Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    08/12/2023, 10:25

General

  • Target

    KO98765456700.exe

  • Size

    588KB

  • MD5

    48a8c7c04787860d0b433581a404ba34

  • SHA1

    1c675b13fa28944232ec919b458c7da4a2bd43b2

  • SHA256

    27d2d0578f8c2ef2ed8055dfc2594af414222a0914e2740a0c12adb9db424e9d

  • SHA512

    b8d45391b6f0c3d6d1da61d2dc964e60925133cfca7f840cb9753f257494f5fa16997b91295fb26e5e216291702b712efd2fbbce7b52186c63222546612cfe4c

  • SSDEEP

    12288:BxL8DKn1sgl+4gXGMz4hQHjAl7ZEs7SroJZucXou:BhMKnv+Z2MEhQ8ldMUucX/

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

107.175.229.139:8087

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-IZFV1M

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\KO98765456700.exe
    "C:\Users\Admin\AppData\Local\Temp\KO98765456700.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Users\Admin\AppData\Local\Temp\qjwofl.exe
      "C:\Users\Admin\AppData\Local\Temp\qjwofl.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1252
      • C:\Users\Admin\AppData\Local\Temp\qjwofl.exe
        "C:\Users\Admin\AppData\Local\Temp\qjwofl.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2244
        • C:\Users\Admin\AppData\Local\Temp\qjwofl.exe
          C:\Users\Admin\AppData\Local\Temp\qjwofl.exe /stext "C:\Users\Admin\AppData\Local\Temp\ectewwnkadsuvuvgp"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2704
        • C:\Users\Admin\AppData\Local\Temp\qjwofl.exe
          C:\Users\Admin\AppData\Local\Temp\qjwofl.exe /stext "C:\Users\Admin\AppData\Local\Temp\pezxphxlolkhxarkgrrk"
          4⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook accounts
          PID:2728
        • C:\Users\Admin\AppData\Local\Temp\qjwofl.exe
          C:\Users\Admin\AppData\Local\Temp\qjwofl.exe /stext "C:\Users\Admin\AppData\Local\Temp\zzepqzifctcmiofwpbdmffs"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2612

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\remcos\logs.dat

          Filesize

          144B

          MD5

          b193812cc5d6a1f71ebe6fc9ca734154

          SHA1

          f8898da7494b71d2c29abe4b0f3d40a690073cc1

          SHA256

          795b9ea7fbc48cacceb79dbb1b14a4206aaa6aa91a3903e9da8fa2a5b779604d

          SHA512

          21e957150d23bbb3e8448ea9658f6c97beaf8a891fbf096bf360b4fb2f593f1fa1bd4fae9046a29971642757c8f059343643d952b2a72f54ff2aefd91f4c05e4

        • C:\Users\Admin\AppData\Local\Temp\ectewwnkadsuvuvgp

          Filesize

          2B

          MD5

          f3b25701fe362ec84616a93a45ce9998

          SHA1

          d62636d8caec13f04e28442a0a6fa1afeb024bbb

          SHA256

          b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

          SHA512

          98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

        • C:\Users\Admin\AppData\Local\Temp\qjwofl.exe

          Filesize

          168KB

          MD5

          e9e36c00a6bdc83b58f2f005d9230560

          SHA1

          4517889931bac4911012e6c40f26664553316b86

          SHA256

          f3b88a87391d8978784342aa4cf1d02c58b65051b6003d9643e5cb0b1fa38a49

          SHA512

          0af04537930dbd11a0524769781d2a03bd1282bf55f0e14e990fecf70d31a30f8bf4554c600125f0296617746a8822b29ab45ee7670874792905141af4f1e9ab

        • C:\Users\Admin\AppData\Local\Temp\qjwofl.exe

          Filesize

          168KB

          MD5

          e9e36c00a6bdc83b58f2f005d9230560

          SHA1

          4517889931bac4911012e6c40f26664553316b86

          SHA256

          f3b88a87391d8978784342aa4cf1d02c58b65051b6003d9643e5cb0b1fa38a49

          SHA512

          0af04537930dbd11a0524769781d2a03bd1282bf55f0e14e990fecf70d31a30f8bf4554c600125f0296617746a8822b29ab45ee7670874792905141af4f1e9ab

        • C:\Users\Admin\AppData\Local\Temp\qjwofl.exe

          Filesize

          168KB

          MD5

          e9e36c00a6bdc83b58f2f005d9230560

          SHA1

          4517889931bac4911012e6c40f26664553316b86

          SHA256

          f3b88a87391d8978784342aa4cf1d02c58b65051b6003d9643e5cb0b1fa38a49

          SHA512

          0af04537930dbd11a0524769781d2a03bd1282bf55f0e14e990fecf70d31a30f8bf4554c600125f0296617746a8822b29ab45ee7670874792905141af4f1e9ab

        • C:\Users\Admin\AppData\Local\Temp\qjwofl.exe

          Filesize

          168KB

          MD5

          e9e36c00a6bdc83b58f2f005d9230560

          SHA1

          4517889931bac4911012e6c40f26664553316b86

          SHA256

          f3b88a87391d8978784342aa4cf1d02c58b65051b6003d9643e5cb0b1fa38a49

          SHA512

          0af04537930dbd11a0524769781d2a03bd1282bf55f0e14e990fecf70d31a30f8bf4554c600125f0296617746a8822b29ab45ee7670874792905141af4f1e9ab

        • C:\Users\Admin\AppData\Local\Temp\qjwofl.exe

          Filesize

          168KB

          MD5

          e9e36c00a6bdc83b58f2f005d9230560

          SHA1

          4517889931bac4911012e6c40f26664553316b86

          SHA256

          f3b88a87391d8978784342aa4cf1d02c58b65051b6003d9643e5cb0b1fa38a49

          SHA512

          0af04537930dbd11a0524769781d2a03bd1282bf55f0e14e990fecf70d31a30f8bf4554c600125f0296617746a8822b29ab45ee7670874792905141af4f1e9ab

        • C:\Users\Admin\AppData\Local\Temp\qjwofl.exe

          Filesize

          168KB

          MD5

          e9e36c00a6bdc83b58f2f005d9230560

          SHA1

          4517889931bac4911012e6c40f26664553316b86

          SHA256

          f3b88a87391d8978784342aa4cf1d02c58b65051b6003d9643e5cb0b1fa38a49

          SHA512

          0af04537930dbd11a0524769781d2a03bd1282bf55f0e14e990fecf70d31a30f8bf4554c600125f0296617746a8822b29ab45ee7670874792905141af4f1e9ab

        • C:\Users\Admin\AppData\Local\Temp\qjwofl.exe

          Filesize

          168KB

          MD5

          e9e36c00a6bdc83b58f2f005d9230560

          SHA1

          4517889931bac4911012e6c40f26664553316b86

          SHA256

          f3b88a87391d8978784342aa4cf1d02c58b65051b6003d9643e5cb0b1fa38a49

          SHA512

          0af04537930dbd11a0524769781d2a03bd1282bf55f0e14e990fecf70d31a30f8bf4554c600125f0296617746a8822b29ab45ee7670874792905141af4f1e9ab

        • C:\Users\Admin\AppData\Local\Temp\zjzlpdsjrr.mut

          Filesize

          502KB

          MD5

          d1422dcc186dd0d33d4ee348049b7066

          SHA1

          1798099cde18c883af8cff25d213ab51b454d373

          SHA256

          0f1e81839fb040ce10485c8be5c6102546e8673aac91f78813d9ca439017957a

          SHA512

          ca6b9741abbaa59358af118efeaabe8758b793036132f879783d41c77551c246b5456f0b22f455d77c3571cb697f3768293a10aee7c719b9fe8d63de52dfd02d

        • \Users\Admin\AppData\Local\Temp\qjwofl.exe

          Filesize

          168KB

          MD5

          e9e36c00a6bdc83b58f2f005d9230560

          SHA1

          4517889931bac4911012e6c40f26664553316b86

          SHA256

          f3b88a87391d8978784342aa4cf1d02c58b65051b6003d9643e5cb0b1fa38a49

          SHA512

          0af04537930dbd11a0524769781d2a03bd1282bf55f0e14e990fecf70d31a30f8bf4554c600125f0296617746a8822b29ab45ee7670874792905141af4f1e9ab

        • \Users\Admin\AppData\Local\Temp\qjwofl.exe

          Filesize

          168KB

          MD5

          e9e36c00a6bdc83b58f2f005d9230560

          SHA1

          4517889931bac4911012e6c40f26664553316b86

          SHA256

          f3b88a87391d8978784342aa4cf1d02c58b65051b6003d9643e5cb0b1fa38a49

          SHA512

          0af04537930dbd11a0524769781d2a03bd1282bf55f0e14e990fecf70d31a30f8bf4554c600125f0296617746a8822b29ab45ee7670874792905141af4f1e9ab

        • \Users\Admin\AppData\Local\Temp\qjwofl.exe

          Filesize

          168KB

          MD5

          e9e36c00a6bdc83b58f2f005d9230560

          SHA1

          4517889931bac4911012e6c40f26664553316b86

          SHA256

          f3b88a87391d8978784342aa4cf1d02c58b65051b6003d9643e5cb0b1fa38a49

          SHA512

          0af04537930dbd11a0524769781d2a03bd1282bf55f0e14e990fecf70d31a30f8bf4554c600125f0296617746a8822b29ab45ee7670874792905141af4f1e9ab

        • \Users\Admin\AppData\Local\Temp\qjwofl.exe

          Filesize

          168KB

          MD5

          e9e36c00a6bdc83b58f2f005d9230560

          SHA1

          4517889931bac4911012e6c40f26664553316b86

          SHA256

          f3b88a87391d8978784342aa4cf1d02c58b65051b6003d9643e5cb0b1fa38a49

          SHA512

          0af04537930dbd11a0524769781d2a03bd1282bf55f0e14e990fecf70d31a30f8bf4554c600125f0296617746a8822b29ab45ee7670874792905141af4f1e9ab

        • \Users\Admin\AppData\Local\Temp\qjwofl.exe

          Filesize

          168KB

          MD5

          e9e36c00a6bdc83b58f2f005d9230560

          SHA1

          4517889931bac4911012e6c40f26664553316b86

          SHA256

          f3b88a87391d8978784342aa4cf1d02c58b65051b6003d9643e5cb0b1fa38a49

          SHA512

          0af04537930dbd11a0524769781d2a03bd1282bf55f0e14e990fecf70d31a30f8bf4554c600125f0296617746a8822b29ab45ee7670874792905141af4f1e9ab

        • \Users\Admin\AppData\Local\Temp\qjwofl.exe

          Filesize

          168KB

          MD5

          e9e36c00a6bdc83b58f2f005d9230560

          SHA1

          4517889931bac4911012e6c40f26664553316b86

          SHA256

          f3b88a87391d8978784342aa4cf1d02c58b65051b6003d9643e5cb0b1fa38a49

          SHA512

          0af04537930dbd11a0524769781d2a03bd1282bf55f0e14e990fecf70d31a30f8bf4554c600125f0296617746a8822b29ab45ee7670874792905141af4f1e9ab

        • memory/1252-16-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/1252-9-0x0000000000400000-0x000000000042E000-memory.dmp

          Filesize

          184KB

        • memory/2244-24-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-79-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-29-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-109-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-106-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-26-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-103-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-101-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-100-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-98-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-25-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-95-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-92-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-23-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-90-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-22-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-21-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-19-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-89-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-86-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-84-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-18-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-61-0x0000000010000000-0x0000000010019000-memory.dmp

          Filesize

          100KB

        • memory/2244-65-0x0000000010000000-0x0000000010019000-memory.dmp

          Filesize

          100KB

        • memory/2244-64-0x0000000010000000-0x0000000010019000-memory.dmp

          Filesize

          100KB

        • memory/2244-67-0x0000000010000000-0x0000000010019000-memory.dmp

          Filesize

          100KB

        • memory/2244-66-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-68-0x0000000010000000-0x0000000010019000-memory.dmp

          Filesize

          100KB

        • memory/2244-81-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-72-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-73-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-76-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-14-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-78-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2244-27-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/2612-46-0x0000000000400000-0x0000000000424000-memory.dmp

          Filesize

          144KB

        • memory/2612-51-0x0000000000400000-0x0000000000424000-memory.dmp

          Filesize

          144KB

        • memory/2612-50-0x0000000000400000-0x0000000000424000-memory.dmp

          Filesize

          144KB

        • memory/2612-42-0x0000000000400000-0x0000000000424000-memory.dmp

          Filesize

          144KB

        • memory/2704-57-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/2704-40-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/2704-41-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/2704-38-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/2704-31-0x0000000000400000-0x0000000000478000-memory.dmp

          Filesize

          480KB

        • memory/2728-48-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB

        • memory/2728-69-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB

        • memory/2728-44-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB

        • memory/2728-34-0x0000000000400000-0x0000000000457000-memory.dmp

          Filesize

          348KB