Analysis

  • max time kernel
    149s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2023, 12:17

General

  • Target

    3.exe

  • Size

    973KB

  • MD5

    e2473c2832fb852d2aa8785e90b285a0

  • SHA1

    663f5fd69dfd51e8608ea5e2231319923db26b1d

  • SHA256

    b67319d5978b2236bb8a735b1838b18b6432cb835fce1b9b08ff2d68e012bc50

  • SHA512

    4368f1289746e425eec96762e05894f524ef43424db92d66730c2eb8bfadffecb9126588da97a21f28273babba53bb94396a72e0a0abcf391c512adf8ae1efba

  • SSDEEP

    24576:i9PtD/fmh3G6dGSCjFqHvwy8zfGIvtooo:UBt2GtFqPwGjr

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

107.175.229.139:8087

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-IZFV1M

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3.exe
    "C:\Users\Admin\AppData\Local\Temp\3.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1708
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2564
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LCofJSC.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2620
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LCofJSC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4F39.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2720
    • C:\Users\Admin\AppData\Local\Temp\3.exe
      "C:\Users\Admin\AppData\Local\Temp\3.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:2660

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\remcos\logs.dat

          Filesize

          144B

          MD5

          711533f369c55d232c56cfc39ab96006

          SHA1

          ce0b4deaaccc265bdf7b6cf4c89c79ab0618230a

          SHA256

          b9c9cebe3551ea10d4b2107da42d55f440e9171c7c0ebcc454a23b36472be265

          SHA512

          d07a081aa5a87576bbeacfc2efca6f6c4619156bae41630274296f495ea81e494a1b661064a36d284f7abebaf5455eaeff4b3528f3e22a4586e8c246cb4dc226

        • C:\Users\Admin\AppData\Local\Temp\tmp4F39.tmp

          Filesize

          1KB

          MD5

          5b48b0b0f01ecb8dcd92d8e68465b196

          SHA1

          d857b8a82e28eb35970f359afaf3cccb324c3980

          SHA256

          3617210e8d0a86467eb43827e4373412172122222379cbf5f757c7da7f98968f

          SHA512

          f8c866b91a0c593e3296e524654825cfccaed7fa21fef7db30e64c8bde27a1c4b0e1eaa7bbc690cc1cdd62e41899124e4bca9173ebb818045ca5221587fc933c

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\N9Q6K0MVULHOIWR6CF6V.temp

          Filesize

          7KB

          MD5

          a68c436f848bd71d9c0cd7523277bd9d

          SHA1

          f74105da7df46c8127627e826574985d63d83968

          SHA256

          10b3c4be2f57d12d4d0dd24c022fde6d48230e3e7e195b415850084ce49084ad

          SHA512

          714b91daaca456fd68931f6c491e4a30c6397b642b6d8df3434f78eace6014bf49ce68edc96f79e23c5017aedf55cc9023f39a2178598da82440d0bc9a6e2b06

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

          Filesize

          7KB

          MD5

          a68c436f848bd71d9c0cd7523277bd9d

          SHA1

          f74105da7df46c8127627e826574985d63d83968

          SHA256

          10b3c4be2f57d12d4d0dd24c022fde6d48230e3e7e195b415850084ce49084ad

          SHA512

          714b91daaca456fd68931f6c491e4a30c6397b642b6d8df3434f78eace6014bf49ce68edc96f79e23c5017aedf55cc9023f39a2178598da82440d0bc9a6e2b06

        • memory/1708-5-0x0000000000460000-0x000000000046A000-memory.dmp

          Filesize

          40KB

        • memory/1708-32-0x0000000074090000-0x000000007477E000-memory.dmp

          Filesize

          6.9MB

        • memory/1708-6-0x0000000005D60000-0x0000000005E18000-memory.dmp

          Filesize

          736KB

        • memory/1708-4-0x0000000000450000-0x0000000000458000-memory.dmp

          Filesize

          32KB

        • memory/1708-3-0x0000000000430000-0x0000000000448000-memory.dmp

          Filesize

          96KB

        • memory/1708-2-0x0000000004B20000-0x0000000004B60000-memory.dmp

          Filesize

          256KB

        • memory/1708-0-0x0000000000A30000-0x0000000000B2A000-memory.dmp

          Filesize

          1000KB

        • memory/1708-1-0x0000000074090000-0x000000007477E000-memory.dmp

          Filesize

          6.9MB

        • memory/2564-42-0x0000000002D30000-0x0000000002D70000-memory.dmp

          Filesize

          256KB

        • memory/2564-45-0x0000000002D30000-0x0000000002D70000-memory.dmp

          Filesize

          256KB

        • memory/2564-44-0x000000006E1D0000-0x000000006E77B000-memory.dmp

          Filesize

          5.7MB

        • memory/2564-38-0x000000006E1D0000-0x000000006E77B000-memory.dmp

          Filesize

          5.7MB

        • memory/2564-47-0x000000006E1D0000-0x000000006E77B000-memory.dmp

          Filesize

          5.7MB

        • memory/2620-46-0x0000000002A10000-0x0000000002A50000-memory.dmp

          Filesize

          256KB

        • memory/2620-43-0x000000006E1D0000-0x000000006E77B000-memory.dmp

          Filesize

          5.7MB

        • memory/2620-36-0x000000006E1D0000-0x000000006E77B000-memory.dmp

          Filesize

          5.7MB

        • memory/2620-40-0x0000000002A10000-0x0000000002A50000-memory.dmp

          Filesize

          256KB

        • memory/2620-48-0x000000006E1D0000-0x000000006E77B000-memory.dmp

          Filesize

          5.7MB

        • memory/2660-37-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2660-20-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2660-33-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2660-30-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2660-39-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2660-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2660-41-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2660-27-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2660-26-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2660-25-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2660-24-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2660-22-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2660-21-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2660-34-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2660-53-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2660-54-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2660-19-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2660-59-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2660-60-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2660-66-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2660-67-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2660-72-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2660-73-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2660-78-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2660-80-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2660-85-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB