Analysis

  • max time kernel
    148s
  • max time network
    144s
  • platform
    windows10-1703_x64
  • resource
    win10-20231129-en
  • resource tags

    arch:x64arch:x86image:win10-20231129-enlocale:en-usos:windows10-1703-x64system
  • submitted
    05/12/2023, 21:14

General

  • Target

    $R6B2ZGV.exe

  • Size

    895KB

  • MD5

    7f32f76a211c294f6e280b5f6867f2b0

  • SHA1

    008da0b94b792b4d4810a000336a37651090e9ed

  • SHA256

    996fec4254ba09feade637d40971b6472912961128f6ad353ec4fe0405f0cc70

  • SHA512

    1ac208de202c91a038f468a0fba3f3b4f09fa92c4a1d21cca4eda21cf40fe99f245424e6f485327b232a23eaa444419efa96384c3b88f6b0106f81efdb7388c9

  • SSDEEP

    12288:Sk4lrraD+fm31WPSq3CgCDBPifM1TimdE/3OLjRyX/03xP46L9FI:Sk4lXPfm3gqzB6k1Ts/k2cxHL9F

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

167.114.189.33:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-7ZDF66

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$R6B2ZGV.exe
    "C:\Users\Admin\AppData\Local\Temp\$R6B2ZGV.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\$R6B2ZGV.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1132
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XpBeYEmkGU.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3612
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XpBeYEmkGU" /XML "C:\Users\Admin\AppData\Local\Temp\tmp724D.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2372
    • C:\Users\Admin\AppData\Local\Temp\$R6B2ZGV.exe
      "C:\Users\Admin\AppData\Local\Temp\$R6B2ZGV.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:2900

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\remcos\logs.dat

          Filesize

          144B

          MD5

          918d483bc33cb04d6caffac8c248854f

          SHA1

          32bfacfc5cfcd4017d79b6d7a8ef00b6ec03fb17

          SHA256

          41116ed7cf53acff05cb8b49e0488ea389a67fdcf221ba43373ec882e20e662c

          SHA512

          f827dfe8f1d667fce0dc395dcf7427ea43d47dab345bf4daefde6ff726c972fa84b50d2bf4e27416db3c5ccd5038e6d1ffc4aef7f095a821c980795549986d97

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          1c19c16e21c97ed42d5beabc93391fc5

          SHA1

          8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

          SHA256

          1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

          SHA512

          7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          18KB

          MD5

          09e7a8aea3636188c3ca562e2c3353a5

          SHA1

          70eb0e4be5842d8c0d820147178b22e2e1981978

          SHA256

          9a42d3b38ebfd9afdf3fcbe6c316f89e91b2253964ce66aafe6957fcb7edd654

          SHA512

          7215554c95c546cda8f03e4d8090da6c7353f8f4f78fb0f64e453d778e78b63aca923c5541d89a180fc18ad3d318770fdbdeef5488532ba5a22d2c27b9d7ee5b

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tid12mxa.5yl.ps1

          Filesize

          1B

          MD5

          c4ca4238a0b923820dcc509a6f75849b

          SHA1

          356a192b7913b04c54574d18c28d46e6395428ab

          SHA256

          6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

          SHA512

          4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

        • C:\Users\Admin\AppData\Local\Temp\tmp724D.tmp

          Filesize

          1KB

          MD5

          14e1b188f75d56f6f7afe294121429cf

          SHA1

          f6cba689bc0b68ba8c16e43d936d756c4cb7bcf3

          SHA256

          c5e63f3413904372f44b57859dd6c4ecbbb314851d2274b23874601dfc18c872

          SHA512

          a72214dbb6f454c83a01e89ccb8672950bb9656a19dce2a8b4dcf8e3473a84ffed03f53050125e2321bd11eb2d3633c8141e1bd6ee19642ff37954eb58fbf6f7

        • memory/1132-482-0x0000000006750000-0x000000000676A000-memory.dmp

          Filesize

          104KB

        • memory/1132-38-0x00000000074C0000-0x0000000007810000-memory.dmp

          Filesize

          3.3MB

        • memory/1132-79-0x000000007EF70000-0x000000007EF80000-memory.dmp

          Filesize

          64KB

        • memory/1132-80-0x0000000008A70000-0x0000000008AA3000-memory.dmp

          Filesize

          204KB

        • memory/1132-93-0x0000000008BC0000-0x0000000008C65000-memory.dmp

          Filesize

          660KB

        • memory/1132-491-0x0000000006740000-0x0000000006748000-memory.dmp

          Filesize

          32KB

        • memory/1132-95-0x0000000006670000-0x0000000006680000-memory.dmp

          Filesize

          64KB

        • memory/1132-18-0x0000000073320000-0x0000000073A0E000-memory.dmp

          Filesize

          6.9MB

        • memory/1132-19-0x0000000006670000-0x0000000006680000-memory.dmp

          Filesize

          64KB

        • memory/1132-20-0x0000000000C00000-0x0000000000C36000-memory.dmp

          Filesize

          216KB

        • memory/1132-22-0x0000000006670000-0x0000000006680000-memory.dmp

          Filesize

          64KB

        • memory/1132-24-0x0000000006CB0000-0x00000000072D8000-memory.dmp

          Filesize

          6.2MB

        • memory/1132-45-0x00000000078B0000-0x00000000078FB000-memory.dmp

          Filesize

          300KB

        • memory/1132-46-0x0000000007BA0000-0x0000000007C16000-memory.dmp

          Filesize

          472KB

        • memory/1132-81-0x0000000073AA0000-0x0000000073AEB000-memory.dmp

          Filesize

          300KB

        • memory/1132-520-0x0000000073320000-0x0000000073A0E000-memory.dmp

          Filesize

          6.9MB

        • memory/1132-526-0x0000000073320000-0x0000000073A0E000-memory.dmp

          Filesize

          6.9MB

        • memory/1132-34-0x0000000006B80000-0x0000000006BE6000-memory.dmp

          Filesize

          408KB

        • memory/2900-531-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/2900-29-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/2900-527-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/2900-39-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/2900-42-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/2900-41-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/2900-32-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/2900-43-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/2900-31-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/2900-528-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/2900-535-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/2900-536-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/2900-541-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/2900-542-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/2900-547-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/2900-549-0x0000000000400000-0x0000000000481000-memory.dmp

          Filesize

          516KB

        • memory/3068-1-0x0000000073320000-0x0000000073A0E000-memory.dmp

          Filesize

          6.9MB

        • memory/3068-5-0x0000000005140000-0x000000000514A000-memory.dmp

          Filesize

          40KB

        • memory/3068-7-0x0000000073320000-0x0000000073A0E000-memory.dmp

          Filesize

          6.9MB

        • memory/3068-8-0x0000000005010000-0x0000000005020000-memory.dmp

          Filesize

          64KB

        • memory/3068-4-0x0000000005010000-0x0000000005020000-memory.dmp

          Filesize

          64KB

        • memory/3068-9-0x0000000005510000-0x000000000551E000-memory.dmp

          Filesize

          56KB

        • memory/3068-6-0x0000000005500000-0x0000000005510000-memory.dmp

          Filesize

          64KB

        • memory/3068-10-0x0000000006B40000-0x0000000006BF8000-memory.dmp

          Filesize

          736KB

        • memory/3068-11-0x0000000009250000-0x00000000092EC000-memory.dmp

          Filesize

          624KB

        • memory/3068-0-0x00000000006A0000-0x0000000000784000-memory.dmp

          Filesize

          912KB

        • memory/3068-3-0x0000000005060000-0x00000000050F2000-memory.dmp

          Filesize

          584KB

        • memory/3068-36-0x0000000073320000-0x0000000073A0E000-memory.dmp

          Filesize

          6.9MB

        • memory/3068-2-0x0000000005560000-0x0000000005A5E000-memory.dmp

          Filesize

          5.0MB

        • memory/3612-30-0x0000000007880000-0x00000000078A2000-memory.dmp

          Filesize

          136KB

        • memory/3612-525-0x0000000073320000-0x0000000073A0E000-memory.dmp

          Filesize

          6.9MB

        • memory/3612-28-0x00000000073D0000-0x00000000073E0000-memory.dmp

          Filesize

          64KB

        • memory/3612-82-0x0000000073AA0000-0x0000000073AEB000-memory.dmp

          Filesize

          300KB

        • memory/3612-27-0x00000000073D0000-0x00000000073E0000-memory.dmp

          Filesize

          64KB

        • memory/3612-35-0x0000000008340000-0x00000000083A6000-memory.dmp

          Filesize

          408KB

        • memory/3612-25-0x0000000073320000-0x0000000073A0E000-memory.dmp

          Filesize

          6.9MB

        • memory/3612-44-0x0000000008240000-0x000000000825C000-memory.dmp

          Filesize

          112KB

        • memory/3612-96-0x0000000009E20000-0x0000000009EB4000-memory.dmp

          Filesize

          592KB

        • memory/3612-94-0x00000000073D0000-0x00000000073E0000-memory.dmp

          Filesize

          64KB

        • memory/3612-84-0x00000000098F0000-0x000000000990E000-memory.dmp

          Filesize

          120KB

        • memory/3612-83-0x000000007E410000-0x000000007E420000-memory.dmp

          Filesize

          64KB