Analysis

  • max time kernel
    46s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-12-2023 19:19

General

  • Target

    0ce9986f40ca48cd895f2cc83cd61ecf.exe

  • Size

    420KB

  • MD5

    0ce9986f40ca48cd895f2cc83cd61ecf

  • SHA1

    771f17bbe3f77ba801f8b87d88e5e5f13c5dd56c

  • SHA256

    072aefc1a185ec483b10dfee719aa437c9c0c0772bb05dee0ff8303f107ca2c4

  • SHA512

    ab4db9572aaf76497545bfd612ad1cf6eb62ac1c054e82bbd3539ef551aa5d460f8cc248584ccd7d19d2e8553185be01db5cd6b0ef6ce83499f6f4dce3582e22

  • SSDEEP

    6144:i9g5p/aJJL7XJAnY7jioSgBK0Ru115xTcYeEknZJJAVAe+:igUJHX+nOjhBq1j2AWt

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

Buddy

C2

eastsidepapi.myq-see.com:6996

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    Buddy.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Buddy-PVO134

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Buddy

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Extracted

Family

remcos

Botnet

Buddy

C2

eastsidepapi.myq-see.com:6996

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    Buddy.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Buddy-PVO134

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Buddy

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Obfuscated with Agile.Net obfuscator 2 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ce9986f40ca48cd895f2cc83cd61ecf.exe
    "C:\Users\Admin\AppData\Local\Temp\0ce9986f40ca48cd895f2cc83cd61ecf.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4100
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v progmfil /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Local\ftermgr.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2896
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v progmfil /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Local\ftermgr.exe"
        3⤵
        • Adds Run key to start application
        PID:4108
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process C:\Users\Admin\AppData\Local\ftermgr.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3368
      • C:\Users\Admin\AppData\Local\ftermgr.exe
        "C:\Users\Admin\AppData\Local\ftermgr.exe"
        3⤵
          PID:3588
          • C:\Users\Admin\AppData\Local\ftermgr.exe
            "C:\Users\Admin\AppData\Local\ftermgr.exe"
            4⤵
              PID:1644
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 508
                5⤵
                • Program crash
                PID:2456
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 1480
              4⤵
              • Program crash
              PID:4980
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1644 -ip 1644
        1⤵
          PID:4680
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3588 -ip 3588
          1⤵
            PID:1108

          Network

          MITRE ATT&CK Matrix ATT&CK v13

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Defense Evasion

          Modify Registry

          1
          T1112

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kjwcquwx.l0j.ps1
            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Local\ftermgr.exe
            Filesize

            6KB

            MD5

            a7720fba5a6d70d4d2fc1753053e91ec

            SHA1

            ec683ec699a89ff29074e8b4dcccaf9f367ee550

            SHA256

            dca0a698ffb5343d0e3e96ef4f809c99ffbff66613cf9fecc65ade819e3c907f

            SHA512

            9ac0cd133bfe599e6b113c8a4ad7c4e4cc21467407c077f29ab68bfe87888e8c2d76a0e77b2ecde63794c5e44b600a57d2200221b4549df7868202fba69d1503

          • C:\Users\Admin\AppData\Local\ftermgr.exe
            Filesize

            5KB

            MD5

            ed9d5cb514b0851753ba0539cdeb5e7b

            SHA1

            40a8721fc8390ed443719d08ec44a2c0e4bbca59

            SHA256

            a2c66e60e3b40c0a4e854f34eb76b41e62ef115c880e01f8c81d6f57f95942e8

            SHA512

            1326f9a8a83a4bfde328979bda0fc1321084c31793753afdc407db1f8f4ae3247058179d9d225069f6d14c2e0e2ffd916c2b61eeb2bc831835f29cbd294f0fc0

          • C:\Users\Admin\AppData\Local\ftermgr.exe
            Filesize

            30KB

            MD5

            f2069a20bf65219b71b5f50e93cc9250

            SHA1

            95ad3aa76d5d0aca626ede2da8368b0cc9cd23dc

            SHA256

            fa2b93ac375b6a926dda8ce5dc39194b3b7e546e77d39f26ca2112f9d170a2c9

            SHA512

            112dc9efc5205f0df9502cbf52cbb3f7c444a4f939d7d12e0779138d35981353cb540ae18f4ec54bf70b13e90179b3e5041c7a9f3b43dabec7418d367ffb44b6

          • memory/1644-54-0x0000000000550000-0x0000000000570000-memory.dmp
            Filesize

            128KB

          • memory/1644-62-0x0000000000550000-0x0000000000570000-memory.dmp
            Filesize

            128KB

          • memory/1644-58-0x0000000000550000-0x0000000000570000-memory.dmp
            Filesize

            128KB

          • memory/3368-38-0x0000000006340000-0x000000000635A000-memory.dmp
            Filesize

            104KB

          • memory/3368-23-0x00000000056D0000-0x0000000005736000-memory.dmp
            Filesize

            408KB

          • memory/3368-39-0x0000000006390000-0x00000000063B2000-memory.dmp
            Filesize

            136KB

          • memory/3368-24-0x0000000005830000-0x0000000005896000-memory.dmp
            Filesize

            408KB

          • memory/3368-36-0x0000000005F10000-0x0000000005F5C000-memory.dmp
            Filesize

            304KB

          • memory/3368-35-0x0000000005E70000-0x0000000005E8E000-memory.dmp
            Filesize

            120KB

          • memory/3368-34-0x00000000059A0000-0x0000000005CF4000-memory.dmp
            Filesize

            3.3MB

          • memory/3368-37-0x0000000006E40000-0x0000000006ED6000-memory.dmp
            Filesize

            600KB

          • memory/3368-18-0x0000000004880000-0x00000000048B6000-memory.dmp
            Filesize

            216KB

          • memory/3368-20-0x00000000049F0000-0x0000000004A00000-memory.dmp
            Filesize

            64KB

          • memory/3368-19-0x00000000049F0000-0x0000000004A00000-memory.dmp
            Filesize

            64KB

          • memory/3368-17-0x0000000074410000-0x0000000074BC0000-memory.dmp
            Filesize

            7.7MB

          • memory/3368-21-0x0000000005030000-0x0000000005658000-memory.dmp
            Filesize

            6.2MB

          • memory/3368-22-0x0000000004E90000-0x0000000004EB2000-memory.dmp
            Filesize

            136KB

          • memory/3368-45-0x0000000074410000-0x0000000074BC0000-memory.dmp
            Filesize

            7.7MB

          • memory/3588-46-0x00000000055C0000-0x00000000055D0000-memory.dmp
            Filesize

            64KB

          • memory/3588-44-0x0000000074410000-0x0000000074BC0000-memory.dmp
            Filesize

            7.7MB

          • memory/3588-63-0x0000000074410000-0x0000000074BC0000-memory.dmp
            Filesize

            7.7MB

          • memory/3588-51-0x00000000055C0000-0x00000000055D0000-memory.dmp
            Filesize

            64KB

          • memory/3588-50-0x0000000006010000-0x000000000601A000-memory.dmp
            Filesize

            40KB

          • memory/3588-49-0x00000000055C0000-0x00000000055D0000-memory.dmp
            Filesize

            64KB

          • memory/3588-48-0x0000000074410000-0x0000000074BC0000-memory.dmp
            Filesize

            7.7MB

          • memory/3588-47-0x00000000055C0000-0x00000000055D0000-memory.dmp
            Filesize

            64KB

          • memory/4100-7-0x0000000004DD0000-0x0000000004DE0000-memory.dmp
            Filesize

            64KB

          • memory/4100-10-0x0000000074410000-0x0000000074BC0000-memory.dmp
            Filesize

            7.7MB

          • memory/4100-6-0x00000000055A0000-0x0000000005632000-memory.dmp
            Filesize

            584KB

          • memory/4100-0-0x0000000074410000-0x0000000074BC0000-memory.dmp
            Filesize

            7.7MB

          • memory/4100-9-0x0000000006000000-0x0000000006044000-memory.dmp
            Filesize

            272KB

          • memory/4100-8-0x00000000056D0000-0x00000000056D8000-memory.dmp
            Filesize

            32KB

          • memory/4100-16-0x0000000074410000-0x0000000074BC0000-memory.dmp
            Filesize

            7.7MB

          • memory/4100-5-0x0000000004E40000-0x0000000004E48000-memory.dmp
            Filesize

            32KB

          • memory/4100-11-0x0000000004DD0000-0x0000000004DE0000-memory.dmp
            Filesize

            64KB

          • memory/4100-12-0x00000000056E0000-0x00000000056E8000-memory.dmp
            Filesize

            32KB

          • memory/4100-4-0x0000000005A50000-0x0000000005FF4000-memory.dmp
            Filesize

            5.6MB

          • memory/4100-3-0x0000000004DD0000-0x0000000004DE0000-memory.dmp
            Filesize

            64KB

          • memory/4100-2-0x0000000002780000-0x0000000002796000-memory.dmp
            Filesize

            88KB

          • memory/4100-1-0x0000000000370000-0x00000000003E0000-memory.dmp
            Filesize

            448KB

          • memory/4100-14-0x0000000004DD0000-0x0000000004DE0000-memory.dmp
            Filesize

            64KB