Analysis

  • max time kernel
    17s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2023, 16:55

General

  • Target

    FADTQWERT.exe

  • Size

    1.0MB

  • MD5

    c200bdcd9c827ad9c878f61a6e80b2ee

  • SHA1

    730d6b83b8af8d7b6740020d0e44466c2192f6ee

  • SHA256

    fc4fb593fdecc5e6c82c0c98decab2ccd213153078489787712a082c299d20cd

  • SHA512

    a5dd81fe25aa643c94f5e098e17fc2ce9a929141ea3a470245986e3e5fb8d9da8c014f6649a70816f8d1338b043a09caea69193f627f8c1bf351becb8d76de43

  • SSDEEP

    24576:KgCKtD/61Idz9KOXdI0YBt68T1U3FMztS5aV3+2rN87:X6Kzj+0YBt68+3FMKaO2h87

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

107.175.229.139:8087

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-IZFV1M

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FADTQWERT.exe
    "C:\Users\Admin\AppData\Local\Temp\FADTQWERT.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4368
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GwdCcjuxCiQA.exe"
      2⤵
        PID:4532
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\FADTQWERT.exe"
        2⤵
          PID:2324
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GwdCcjuxCiQA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8944.tmp"
          2⤵
          • Creates scheduled task(s)
          PID:3748
        • C:\Users\Admin\AppData\Local\Temp\FADTQWERT.exe
          "C:\Users\Admin\AppData\Local\Temp\FADTQWERT.exe"
          2⤵
            PID:4008
          • C:\Users\Admin\AppData\Local\Temp\FADTQWERT.exe
            "C:\Users\Admin\AppData\Local\Temp\FADTQWERT.exe"
            2⤵
              PID:4892

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\ProgramData\remcos\logs.dat

                  Filesize

                  144B

                  MD5

                  40d326cdc38e906f1b80663e44d5b3a5

                  SHA1

                  f7cebaa62119486c91b75bd17a7e67dbd83ed590

                  SHA256

                  50cdf89c127016081a57a896fc41e5644d48943d8c65d3530d9960ac815cad94

                  SHA512

                  d30e9613137785dae96fc2959ce2bfbf2f3477b4b1d485bbc38a147053f2ee9034b163e8e053e30fba9601cfb906a2299272293b0264cb392a3203b492ed530c

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                  Filesize

                  2KB

                  MD5

                  3d086a433708053f9bf9523e1d87a4e8

                  SHA1

                  b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

                  SHA256

                  6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

                  SHA512

                  931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  18KB

                  MD5

                  9baaf8bce3f00dbc0bf93e0f0253d425

                  SHA1

                  f424f1aa4135434a32845cd533420ef5f3b488be

                  SHA256

                  49eb0c2f3cf3198c1f8f6db0481cefecb98818eafe77e50e4dbd60706abb52b0

                  SHA512

                  2939ace6cc1f64d03dec009af5e25c2378a9ef9957fc318ceead74ee7d5d32d90391f6c0a592028159c37fb613b4e49a615de4e58243c51128b7c19e5ddbd27b

                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rb4p1ygb.gm5.ps1

                  Filesize

                  60B

                  MD5

                  d17fe0a3f47be24a6453e9ef58c94641

                  SHA1

                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                  SHA256

                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                  SHA512

                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                • C:\Users\Admin\AppData\Local\Temp\tmp8944.tmp

                  Filesize

                  1KB

                  MD5

                  70b84ba6c6e4a44cb6bcd3e049f2fe12

                  SHA1

                  41dc7463a577907db270e80dcfd14c00a3143819

                  SHA256

                  7a2916571e6806101da8bb72083c6202d4463d788ee42711752fafc625d1b68e

                  SHA512

                  152f6f085661199ffe6a1e7353d07e047597b877d9a9948496cdb3a9bd3b12eb4e51983fe796cbe6ecd548c967b9cf6c3e977762ec3bfe3f0ad756ababea0f17

                • memory/2324-102-0x0000000074DE0000-0x0000000075590000-memory.dmp

                  Filesize

                  7.7MB

                • memory/2324-26-0x0000000005B80000-0x0000000005BE6000-memory.dmp

                  Filesize

                  408KB

                • memory/2324-92-0x0000000007780000-0x000000000778E000-memory.dmp

                  Filesize

                  56KB

                • memory/2324-90-0x00000000077D0000-0x0000000007866000-memory.dmp

                  Filesize

                  600KB

                • memory/2324-89-0x00000000075C0000-0x00000000075CA000-memory.dmp

                  Filesize

                  40KB

                • memory/2324-88-0x0000000007B90000-0x000000000820A000-memory.dmp

                  Filesize

                  6.5MB

                • memory/2324-15-0x0000000002930000-0x0000000002966000-memory.dmp

                  Filesize

                  216KB

                • memory/2324-18-0x0000000004F10000-0x0000000004F20000-memory.dmp

                  Filesize

                  64KB

                • memory/2324-16-0x0000000005550000-0x0000000005B78000-memory.dmp

                  Filesize

                  6.2MB

                • memory/2324-61-0x00000000067F0000-0x0000000006822000-memory.dmp

                  Filesize

                  200KB

                • memory/2324-74-0x0000000073890000-0x00000000738DC000-memory.dmp

                  Filesize

                  304KB

                • memory/2324-22-0x0000000005260000-0x0000000005282000-memory.dmp

                  Filesize

                  136KB

                • memory/2324-86-0x0000000004F10000-0x0000000004F20000-memory.dmp

                  Filesize

                  64KB

                • memory/2324-63-0x000000007F7D0000-0x000000007F7E0000-memory.dmp

                  Filesize

                  64KB

                • memory/2324-48-0x0000000005D60000-0x00000000060B4000-memory.dmp

                  Filesize

                  3.3MB

                • memory/2324-33-0x0000000005BF0000-0x0000000005C56000-memory.dmp

                  Filesize

                  408KB

                • memory/2324-59-0x00000000065C0000-0x000000000660C000-memory.dmp

                  Filesize

                  304KB

                • memory/2324-17-0x0000000074DE0000-0x0000000075590000-memory.dmp

                  Filesize

                  7.7MB

                • memory/2324-20-0x0000000004F10000-0x0000000004F20000-memory.dmp

                  Filesize

                  64KB

                • memory/4368-0-0x0000000000C90000-0x0000000000D9E000-memory.dmp

                  Filesize

                  1.1MB

                • memory/4368-5-0x0000000005790000-0x000000000579A000-memory.dmp

                  Filesize

                  40KB

                • memory/4368-1-0x0000000074DE0000-0x0000000075590000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4368-2-0x0000000005CB0000-0x0000000006254000-memory.dmp

                  Filesize

                  5.6MB

                • memory/4368-3-0x00000000057A0000-0x0000000005832000-memory.dmp

                  Filesize

                  584KB

                • memory/4368-8-0x0000000005A40000-0x0000000005A4A000-memory.dmp

                  Filesize

                  40KB

                • memory/4368-7-0x0000000005A20000-0x0000000005A28000-memory.dmp

                  Filesize

                  32KB

                • memory/4368-10-0x0000000006F10000-0x0000000006FAC000-memory.dmp

                  Filesize

                  624KB

                • memory/4368-53-0x0000000074DE0000-0x0000000075590000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4368-4-0x0000000005970000-0x0000000005980000-memory.dmp

                  Filesize

                  64KB

                • memory/4368-9-0x00000000071F0000-0x00000000072A8000-memory.dmp

                  Filesize

                  736KB

                • memory/4368-19-0x0000000074DE0000-0x0000000075590000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4368-25-0x0000000005970000-0x0000000005980000-memory.dmp

                  Filesize

                  64KB

                • memory/4368-6-0x00000000059F0000-0x0000000005A08000-memory.dmp

                  Filesize

                  96KB

                • memory/4532-87-0x00000000074B0000-0x00000000074CA000-memory.dmp

                  Filesize

                  104KB

                • memory/4532-62-0x0000000073890000-0x00000000738DC000-memory.dmp

                  Filesize

                  304KB

                • memory/4532-101-0x0000000074DE0000-0x0000000075590000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4532-24-0x0000000074DE0000-0x0000000075590000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4532-77-0x0000000007180000-0x0000000007223000-memory.dmp

                  Filesize

                  652KB

                • memory/4532-21-0x00000000029E0000-0x00000000029F0000-memory.dmp

                  Filesize

                  64KB

                • memory/4532-73-0x00000000066C0000-0x00000000066DE000-memory.dmp

                  Filesize

                  120KB

                • memory/4532-60-0x000000007F6F0000-0x000000007F700000-memory.dmp

                  Filesize

                  64KB

                • memory/4532-75-0x00000000029E0000-0x00000000029F0000-memory.dmp

                  Filesize

                  64KB

                • memory/4532-58-0x0000000006050000-0x000000000606E000-memory.dmp

                  Filesize

                  120KB

                • memory/4532-95-0x00000000077D0000-0x00000000077D8000-memory.dmp

                  Filesize

                  32KB

                • memory/4532-94-0x00000000077F0000-0x000000000780A000-memory.dmp

                  Filesize

                  104KB

                • memory/4532-91-0x00000000076B0000-0x00000000076C1000-memory.dmp

                  Filesize

                  68KB

                • memory/4532-93-0x00000000076F0000-0x0000000007704000-memory.dmp

                  Filesize

                  80KB

                • memory/4892-56-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/4892-51-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/4892-50-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/4892-52-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/4892-47-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/4892-57-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/4892-55-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/4892-106-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/4892-109-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/4892-108-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/4892-115-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/4892-114-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/4892-46-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/4892-121-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/4892-122-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/4892-127-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/4892-128-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/4892-133-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/4892-134-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/4892-140-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB