize

    516KB

  • memory/2012-154-0x0000000000630000-0x00000000006B1000-memory.dmp
    Filesize

    516KB

  • memory/2012-153-0x0000000000630000-0x00000000006B1000-memory.dmp
    Filesize

    516KB

  • memory/2012-213-0x0000000000630000-0x00000000006B1000-memory.dmp
    Filesize

    516KB

  • memory/2012-209-0x0000000000630000-0x00000000006B1000-memory.dmp
    Filesize

    516KB

  • memory/2012-151-0x00000000005E0000-0x00000000005E1000-memory.dmp
    Filesize

    4KB

  • memory/2012-208-0x0000000000630000-0x00000000006B1000-memory.dmp
    Filesize

    516KB

  • memory/2012-145-0x0000000000580000-0x0000000000581000-memory.dmp
    Filesize

    4KB

  • memory/2012-204-0x0000000000630000-0x00000000006B1000-memory.dmp
    Filesize

    516KB

  • memory/2012-143-0x00000000001E0000-0x00000000001E1000-memory.dmp
    Filesize

    4KB

  • memory/2012-203-0x0000000000630000-0x00000000006B1000-memory.dmp
    Filesize

    516KB

  • memory/2012-199-0x0000000000630000-0x00000000006B1000-memory.dmp
    Filesize

    516KB

  • memory/2012-198-0x0000000000630000-0x00000000006B1000-memory.dmp
    Filesize

    516KB

  • memory/2012-197-0x0000000000630000-0x00000000006B1000-memory.dmp
    Filesize

    516KB

  • memory/2012-190-0x0000000010000000-0x0000000010019000-memory.dmp
    Filesize

    100KB

  • memory/2012-193-0x0000000010000000-0x0000000010019000-memory.dmp
    Filesize

    100KB

  • memory/2012-194-0x0000000000630000-0x00000000006B1000-memory.dmp
    Filesize

    516KB

  • memory/2012-195-0x0000000010000000-0x0000000010019000-memory.dmp
    Filesize

    100KB

  • memory/2012-159-0x0000000000630000-0x00000000006B1000-memory.dmp
    Filesize

    516KB

  • memory/3576-183-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

  • memory/3576-167-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

  • memory/3576-177-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

  • memory/3576-175-0x0000000000400000-0x0000000000424000-memory.dmp
    Filesize

    144KB

  • memory/4076-134-0x0000000004360000-0x0000000004392000-memory.dmp
    Filesize

    200KB

  • memory/4076-136-0x0000000000400000-0x0000000000508000-memory.dmp
    Filesize

    1.0MB

  • memory/4076-142-0x00000000105A0000-0x0000000010667000-memory.dmp
    Filesize

    796KB

  • memory/4076-150-0x00000000105A0000-0x0000000010667000-memory.dmp
    Filesize

    796KB

  • memory/4076-133-0x00000000022B0000-0x00000000022B1000-memory.dmp
    Filesize

    4KB