Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/12/2023, 07:41

General

  • Target

    Payment Advice-BCS_ECS9522023032900460039_16922_952.exe

  • Size

    1.0MB

  • MD5

    d450c0d6afa6a22fc9fc53780bcc628b

  • SHA1

    65ae8b330c8da3f7c0699ea054cdcc857087bd38

  • SHA256

    ed5f392d0095487edd0f112db6a14bbd3e9dc13454e63bf17bb0816d15e93f31

  • SHA512

    20384a55ece7385a7c950ad984d75f778fc0c7975dfca813fe0b9890862649c26c5eea0e392648c66da491020e2818176c28bc89f1785159e9ed0f323748bc6e

  • SSDEEP

    12288:zy2iNpukyFWjrH66dn1uoLeyFfyu0AHyJy/bppvmT6TQ/lEtYyVgh2eV:G1XukRjr5pcobFJHxr+NNos

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

127.0.0.1:56932

45.128.234.54:56932

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-D11KCU

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Detect ZGRat V1 1 IoCs
  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
    "C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5028
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4864
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XOXpOFSvB.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1428
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XOXpOFSvB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp29DA.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2440
    • C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
      "C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      PID:4732
    • C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
      "C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe"
      2⤵
        PID:376

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

            Filesize

            2KB

            MD5

            968cb9309758126772781b83adb8a28f

            SHA1

            8da30e71accf186b2ba11da1797cf67f8f78b47c

            SHA256

            92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

            SHA512

            4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

            Filesize

            18KB

            MD5

            f8831e0aeffd24d465e9a8218a963f08

            SHA1

            89136e81cab114c12ba0a47f634b27f2e29529b7

            SHA256

            3ca2ceb5b77d5f6c465b2138e9eaff861042f22e8f6b93b1099251b0fa44eef1

            SHA512

            9baa9a9b9d0543386c9c1bcc3f8d2778f9339976647b89466a29b7045a8c6e48869f0f4df8cadcdc78fe25c233fb19e5ea462b0784f84170c356f070be0c0f81

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ohhss5pw.enh.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Local\Temp\tmp29DA.tmp

            Filesize

            1KB

            MD5

            d12bc4d4b295b2f4d420356bfd0da2c0

            SHA1

            17d589c2831d3cdc77c0819ff1610613a12322ee

            SHA256

            b02acc7ba3c8a38078a71fa6329cbc410eed8fcdff96a4b7203bd9ea0a7932d9

            SHA512

            346ca1c47b9d336abf12f1d5483ac51afd339220095a571e1625d8fbb7f5dd2f109d9b61cf27b301bdb9bf9a1fe6272932564758ca8bd1009b290e78620c2bdc

          • memory/1428-94-0x0000000007340000-0x000000000735A000-memory.dmp

            Filesize

            104KB

          • memory/1428-92-0x0000000007230000-0x000000000723E000-memory.dmp

            Filesize

            56KB

          • memory/1428-90-0x0000000007280000-0x0000000007316000-memory.dmp

            Filesize

            600KB

          • memory/1428-74-0x0000000006C60000-0x0000000006C7E000-memory.dmp

            Filesize

            120KB

          • memory/1428-60-0x000000007F420000-0x000000007F430000-memory.dmp

            Filesize

            64KB

          • memory/1428-62-0x00000000758F0000-0x000000007593C000-memory.dmp

            Filesize

            304KB

          • memory/1428-61-0x0000000006C80000-0x0000000006CB2000-memory.dmp

            Filesize

            200KB

          • memory/1428-59-0x0000000002530000-0x0000000002540000-memory.dmp

            Filesize

            64KB

          • memory/1428-21-0x0000000075040000-0x00000000757F0000-memory.dmp

            Filesize

            7.7MB

          • memory/1428-23-0x0000000004D10000-0x0000000004D32000-memory.dmp

            Filesize

            136KB

          • memory/1428-25-0x0000000005660000-0x00000000056C6000-memory.dmp

            Filesize

            408KB

          • memory/1428-102-0x0000000075040000-0x00000000757F0000-memory.dmp

            Filesize

            7.7MB

          • memory/4732-46-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-130-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-158-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-157-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-156-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-154-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-153-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-152-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-150-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-47-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-149-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-148-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-50-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-53-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-55-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-146-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-52-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-51-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-145-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-144-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-142-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-141-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-140-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-138-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-137-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-136-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-134-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-133-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-132-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-129-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-128-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-126-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-88-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-125-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-124-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-122-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-121-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-120-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-118-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-117-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-116-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-114-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-113-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-103-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-104-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-105-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-107-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-108-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-109-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-111-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4732-112-0x0000000000400000-0x0000000000480000-memory.dmp

            Filesize

            512KB

          • memory/4864-56-0x0000000006800000-0x000000000681E000-memory.dmp

            Filesize

            120KB

          • memory/4864-16-0x0000000005240000-0x0000000005276000-memory.dmp

            Filesize

            216KB

          • memory/4864-20-0x00000000052A0000-0x00000000052B0000-memory.dmp

            Filesize

            64KB

          • memory/4864-24-0x0000000006080000-0x00000000060E6000-memory.dmp

            Filesize

            408KB

          • memory/4864-95-0x0000000007E30000-0x0000000007E38000-memory.dmp

            Filesize

            32KB

          • memory/4864-19-0x00000000058E0000-0x0000000005F08000-memory.dmp

            Filesize

            6.2MB

          • memory/4864-93-0x0000000007D50000-0x0000000007D64000-memory.dmp

            Filesize

            80KB

          • memory/4864-17-0x0000000075040000-0x00000000757F0000-memory.dmp

            Filesize

            7.7MB

          • memory/4864-91-0x0000000007D10000-0x0000000007D21000-memory.dmp

            Filesize

            68KB

          • memory/4864-58-0x00000000052A0000-0x00000000052B0000-memory.dmp

            Filesize

            64KB

          • memory/4864-87-0x0000000007B80000-0x0000000007B8A000-memory.dmp

            Filesize

            40KB

          • memory/4864-86-0x0000000007B10000-0x0000000007B2A000-memory.dmp

            Filesize

            104KB

          • memory/4864-85-0x0000000008160000-0x00000000087DA000-memory.dmp

            Filesize

            6.5MB

          • memory/4864-18-0x00000000052A0000-0x00000000052B0000-memory.dmp

            Filesize

            64KB

          • memory/4864-64-0x000000007F640000-0x000000007F650000-memory.dmp

            Filesize

            64KB

          • memory/4864-84-0x0000000007A20000-0x0000000007AC3000-memory.dmp

            Filesize

            652KB

          • memory/4864-101-0x0000000075040000-0x00000000757F0000-memory.dmp

            Filesize

            7.7MB

          • memory/4864-63-0x00000000758F0000-0x000000007593C000-memory.dmp

            Filesize

            304KB

          • memory/4864-48-0x0000000006210000-0x0000000006564000-memory.dmp

            Filesize

            3.3MB

          • memory/4864-57-0x0000000006840000-0x000000000688C000-memory.dmp

            Filesize

            304KB

          • memory/5028-6-0x0000000004910000-0x0000000004924000-memory.dmp

            Filesize

            80KB

          • memory/5028-11-0x000000000A2E0000-0x000000000A37C000-memory.dmp

            Filesize

            624KB

          • memory/5028-10-0x0000000007EA0000-0x0000000007F60000-memory.dmp

            Filesize

            768KB

          • memory/5028-9-0x00000000049A0000-0x00000000049AC000-memory.dmp

            Filesize

            48KB

          • memory/5028-1-0x0000000075040000-0x00000000757F0000-memory.dmp

            Filesize

            7.7MB

          • memory/5028-54-0x0000000075040000-0x00000000757F0000-memory.dmp

            Filesize

            7.7MB

          • memory/5028-8-0x0000000005140000-0x0000000005150000-memory.dmp

            Filesize

            64KB

          • memory/5028-0-0x0000000000400000-0x000000000050A000-memory.dmp

            Filesize

            1.0MB

          • memory/5028-36-0x000000000A580000-0x000000000A600000-memory.dmp

            Filesize

            512KB

          • memory/5028-31-0x0000000007D10000-0x0000000007D16000-memory.dmp

            Filesize

            24KB

          • memory/5028-7-0x0000000075040000-0x00000000757F0000-memory.dmp

            Filesize

            7.7MB

          • memory/5028-5-0x00000000050B0000-0x00000000050BA000-memory.dmp

            Filesize

            40KB

          • memory/5028-4-0x0000000005140000-0x0000000005150000-memory.dmp

            Filesize

            64KB

          • memory/5028-3-0x0000000004F10000-0x0000000004FA2000-memory.dmp

            Filesize

            584KB

          • memory/5028-2-0x0000000005420000-0x00000000059C4000-memory.dmp

            Filesize

            5.6MB