Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    04/12/2023, 17:20

General

  • Target

    FAT986545600986.exe

  • Size

    1.0MB

  • MD5

    470249dbfe3ac7f1d16ea4a52ef76fb3

  • SHA1

    984ef38fbfa4efd6b9310a07c4a6b2be63e328bf

  • SHA256

    f77532a0a209676025270db283534fc63ba0780415e8273d670fc6d1bc4bf1f5

  • SHA512

    ec2edf6140afcf84719a8a2d53303ee86fa6b32406b0fc99db6d87dcc162577b9766f88e5fb7643e4cb4fb09c5431c5ab3d8029800eab02aa1b81914e3faba39

  • SSDEEP

    24576:h34/up+pJ1sRbSz55MlrTQF4ZriIqBT3peD:h38PJ1QSz55CsIiIqBs

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

107.175.229.139:8087

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-IZFV1M

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FAT986545600986.exe
    "C:\Users\Admin\AppData\Local\Temp\FAT986545600986.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2116
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\FAT986545600986.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2556
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zulqgtKXtL.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2740
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zulqgtKXtL" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE531.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2700
    • C:\Users\Admin\AppData\Local\Temp\FAT986545600986.exe
      "C:\Users\Admin\AppData\Local\Temp\FAT986545600986.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2772
      • C:\Users\Admin\AppData\Local\Temp\FAT986545600986.exe
        C:\Users\Admin\AppData\Local\Temp\FAT986545600986.exe /stext "C:\Users\Admin\AppData\Local\Temp\oxgfjaplcxnyuvqnibwawxqu"
        3⤵
          PID:2436
        • C:\Users\Admin\AppData\Local\Temp\FAT986545600986.exe
          C:\Users\Admin\AppData\Local\Temp\FAT986545600986.exe /stext "C:\Users\Admin\AppData\Local\Temp\oxgfjaplcxnyuvqnibwawxqu"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1080
        • C:\Users\Admin\AppData\Local\Temp\FAT986545600986.exe
          C:\Users\Admin\AppData\Local\Temp\FAT986545600986.exe /stext "C:\Users\Admin\AppData\Local\Temp\zsmxcsamqffdekerrmrbzkldmxu"
          3⤵
          • Accesses Microsoft Outlook accounts
          PID:1644
        • C:\Users\Admin\AppData\Local\Temp\FAT986545600986.exe
          C:\Users\Admin\AppData\Local\Temp\FAT986545600986.exe /stext "C:\Users\Admin\AppData\Local\Temp\burqcltgenxqhqbdixedkpyuvelfhkb"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1724

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\remcos\logs.dat

            Filesize

            144B

            MD5

            77dac67713555dbb677bb605fe693a32

            SHA1

            08cf44ba4fea16721500ed84830bde1fc46ea55b

            SHA256

            846f1e847e095e78a0214fc8d23edfc0cdf3284bd6d6d8a3f8b612a684a962c9

            SHA512

            86be53d55ab0e0f5cc6be9213de8c47dd6e94be800fed6163d000b8aa51d37a74fdee515ce2f3b39fb93991670ba04b6f1324e9333b6341cdb439fb13b72564f

          • C:\Users\Admin\AppData\Local\Temp\oxgfjaplcxnyuvqnibwawxqu

            Filesize

            2B

            MD5

            f3b25701fe362ec84616a93a45ce9998

            SHA1

            d62636d8caec13f04e28442a0a6fa1afeb024bbb

            SHA256

            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

            SHA512

            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

          • C:\Users\Admin\AppData\Local\Temp\tmpE531.tmp

            Filesize

            1KB

            MD5

            ebc446fa5693d0b35a95f0d09b80ba56

            SHA1

            f9be5a6923d8b7c06b980e3f4698e47bfcdb8666

            SHA256

            044f4c4e69a8b78ed2b5b6ecb1e24a52db7b7d2497dc2a72a6da936320deaedc

            SHA512

            45b186dcecd4e070ff93c6cb858e206235d781dd14ba2717b1637bdc4bfd3ba5d451fcee45f91d839ba260594263ee5630db24f6cae01aa75d894f618bdb19b6

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\W5ME3COSHH4ZEYAYFOWF.temp

            Filesize

            7KB

            MD5

            055f8649a15526c58e3078494ac60f8a

            SHA1

            2046a7d5d0e3dac526a44b955e85640fa2d73058

            SHA256

            5cc21754d2eeb3eb5bb614e4b7bbd4056574449bd52b2b52d1b8a682a366e7d7

            SHA512

            33261695d1f6b6c9d8fdde4089117943eb76e6428570301fbf7f4eaf6b7658d193a24d55bd001e64c799f60337c1a3efa243a85a0f79879e476b031e746b0e99

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

            Filesize

            7KB

            MD5

            055f8649a15526c58e3078494ac60f8a

            SHA1

            2046a7d5d0e3dac526a44b955e85640fa2d73058

            SHA256

            5cc21754d2eeb3eb5bb614e4b7bbd4056574449bd52b2b52d1b8a682a366e7d7

            SHA512

            33261695d1f6b6c9d8fdde4089117943eb76e6428570301fbf7f4eaf6b7658d193a24d55bd001e64c799f60337c1a3efa243a85a0f79879e476b031e746b0e99

          • memory/1080-58-0x0000000000400000-0x0000000000478000-memory.dmp

            Filesize

            480KB

          • memory/1080-62-0x0000000000400000-0x0000000000478000-memory.dmp

            Filesize

            480KB

          • memory/1080-65-0x0000000000400000-0x0000000000478000-memory.dmp

            Filesize

            480KB

          • memory/1080-83-0x0000000000400000-0x0000000000478000-memory.dmp

            Filesize

            480KB

          • memory/1644-74-0x0000000000400000-0x0000000000457000-memory.dmp

            Filesize

            348KB

          • memory/1644-70-0x0000000000400000-0x0000000000457000-memory.dmp

            Filesize

            348KB

          • memory/1644-92-0x0000000000400000-0x0000000000457000-memory.dmp

            Filesize

            348KB

          • memory/1644-59-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/1644-72-0x0000000000400000-0x0000000000457000-memory.dmp

            Filesize

            348KB

          • memory/1644-63-0x0000000000400000-0x0000000000457000-memory.dmp

            Filesize

            348KB

          • memory/1724-73-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/1724-75-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/1724-69-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/1724-76-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/1724-77-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/2116-4-0x00000000003E0000-0x00000000003E8000-memory.dmp

            Filesize

            32KB

          • memory/2116-6-0x0000000005100000-0x00000000051B8000-memory.dmp

            Filesize

            736KB

          • memory/2116-1-0x0000000074520000-0x0000000074C0E000-memory.dmp

            Filesize

            6.9MB

          • memory/2116-32-0x0000000074520000-0x0000000074C0E000-memory.dmp

            Filesize

            6.9MB

          • memory/2116-2-0x0000000000450000-0x0000000000490000-memory.dmp

            Filesize

            256KB

          • memory/2116-3-0x0000000000490000-0x00000000004A8000-memory.dmp

            Filesize

            96KB

          • memory/2116-5-0x0000000000440000-0x000000000044A000-memory.dmp

            Filesize

            40KB

          • memory/2116-0-0x0000000000E30000-0x0000000000F40000-memory.dmp

            Filesize

            1.1MB

          • memory/2556-40-0x00000000025A0000-0x00000000025E0000-memory.dmp

            Filesize

            256KB

          • memory/2556-55-0x000000006F270000-0x000000006F81B000-memory.dmp

            Filesize

            5.7MB

          • memory/2556-42-0x000000006F270000-0x000000006F81B000-memory.dmp

            Filesize

            5.7MB

          • memory/2556-46-0x00000000025A0000-0x00000000025E0000-memory.dmp

            Filesize

            256KB

          • memory/2556-38-0x000000006F270000-0x000000006F81B000-memory.dmp

            Filesize

            5.7MB

          • memory/2556-44-0x00000000025A0000-0x00000000025E0000-memory.dmp

            Filesize

            256KB

          • memory/2740-41-0x000000006F270000-0x000000006F81B000-memory.dmp

            Filesize

            5.7MB

          • memory/2740-49-0x0000000002630000-0x0000000002670000-memory.dmp

            Filesize

            256KB

          • memory/2740-48-0x0000000002630000-0x0000000002670000-memory.dmp

            Filesize

            256KB

          • memory/2740-43-0x0000000002630000-0x0000000002670000-memory.dmp

            Filesize

            256KB

          • memory/2740-39-0x000000006F270000-0x000000006F81B000-memory.dmp

            Filesize

            5.7MB

          • memory/2740-54-0x000000006F270000-0x000000006F81B000-memory.dmp

            Filesize

            5.7MB

          • memory/2772-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/2772-53-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-50-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-51-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-47-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-45-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-37-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-36-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-35-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-33-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-24-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-25-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-31-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-29-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-26-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-23-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-22-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-21-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-85-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-86-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-91-0x0000000010000000-0x0000000010019000-memory.dmp

            Filesize

            100KB

          • memory/2772-95-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-94-0x0000000010000000-0x0000000010019000-memory.dmp

            Filesize

            100KB

          • memory/2772-93-0x0000000010000000-0x0000000010019000-memory.dmp

            Filesize

            100KB

          • memory/2772-20-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-90-0x0000000010000000-0x0000000010019000-memory.dmp

            Filesize

            100KB

          • memory/2772-87-0x0000000010000000-0x0000000010019000-memory.dmp

            Filesize

            100KB

          • memory/2772-98-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-19-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-102-0x0000000010000000-0x0000000010019000-memory.dmp

            Filesize

            100KB

          • memory/2772-104-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-105-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-112-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-113-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-120-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-121-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-128-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/2772-129-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB