Resubmissions

06/12/2023, 12:34

231206-pr5j3sdb3s 10

27/11/2023, 14:27

231127-rsefdsha85 10

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2023, 12:34

General

  • Target

    clientfmUx.exe

  • Size

    516KB

  • MD5

    38a9b7e6b93904b572e76cad2f99353c

  • SHA1

    20bd0ea13cbc76cdbb9d002a457e543d02e9d500

  • SHA256

    06b9b10a15c0b2856620dd4469c8a976bfbc42e506747a04a763dbeeaf1ecb79

  • SHA512

    b381687ef7f9f32af5b254b33bfffc287f675ba06d990df011a460c4f76c81d76546203af6bf0fc412e328d5e013e3997db56b3454002edc71ab6357e4211683

  • SSDEEP

    12288:1oPHzIcgTRo9RvHBQAC76LUkd0bpaMwdHqUz:SPHM1ohP0XAx

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

retghrtgwtrgtg.bounceme.net:3839

listpoints.click:7020

datastream.myvnc.com:5225

gservicese.com:2718

center.onthewifi.com:8118

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    explorer.exe

  • delete_file

    false

  • hide_file

    true

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-OPX7KW

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\clientfmUx.exe
    "C:\Users\Admin\AppData\Local\Temp\clientfmUx.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3644
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\SysWOW64\cmd.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1920
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
          PID:3016

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\19e09be8

            Filesize

            1.1MB

            MD5

            400104c285806db2ea291a5a0cd98f09

            SHA1

            8ffb20345435684f209ba15a6031d5207c7205fa

            SHA256

            2ed05e3352352b168ff6ccd463fc97bc53e107ab63b91eff8e9b409651c6624e

            SHA512

            c29d812515686566864da0aac71731a80416c9a0264e3913c32f127b0451e7aeb4520ad10ad3c56ee7dae19e73b9f5dc97443fe90936da7bfb5e7b170bf75391

          • memory/1920-14-0x0000000074D20000-0x0000000074E9B000-memory.dmp

            Filesize

            1.5MB

          • memory/1920-12-0x0000000074D20000-0x0000000074E9B000-memory.dmp

            Filesize

            1.5MB

          • memory/1920-11-0x0000000074D20000-0x0000000074E9B000-memory.dmp

            Filesize

            1.5MB

          • memory/1920-9-0x00007FFF47830000-0x00007FFF47A25000-memory.dmp

            Filesize

            2.0MB

          • memory/1920-7-0x0000000074D20000-0x0000000074E9B000-memory.dmp

            Filesize

            1.5MB

          • memory/3016-15-0x00007FFF47830000-0x00007FFF47A25000-memory.dmp

            Filesize

            2.0MB

          • memory/3016-24-0x0000000000920000-0x00000000009A4000-memory.dmp

            Filesize

            528KB

          • memory/3016-29-0x0000000000920000-0x00000000009A4000-memory.dmp

            Filesize

            528KB

          • memory/3016-28-0x0000000000920000-0x00000000009A4000-memory.dmp

            Filesize

            528KB

          • memory/3016-27-0x0000000000920000-0x00000000009A4000-memory.dmp

            Filesize

            528KB

          • memory/3016-26-0x0000000000920000-0x00000000009A4000-memory.dmp

            Filesize

            528KB

          • memory/3016-25-0x0000000000920000-0x00000000009A4000-memory.dmp

            Filesize

            528KB

          • memory/3016-16-0x0000000000920000-0x00000000009A4000-memory.dmp

            Filesize

            528KB

          • memory/3016-19-0x0000000000920000-0x00000000009A4000-memory.dmp

            Filesize

            528KB

          • memory/3016-20-0x00000000003E0000-0x0000000000813000-memory.dmp

            Filesize

            4.2MB

          • memory/3016-21-0x0000000000920000-0x00000000009A4000-memory.dmp

            Filesize

            528KB

          • memory/3016-22-0x0000000000920000-0x00000000009A4000-memory.dmp

            Filesize

            528KB

          • memory/3016-23-0x0000000000920000-0x00000000009A4000-memory.dmp

            Filesize

            528KB

          • memory/3644-5-0x0000000074D20000-0x0000000074E9B000-memory.dmp

            Filesize

            1.5MB

          • memory/3644-0-0x0000000000400000-0x0000000000488000-memory.dmp

            Filesize

            544KB

          • memory/3644-1-0x0000000074D20000-0x0000000074E9B000-memory.dmp

            Filesize

            1.5MB

          • memory/3644-2-0x00007FFF47830000-0x00007FFF47A25000-memory.dmp

            Filesize

            2.0MB

          • memory/3644-3-0x0000000074D20000-0x0000000074E9B000-memory.dmp

            Filesize

            1.5MB

          • memory/3644-4-0x0000000074D20000-0x0000000074E9B000-memory.dmp

            Filesize

            1.5MB