Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-1703_x64
  • resource
    win10-20231129-en
  • resource tags

    arch:x64arch:x86image:win10-20231129-enlocale:en-usos:windows10-1703-x64system
  • submitted
    05/12/2023, 21:13

General

  • Target

    $R2VGET4.exe

  • Size

    1.1MB

  • MD5

    aec9174c8479a575306048bb92f94829

  • SHA1

    049eaa475e61cbe1e38c007507bd64d30fbe82b9

  • SHA256

    79015a0c68260b6317ecfea1983091e74c98dd8ced80766e1515df93534a3f6d

  • SHA512

    08bdd9bb7200ba25cb2939d3d845ddfc4a8de1cdbe0848888bd33861b0c26b599d29173bf507ca4118a5b1c166e775d53caafe9934cd5da5343382e92b76ac1d

  • SSDEEP

    24576:ogeik1YB0bJMqpiXP4kRRb2X/yVqRNNbmfz89qLs4v7WkiHa/Gx8yo7Y:ogeikqBsJM1QuRsq4R4v7Wki6/GxA

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

167.114.189.33:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-7ZDF66

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$R2VGET4.exe
    "C:\Users\Admin\AppData\Local\Temp\$R2VGET4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:196
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\$R2VGET4.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3224
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eSFNAbyW.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:652
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eSFNAbyW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6339.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2824
    • C:\Users\Admin\AppData\Local\Temp\$R2VGET4.exe
      "C:\Users\Admin\AppData\Local\Temp\$R2VGET4.exe"
      2⤵
        PID:1144
      • C:\Users\Admin\AppData\Local\Temp\$R2VGET4.exe
        "C:\Users\Admin\AppData\Local\Temp\$R2VGET4.exe"
        2⤵
        • Suspicious use of SetWindowsHookEx
        PID:1264

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\remcos\logs.dat

            Filesize

            144B

            MD5

            f46438ff20cf4b7b7067194df35037d6

            SHA1

            f4c9e481ed2fed4e0becd3c5fb70e9ce7556c459

            SHA256

            f50f82180042af4e8a931751f988578a24e550d4fe34d3dcfe23b583d9b1f8c7

            SHA512

            d048c05d839ef97c4882764c23cb8f1cebcc04837f17f490d27f08d6153a0b231a48676530d87344342068712c4abf1362fad28deeb91fd2e0120818990e452e

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

            Filesize

            2KB

            MD5

            1c19c16e21c97ed42d5beabc93391fc5

            SHA1

            8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

            SHA256

            1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

            SHA512

            7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            18KB

            MD5

            df451255fce463c7ee51a4d9f2857981

            SHA1

            64b4818a075bbf6a73e4d7bf0a9922ef679b34ac

            SHA256

            49cef38572434054ded7a62e3865c3e5ee3be733d9a32f45f9b824ace88d063f

            SHA512

            5dca1a89a6d808e9b2831364cc11404739b50bd613ac1af7b62edc94215057e59217d18ba00e828574e20ba7fdfe4c67cf7fcd90b63a35fa91d3add4b612c004

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lriel1by.elh.ps1

            Filesize

            1B

            MD5

            c4ca4238a0b923820dcc509a6f75849b

            SHA1

            356a192b7913b04c54574d18c28d46e6395428ab

            SHA256

            6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

            SHA512

            4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

          • C:\Users\Admin\AppData\Local\Temp\tmp6339.tmp

            Filesize

            1KB

            MD5

            526a81461df0cca7dd58846010b10a42

            SHA1

            fcda2d075f755bca872b16e827e7fb7ee88ce020

            SHA256

            5e678975f1cb8683b62895f68460fe0615035d0492a1598c2a1c73f02ad611df

            SHA512

            fed356cbedc3de69549109cafd1104b5d50c31b04671838f75ec7aa1f24966bdf7df3832a38d6f5ec067393772a6f36938c1e8ea471a7578b4d17792ad3de618

          • memory/196-4-0x00000000050B0000-0x00000000050C0000-memory.dmp

            Filesize

            64KB

          • memory/196-6-0x00000000050C0000-0x000000000515C000-memory.dmp

            Filesize

            624KB

          • memory/196-7-0x0000000005290000-0x00000000052A6000-memory.dmp

            Filesize

            88KB

          • memory/196-8-0x00000000732D0000-0x00000000739BE000-memory.dmp

            Filesize

            6.9MB

          • memory/196-9-0x00000000050B0000-0x00000000050C0000-memory.dmp

            Filesize

            64KB

          • memory/196-10-0x00000000059A0000-0x00000000059AE000-memory.dmp

            Filesize

            56KB

          • memory/196-11-0x00000000067B0000-0x0000000006884000-memory.dmp

            Filesize

            848KB

          • memory/196-5-0x0000000004FF0000-0x0000000004FFA000-memory.dmp

            Filesize

            40KB

          • memory/196-3-0x0000000004E90000-0x0000000004F22000-memory.dmp

            Filesize

            584KB

          • memory/196-2-0x00000000052F0000-0x00000000057EE000-memory.dmp

            Filesize

            5.0MB

          • memory/196-0-0x0000000000500000-0x0000000000628000-memory.dmp

            Filesize

            1.2MB

          • memory/196-38-0x00000000732D0000-0x00000000739BE000-memory.dmp

            Filesize

            6.9MB

          • memory/196-1-0x00000000732D0000-0x00000000739BE000-memory.dmp

            Filesize

            6.9MB

          • memory/652-33-0x0000000007590000-0x00000000078E0000-memory.dmp

            Filesize

            3.3MB

          • memory/652-43-0x0000000006900000-0x000000000691C000-memory.dmp

            Filesize

            112KB

          • memory/652-26-0x0000000006920000-0x0000000006930000-memory.dmp

            Filesize

            64KB

          • memory/652-29-0x0000000002DD0000-0x0000000002DF2000-memory.dmp

            Filesize

            136KB

          • memory/652-482-0x0000000006A80000-0x0000000006A9A000-memory.dmp

            Filesize

            104KB

          • memory/652-95-0x0000000006920000-0x0000000006930000-memory.dmp

            Filesize

            64KB

          • memory/652-25-0x00000000732D0000-0x00000000739BE000-memory.dmp

            Filesize

            6.9MB

          • memory/652-523-0x00000000732D0000-0x00000000739BE000-memory.dmp

            Filesize

            6.9MB

          • memory/652-27-0x0000000006920000-0x0000000006930000-memory.dmp

            Filesize

            64KB

          • memory/652-84-0x000000007F170000-0x000000007F180000-memory.dmp

            Filesize

            64KB

          • memory/652-83-0x0000000073A50000-0x0000000073A9B000-memory.dmp

            Filesize

            300KB

          • memory/652-79-0x0000000008A50000-0x0000000008A83000-memory.dmp

            Filesize

            204KB

          • memory/652-46-0x0000000007B60000-0x0000000007BD6000-memory.dmp

            Filesize

            472KB

          • memory/652-45-0x0000000006D40000-0x0000000006D8B000-memory.dmp

            Filesize

            300KB

          • memory/1264-35-0x0000000000400000-0x0000000000481000-memory.dmp

            Filesize

            516KB

          • memory/1264-39-0x0000000000400000-0x0000000000481000-memory.dmp

            Filesize

            516KB

          • memory/1264-42-0x0000000000400000-0x0000000000481000-memory.dmp

            Filesize

            516KB

          • memory/1264-41-0x0000000000400000-0x0000000000481000-memory.dmp

            Filesize

            516KB

          • memory/1264-540-0x0000000000400000-0x0000000000481000-memory.dmp

            Filesize

            516KB

          • memory/1264-545-0x0000000000400000-0x0000000000481000-memory.dmp

            Filesize

            516KB

          • memory/1264-529-0x0000000000400000-0x0000000000481000-memory.dmp

            Filesize

            516KB

          • memory/1264-44-0x0000000000400000-0x0000000000481000-memory.dmp

            Filesize

            516KB

          • memory/1264-539-0x0000000000400000-0x0000000000481000-memory.dmp

            Filesize

            516KB

          • memory/1264-32-0x0000000000400000-0x0000000000481000-memory.dmp

            Filesize

            516KB

          • memory/1264-526-0x0000000000400000-0x0000000000481000-memory.dmp

            Filesize

            516KB

          • memory/1264-525-0x0000000000400000-0x0000000000481000-memory.dmp

            Filesize

            516KB

          • memory/1264-34-0x0000000000400000-0x0000000000481000-memory.dmp

            Filesize

            516KB

          • memory/1264-547-0x0000000000400000-0x0000000000481000-memory.dmp

            Filesize

            516KB

          • memory/1264-533-0x0000000000400000-0x0000000000481000-memory.dmp

            Filesize

            516KB

          • memory/1264-534-0x0000000000400000-0x0000000000481000-memory.dmp

            Filesize

            516KB

          • memory/3224-21-0x0000000006E40000-0x0000000006E50000-memory.dmp

            Filesize

            64KB

          • memory/3224-491-0x0000000007010000-0x0000000007018000-memory.dmp

            Filesize

            32KB

          • memory/3224-96-0x00000000098A0000-0x0000000009934000-memory.dmp

            Filesize

            592KB

          • memory/3224-94-0x0000000006E40000-0x0000000006E50000-memory.dmp

            Filesize

            64KB

          • memory/3224-524-0x00000000732D0000-0x00000000739BE000-memory.dmp

            Filesize

            6.9MB

          • memory/3224-93-0x00000000093C0000-0x0000000009465000-memory.dmp

            Filesize

            660KB

          • memory/3224-82-0x0000000009360000-0x000000000937E000-memory.dmp

            Filesize

            120KB

          • memory/3224-80-0x0000000073A50000-0x0000000073A9B000-memory.dmp

            Filesize

            300KB

          • memory/3224-81-0x000000007ED60000-0x000000007ED70000-memory.dmp

            Filesize

            64KB

          • memory/3224-31-0x0000000007B20000-0x0000000007B86000-memory.dmp

            Filesize

            408KB

          • memory/3224-30-0x0000000007B90000-0x0000000007BF6000-memory.dmp

            Filesize

            408KB

          • memory/3224-23-0x0000000007480000-0x0000000007AA8000-memory.dmp

            Filesize

            6.2MB

          • memory/3224-20-0x0000000006E40000-0x0000000006E50000-memory.dmp

            Filesize

            64KB

          • memory/3224-19-0x0000000004980000-0x00000000049B6000-memory.dmp

            Filesize

            216KB

          • memory/3224-18-0x00000000732D0000-0x00000000739BE000-memory.dmp

            Filesize

            6.9MB