Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/12/2023, 09:23

General

  • Target

    SecuriteInfo.com.Win32.RATX-gen.21340.24792.exe

  • Size

    757KB

  • MD5

    49eca8d1b29bfaec20599239db6f10da

  • SHA1

    ee605018797e3a9408e24b7ec0767ef5e096ac16

  • SHA256

    dfd724316cb0edbf1212cbf5e71f007d22b7a38e7860d96d4d4bedf17eaa85ea

  • SHA512

    a0d1d7910314cc76bdfa46b6f8cdc9909d850f7fe320be943c16bb6da86b213b23148b331626492a07fedda1932e9d09d4fd10faeb00171e43cdd801cfb71220

  • SSDEEP

    12288:HDWMD9ehE+uDneLBQt20dup/20AQBOLdxD4N1fahKDwancwk6pvxT0K0jlyOJN9I:FefZ27zZPdnjImBOQX

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

107.175.229.139:8087

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-IZFV1M

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 6 IoCs
  • Drops startup file 2 IoCs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.21340.24792.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.21340.24792.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1488
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
      "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.21340.24792.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe'
      2⤵
      • Drops startup file
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4856
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4816
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /stext "C:\Users\Admin\AppData\Local\Temp\btjvbvxkuawcrwhknvxyzrueqrovt"
        3⤵
          PID:4980
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /stext "C:\Users\Admin\AppData\Local\Temp\btjvbvxkuawcrwhknvxyzrueqrovt"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1804
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /stext "C:\Users\Admin\AppData\Local\Temp\mvofcnimiiohckewegkscepvyxgeuduf"
          3⤵
          • Accesses Microsoft Outlook accounts
          PID:4976
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /stext "C:\Users\Admin\AppData\Local\Temp\wquy"
          3⤵
            PID:4588
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /stext "C:\Users\Admin\AppData\Local\Temp\wquy"
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2528

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\remcos\logs.dat

              Filesize

              144B

              MD5

              fa1db6aea687cd80456174dd65075b23

              SHA1

              85f9fb1e2b1883cc42a5091f94e5b9695ab04123

              SHA256

              b1d434d0f76e561373599b43bfb2e3ce8ae991a14a098d997440e6f20b4c3a60

              SHA512

              9efbed7d7739e75ef32035e60fe5b4ab14c854ace5b9e368ccc64daf03eeb2a12c36f1376000ea38c324c8867be588b24f9056c6f4100c174a78dde12a05ba0a

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tpy2n3eb.ysf.ps1

              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            • C:\Users\Admin\AppData\Local\Temp\btjvbvxkuawcrwhknvxyzrueqrovt

              Filesize

              4KB

              MD5

              f38f9e66e6018fe17658be974254cad4

              SHA1

              597063c515fc90a5cef2d3f4a64d5c8f5e7ed47c

              SHA256

              448eb8deec9960c9a2b6a27daeaea4cbab7d8469ed8b52b6d5916df458b07bb6

              SHA512

              a6b2f498fbd5fe598430371d57182b73779e66af1f2a85b4f6bde919e17c0f8611b226d96ff8134098904c42edaf0c0ef78328f2ccbe9fb16a4f66dd1d5c57a5

            • memory/1488-5-0x0000000005650000-0x00000000056E2000-memory.dmp

              Filesize

              584KB

            • memory/1488-24-0x00000000054A0000-0x00000000054A8000-memory.dmp

              Filesize

              32KB

            • memory/1488-29-0x0000000074460000-0x0000000074C10000-memory.dmp

              Filesize

              7.7MB

            • memory/1488-6-0x00000000056F0000-0x000000000578C000-memory.dmp

              Filesize

              624KB

            • memory/1488-3-0x00000000054F0000-0x0000000005500000-memory.dmp

              Filesize

              64KB

            • memory/1488-2-0x0000000005500000-0x00000000055AE000-memory.dmp

              Filesize

              696KB

            • memory/1488-0-0x00000000009F0000-0x0000000000AB4000-memory.dmp

              Filesize

              784KB

            • memory/1488-4-0x0000000005B60000-0x0000000006104000-memory.dmp

              Filesize

              5.6MB

            • memory/1488-1-0x0000000074460000-0x0000000074C10000-memory.dmp

              Filesize

              7.7MB

            • memory/1804-58-0x0000000000400000-0x0000000000478000-memory.dmp

              Filesize

              480KB

            • memory/1804-56-0x0000000000400000-0x0000000000478000-memory.dmp

              Filesize

              480KB

            • memory/1804-52-0x0000000000400000-0x0000000000478000-memory.dmp

              Filesize

              480KB

            • memory/1804-77-0x0000000000400000-0x0000000000478000-memory.dmp

              Filesize

              480KB

            • memory/2528-65-0x0000000000400000-0x0000000000424000-memory.dmp

              Filesize

              144KB

            • memory/2528-73-0x0000000000400000-0x0000000000424000-memory.dmp

              Filesize

              144KB

            • memory/2528-74-0x0000000000400000-0x0000000000424000-memory.dmp

              Filesize

              144KB

            • memory/2528-60-0x0000000000400000-0x0000000000424000-memory.dmp

              Filesize

              144KB

            • memory/4816-27-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-120-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-31-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-33-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-35-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-137-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-135-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-36-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-38-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-39-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-40-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-41-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-132-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-131-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-130-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-49-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-30-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-126-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-26-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-124-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-121-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-95-0x0000000010000000-0x0000000010019000-memory.dmp

              Filesize

              100KB

            • memory/4816-119-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-70-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-116-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-112-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-62-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-110-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-109-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-105-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-99-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-98-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-96-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-80-0x0000000010000000-0x0000000010019000-memory.dmp

              Filesize

              100KB

            • memory/4816-84-0x0000000010000000-0x0000000010019000-memory.dmp

              Filesize

              100KB

            • memory/4816-83-0x0000000010000000-0x0000000010019000-memory.dmp

              Filesize

              100KB

            • memory/4816-85-0x0000000010000000-0x0000000010019000-memory.dmp

              Filesize

              100KB

            • memory/4816-87-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-86-0x0000000010000000-0x0000000010019000-memory.dmp

              Filesize

              100KB

            • memory/4816-89-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-90-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4816-93-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/4856-50-0x0000000074460000-0x0000000074C10000-memory.dmp

              Filesize

              7.7MB

            • memory/4856-13-0x0000000005FB0000-0x0000000006016000-memory.dmp

              Filesize

              408KB

            • memory/4856-8-0x0000000074460000-0x0000000074C10000-memory.dmp

              Filesize

              7.7MB

            • memory/4856-9-0x0000000005210000-0x0000000005220000-memory.dmp

              Filesize

              64KB

            • memory/4856-34-0x00000000053B0000-0x00000000053CE000-memory.dmp

              Filesize

              120KB

            • memory/4856-10-0x0000000005210000-0x0000000005220000-memory.dmp

              Filesize

              64KB

            • memory/4856-11-0x0000000005850000-0x0000000005E78000-memory.dmp

              Filesize

              6.2MB

            • memory/4856-37-0x0000000006750000-0x000000000679C000-memory.dmp

              Filesize

              304KB

            • memory/4856-12-0x00000000057E0000-0x0000000005802000-memory.dmp

              Filesize

              136KB

            • memory/4856-7-0x00000000050D0000-0x0000000005106000-memory.dmp

              Filesize

              216KB

            • memory/4856-42-0x00000000078E0000-0x0000000007976000-memory.dmp

              Filesize

              600KB

            • memory/4856-43-0x0000000006C00000-0x0000000006C1A000-memory.dmp

              Filesize

              104KB

            • memory/4856-14-0x0000000006020000-0x0000000006086000-memory.dmp

              Filesize

              408KB

            • memory/4856-25-0x0000000006260000-0x00000000065B4000-memory.dmp

              Filesize

              3.3MB

            • memory/4856-44-0x0000000006CB0000-0x0000000006CD2000-memory.dmp

              Filesize

              136KB

            • memory/4976-61-0x0000000000400000-0x0000000000457000-memory.dmp

              Filesize

              348KB

            • memory/4976-69-0x0000000000400000-0x0000000000457000-memory.dmp

              Filesize

              348KB

            • memory/4976-57-0x0000000000400000-0x0000000000457000-memory.dmp

              Filesize

              348KB

            • memory/4976-54-0x0000000000400000-0x0000000000457000-memory.dmp

              Filesize

              348KB