Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2023, 21:14

General

  • Target

    $R4S8Q5B.exe

  • Size

    911KB

  • MD5

    5313272fd87d44ac3b60e976db857d49

  • SHA1

    dbc5bdfa1b78d34fb4b3d3b9074ba449c7f29074

  • SHA256

    9103e2815438759a349705607f3be586c2129551e74cd2a875a04faab7ac43a9

  • SHA512

    271cfe471b50f340d36cb8b23be621883939a9ca85b1eb814bda8d65120eceaea139e159b32d2acf009e58e5df9aa709cebf0ffe0f638c14a577261c12ed3145

  • SSDEEP

    24576:ZzDp2LTL98NShdlTJzZWHyKmgev5/uWO/X4f:Fp2LSNEzTJgrmnUWku

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

167.114.189.33:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-7ZDF66

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$R4S8Q5B.exe
    "C:\Users\Admin\AppData\Local\Temp\$R4S8Q5B.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5116
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\$R4S8Q5B.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1340
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bIURQhWY.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3116
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bIURQhWY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp97C.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1116
    • C:\Users\Admin\AppData\Local\Temp\$R4S8Q5B.exe
      "C:\Users\Admin\AppData\Local\Temp\$R4S8Q5B.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:4340

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\remcos\logs.dat

          Filesize

          144B

          MD5

          8d4c21d83f55b113758dcebf96ff26ee

          SHA1

          96dbddb6d6ff72862517b174f5c087870d0ec054

          SHA256

          6fdf5428a7683f80993d346da723ed64fb8fcdf2ba47bb2f4f1819eb2bf1518e

          SHA512

          297ac171d063c27d459d29ff108cb0cc86a830243a4c1ce5816ee6abed6e0ea3ebb0802572ac517cfe7274491cbb1a4ff62a02e55a16c7faafb7119704c2c6ab

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          968cb9309758126772781b83adb8a28f

          SHA1

          8da30e71accf186b2ba11da1797cf67f8f78b47c

          SHA256

          92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

          SHA512

          4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          18KB

          MD5

          f031bf37ccb3723433ed6afb4a256777

          SHA1

          80c7ea0375aa5145e16857a46b62b8ba967bd32c

          SHA256

          9218f9b599264ab66aed9790f160f6e6bf7e0a58230116e145dea161b19b792a

          SHA512

          dbbf11859faa5399b75979204c08602587c819eabea5a18c6f4b23d04c96006ce2241529c6cf1ab312dfa043152b8a964b43c1fcc454690432812ec47cc7f870

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1cpc0jpp.qks.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\tmp97C.tmp

          Filesize

          1KB

          MD5

          b3b7c03e9c0174e18c53b7d3299a0f69

          SHA1

          e47c9453b6547773b7d71a37743e91cd7a44adb8

          SHA256

          e0b90f4eea58d7df788b7e2d0bf8f9843e13c0309282148be076ce27adb82367

          SHA512

          24c7dac772f7d12fef97e7306a70ecb32a624296566276d34f87725937fd021564b488944c49c643611fa2b9e51a6b3b10033c6cc06765dd63404deebd6924d1

        • memory/1340-92-0x0000000006FC0000-0x0000000006FCE000-memory.dmp

          Filesize

          56KB

        • memory/1340-31-0x0000000005420000-0x0000000005486000-memory.dmp

          Filesize

          408KB

        • memory/1340-103-0x0000000074470000-0x0000000074C20000-memory.dmp

          Filesize

          7.7MB

        • memory/1340-96-0x0000000074470000-0x0000000074C20000-memory.dmp

          Filesize

          7.7MB

        • memory/1340-90-0x0000000007000000-0x0000000007096000-memory.dmp

          Filesize

          600KB

        • memory/1340-89-0x0000000006DE0000-0x0000000006DEA000-memory.dmp

          Filesize

          40KB

        • memory/1340-87-0x0000000006DA0000-0x0000000006DBA000-memory.dmp

          Filesize

          104KB

        • memory/1340-74-0x0000000072F10000-0x0000000072F5C000-memory.dmp

          Filesize

          304KB

        • memory/1340-17-0x0000000074470000-0x0000000074C20000-memory.dmp

          Filesize

          7.7MB

        • memory/1340-18-0x00000000023A0000-0x00000000023B0000-memory.dmp

          Filesize

          64KB

        • memory/1340-19-0x00000000023A0000-0x00000000023B0000-memory.dmp

          Filesize

          64KB

        • memory/1340-16-0x0000000002120000-0x0000000002156000-memory.dmp

          Filesize

          216KB

        • memory/1340-21-0x0000000004D80000-0x00000000053A8000-memory.dmp

          Filesize

          6.2MB

        • memory/1340-60-0x00000000023A0000-0x00000000023B0000-memory.dmp

          Filesize

          64KB

        • memory/1340-62-0x000000007F0D0000-0x000000007F0E0000-memory.dmp

          Filesize

          64KB

        • memory/1340-58-0x00000000047F0000-0x000000000480E000-memory.dmp

          Filesize

          120KB

        • memory/1340-63-0x0000000006A30000-0x0000000006A62000-memory.dmp

          Filesize

          200KB

        • memory/1340-47-0x0000000005490000-0x00000000057E4000-memory.dmp

          Filesize

          3.3MB

        • memory/1340-26-0x0000000004970000-0x0000000004992000-memory.dmp

          Filesize

          136KB

        • memory/3116-94-0x0000000007860000-0x000000000787A000-memory.dmp

          Filesize

          104KB

        • memory/3116-23-0x0000000004D50000-0x0000000004D60000-memory.dmp

          Filesize

          64KB

        • memory/3116-59-0x0000000006250000-0x000000000629C000-memory.dmp

          Filesize

          304KB

        • memory/3116-93-0x0000000007760000-0x0000000007774000-memory.dmp

          Filesize

          80KB

        • memory/3116-102-0x0000000074470000-0x0000000074C20000-memory.dmp

          Filesize

          7.7MB

        • memory/3116-91-0x0000000007720000-0x0000000007731000-memory.dmp

          Filesize

          68KB

        • memory/3116-29-0x00000000052F0000-0x0000000005356000-memory.dmp

          Filesize

          408KB

        • memory/3116-95-0x0000000007840000-0x0000000007848000-memory.dmp

          Filesize

          32KB

        • memory/3116-86-0x0000000007B70000-0x00000000081EA000-memory.dmp

          Filesize

          6.5MB

        • memory/3116-85-0x0000000007430000-0x00000000074D3000-memory.dmp

          Filesize

          652KB

        • memory/3116-61-0x000000007F890000-0x000000007F8A0000-memory.dmp

          Filesize

          64KB

        • memory/3116-75-0x00000000067D0000-0x00000000067EE000-memory.dmp

          Filesize

          120KB

        • memory/3116-22-0x0000000074470000-0x0000000074C20000-memory.dmp

          Filesize

          7.7MB

        • memory/3116-64-0x0000000072F10000-0x0000000072F5C000-memory.dmp

          Filesize

          304KB

        • memory/4340-48-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/4340-56-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/4340-25-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/4340-115-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/4340-109-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/4340-57-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/4340-44-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/4340-114-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/4340-108-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/4340-107-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/4340-27-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/4340-121-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/4340-122-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/4340-30-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/5116-11-0x0000000009600000-0x00000000096B8000-memory.dmp

          Filesize

          736KB

        • memory/5116-8-0x0000000004D70000-0x0000000004D80000-memory.dmp

          Filesize

          64KB

        • memory/5116-3-0x0000000004C50000-0x0000000004CE2000-memory.dmp

          Filesize

          584KB

        • memory/5116-2-0x0000000005100000-0x00000000056A4000-memory.dmp

          Filesize

          5.6MB

        • memory/5116-0-0x0000000074470000-0x0000000074C20000-memory.dmp

          Filesize

          7.7MB

        • memory/5116-7-0x0000000074470000-0x0000000074C20000-memory.dmp

          Filesize

          7.7MB

        • memory/5116-9-0x0000000006410000-0x000000000641A000-memory.dmp

          Filesize

          40KB

        • memory/5116-10-0x0000000006420000-0x000000000642C000-memory.dmp

          Filesize

          48KB

        • memory/5116-12-0x000000000BEA0000-0x000000000BF3C000-memory.dmp

          Filesize

          624KB

        • memory/5116-1-0x0000000000180000-0x000000000026A000-memory.dmp

          Filesize

          936KB

        • memory/5116-5-0x0000000004D20000-0x0000000004D2A000-memory.dmp

          Filesize

          40KB

        • memory/5116-6-0x0000000006170000-0x000000000618A000-memory.dmp

          Filesize

          104KB

        • memory/5116-32-0x0000000074470000-0x0000000074C20000-memory.dmp

          Filesize

          7.7MB

        • memory/5116-4-0x0000000004D70000-0x0000000004D80000-memory.dmp

          Filesize

          64KB