Analysis

  • max time kernel
    183s
  • max time network
    191s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-12-2023 03:26

General

  • Target

    0ce9986f40ca48cd895f2cc83cd61ecf.exe

  • Size

    420KB

  • MD5

    0ce9986f40ca48cd895f2cc83cd61ecf

  • SHA1

    771f17bbe3f77ba801f8b87d88e5e5f13c5dd56c

  • SHA256

    072aefc1a185ec483b10dfee719aa437c9c0c0772bb05dee0ff8303f107ca2c4

  • SHA512

    ab4db9572aaf76497545bfd612ad1cf6eb62ac1c054e82bbd3539ef551aa5d460f8cc248584ccd7d19d2e8553185be01db5cd6b0ef6ce83499f6f4dce3582e22

  • SSDEEP

    6144:i9g5p/aJJL7XJAnY7jioSgBK0Ru115xTcYeEknZJJAVAe+:igUJHX+nOjhBq1j2AWt

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

Buddy

C2

eastsidepapi.myq-see.com:6996

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    Buddy.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Buddy-PVO134

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Buddy

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Executes dropped EXE 2 IoCs
  • Obfuscated with Agile.Net obfuscator 4 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ce9986f40ca48cd895f2cc83cd61ecf.exe
    "C:\Users\Admin\AppData\Local\Temp\0ce9986f40ca48cd895f2cc83cd61ecf.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1448
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v progmfil /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Local\ftermgr.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3520
      • C:\Windows\SysWOW64\reg.exe
        REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v progmfil /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Local\ftermgr.exe"
        3⤵
        • Adds Run key to start application
        PID:3656
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process C:\Users\Admin\AppData\Local\ftermgr.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4676
      • C:\Users\Admin\AppData\Local\ftermgr.exe
        "C:\Users\Admin\AppData\Local\ftermgr.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3268
        • C:\Users\Admin\AppData\Local\ftermgr.exe
          "C:\Users\Admin\AppData\Local\ftermgr.exe"
          4⤵
          • Executes dropped EXE
          PID:4784

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wgr3jpmk.tu3.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\ftermgr.exe
    Filesize

    420KB

    MD5

    0ce9986f40ca48cd895f2cc83cd61ecf

    SHA1

    771f17bbe3f77ba801f8b87d88e5e5f13c5dd56c

    SHA256

    072aefc1a185ec483b10dfee719aa437c9c0c0772bb05dee0ff8303f107ca2c4

    SHA512

    ab4db9572aaf76497545bfd612ad1cf6eb62ac1c054e82bbd3539ef551aa5d460f8cc248584ccd7d19d2e8553185be01db5cd6b0ef6ce83499f6f4dce3582e22

  • C:\Users\Admin\AppData\Local\ftermgr.exe
    Filesize

    166KB

    MD5

    de7f0ac36f5b9f7dcedcb1a784a34152

    SHA1

    a6ff55275e7a17352210e581e8b79fbc9b02d225

    SHA256

    89d920a845fe22524cd88070c278a791290a9a6ca08e702df8ad9342ac7fe824

    SHA512

    db6bc24043da267378ff32a0b23ddce1052eb88a0a8178d8debcfc71741d04f20af367fc27ca81a9ef538926f9ecdbf7f01bb9d24baf366501a3bbd48515fae3

  • memory/1448-10-0x00000000061D0000-0x00000000061D8000-memory.dmp
    Filesize

    32KB

  • memory/1448-4-0x0000000006490000-0x0000000006A34000-memory.dmp
    Filesize

    5.6MB

  • memory/1448-5-0x0000000005ED0000-0x0000000005ED8000-memory.dmp
    Filesize

    32KB

  • memory/1448-6-0x0000000074A50000-0x0000000075200000-memory.dmp
    Filesize

    7.7MB

  • memory/1448-7-0x00000000057E0000-0x00000000057F0000-memory.dmp
    Filesize

    64KB

  • memory/1448-8-0x0000000005FE0000-0x0000000006072000-memory.dmp
    Filesize

    584KB

  • memory/1448-9-0x00000000057E0000-0x00000000057F0000-memory.dmp
    Filesize

    64KB

  • memory/1448-0-0x0000000074A50000-0x0000000075200000-memory.dmp
    Filesize

    7.7MB

  • memory/1448-11-0x0000000005CE0000-0x0000000005D24000-memory.dmp
    Filesize

    272KB

  • memory/1448-12-0x00000000057E0000-0x00000000057F0000-memory.dmp
    Filesize

    64KB

  • memory/1448-13-0x0000000001700000-0x0000000001708000-memory.dmp
    Filesize

    32KB

  • memory/1448-16-0x0000000074A50000-0x0000000075200000-memory.dmp
    Filesize

    7.7MB

  • memory/1448-1-0x0000000000E30000-0x0000000000EA0000-memory.dmp
    Filesize

    448KB

  • memory/1448-3-0x00000000057E0000-0x00000000057F0000-memory.dmp
    Filesize

    64KB

  • memory/1448-2-0x0000000003140000-0x0000000003156000-memory.dmp
    Filesize

    88KB

  • memory/3268-49-0x0000000074A50000-0x0000000075200000-memory.dmp
    Filesize

    7.7MB

  • memory/3268-46-0x0000000074A50000-0x0000000075200000-memory.dmp
    Filesize

    7.7MB

  • memory/3268-52-0x0000000005020000-0x0000000005030000-memory.dmp
    Filesize

    64KB

  • memory/3268-51-0x0000000005B20000-0x0000000005B2A000-memory.dmp
    Filesize

    40KB

  • memory/3268-50-0x0000000005020000-0x0000000005030000-memory.dmp
    Filesize

    64KB

  • memory/3268-48-0x0000000005020000-0x0000000005030000-memory.dmp
    Filesize

    64KB

  • memory/3268-44-0x0000000002980000-0x0000000002996000-memory.dmp
    Filesize

    88KB

  • memory/3268-47-0x0000000005020000-0x0000000005030000-memory.dmp
    Filesize

    64KB

  • memory/4676-34-0x0000000006510000-0x0000000006864000-memory.dmp
    Filesize

    3.3MB

  • memory/4676-45-0x0000000074A50000-0x0000000075200000-memory.dmp
    Filesize

    7.7MB

  • memory/4676-39-0x0000000006E40000-0x0000000006E62000-memory.dmp
    Filesize

    136KB

  • memory/4676-37-0x0000000006EB0000-0x0000000006F46000-memory.dmp
    Filesize

    600KB

  • memory/4676-19-0x0000000005450000-0x0000000005460000-memory.dmp
    Filesize

    64KB

  • memory/4676-36-0x0000000006A50000-0x0000000006A9C000-memory.dmp
    Filesize

    304KB

  • memory/4676-35-0x00000000069A0000-0x00000000069BE000-memory.dmp
    Filesize

    120KB

  • memory/4676-38-0x0000000006DF0000-0x0000000006E0A000-memory.dmp
    Filesize

    104KB

  • memory/4676-21-0x0000000005A90000-0x00000000060B8000-memory.dmp
    Filesize

    6.2MB

  • memory/4676-17-0x00000000052F0000-0x0000000005326000-memory.dmp
    Filesize

    216KB

  • memory/4676-24-0x0000000006360000-0x00000000063C6000-memory.dmp
    Filesize

    408KB

  • memory/4676-20-0x0000000005450000-0x0000000005460000-memory.dmp
    Filesize

    64KB

  • memory/4676-18-0x0000000074A50000-0x0000000075200000-memory.dmp
    Filesize

    7.7MB

  • memory/4676-22-0x00000000058D0000-0x00000000058F2000-memory.dmp
    Filesize

    136KB

  • memory/4676-23-0x00000000060C0000-0x0000000006126000-memory.dmp
    Filesize

    408KB

  • memory/4784-53-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB