Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
25/01/2024, 07:44
General
- Target Item_list0025.exe
- Size 862KB
- Sample240125-jktaksbdc8
- SHA256 8957582ccd1876780ff5a43336984ee23ff03be1c8184a6ff9797828f52536e1
Malware Config
Extracted
-
remcos
-
dk
-
64.188.20.186:5050
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-TPXVZV
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
- Nirsoft 5 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: MapViewOfSection 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 33 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Item_list0025.exe"C:\Users\Admin\AppData\Local\Temp\Item_list0025.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hFjPDstJByxXbg.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hFjPDstJByxXbg" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8434.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\Item_list0025.exe"C:\Users\Admin\AppData\Local\Temp\Item_list0025.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Item_list0025.exeC:\Users\Admin\AppData\Local\Temp\Item_list0025.exe /stext "C:\Users\Admin\AppData\Local\Temp\zethacmglvwgaezeehpf"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Item_list0025.exeC:\Users\Admin\AppData\Local\Temp\Item_list0025.exe /stext "C:\Users\Admin\AppData\Local\Temp\xkopzjbmxnebqxlan"3⤵
- Suspicious use of UnmapMainImage
-
-
C:\Users\Admin\AppData\Local\Temp\Item_list0025.exeC:\Users\Admin\AppData\Local\Temp\Item_list0025.exe /stext "C:\Users\Admin\AppData\Local\Temp\xkopzjbmxnebqxlan"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Item_list0025.exeC:\Users\Admin\AppData\Local\Temp\Item_list0025.exe /stext "C:\Users\Admin\AppData\Local\Temp\mhjezrqkbfmoo"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 264 -ip 2641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 264 -s 121⤵
- Program crash
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_rmk5lxmv.diy.ps1
mhjezrqkbfmoo
tmp8434.tmp
memory/264-79-0x0000000000400000-0x0000000000457000-memory.dmp
memory/1296-20-0x0000000004F10000-0x0000000004F20000-memory.dmp
memory/1296-24-0x0000000005480000-0x00000000054A2000-memory.dmp
memory/1296-70-0x0000000007890000-0x000000000789E000-memory.dmp
memory/1296-71-0x00000000078A0000-0x00000000078B4000-memory.dmp
memory/1296-69-0x0000000007860000-0x0000000007871000-memory.dmp
memory/1296-68-0x00000000078E0000-0x0000000007976000-memory.dmp
memory/1296-15-0x0000000004D70000-0x0000000004DA6000-memory.dmp
memory/1296-73-0x0000000007980000-0x0000000007988000-memory.dmp
memory/1296-17-0x0000000005550000-0x0000000005B78000-memory.dmp
memory/1296-18-0x0000000074C70000-0x0000000075420000-memory.dmp
memory/1296-19-0x0000000004F10000-0x0000000004F20000-memory.dmp
memory/1296-59-0x0000000004F10000-0x0000000004F20000-memory.dmp
memory/1296-65-0x00000000076D0000-0x00000000076DA000-memory.dmp
memory/1296-72-0x00000000079A0000-0x00000000079BA000-memory.dmp
memory/1296-46-0x000000007EFD0000-0x000000007EFE0000-memory.dmp
memory/1296-63-0x0000000007CA0000-0x000000000831A000-memory.dmp
memory/1296-27-0x0000000005C80000-0x0000000005CE6000-memory.dmp
memory/1296-64-0x0000000007660000-0x000000000767A000-memory.dmp
memory/1296-47-0x0000000006900000-0x0000000006932000-memory.dmp
memory/1296-35-0x0000000005CF0000-0x0000000005D56000-memory.dmp
memory/1296-48-0x0000000073740000-0x000000007378C000-memory.dmp
memory/1296-58-0x0000000007300000-0x000000000731E000-memory.dmp
memory/1296-76-0x0000000074C70000-0x0000000075420000-memory.dmp
memory/1296-41-0x0000000005E70000-0x00000000061C4000-memory.dmp
memory/1296-42-0x0000000006330000-0x000000000634E000-memory.dmp
memory/1296-43-0x00000000063D0000-0x000000000641C000-memory.dmp
memory/1296-62-0x0000000007520000-0x00000000075C3000-memory.dmp
memory/3504-26-0x0000000074C70000-0x0000000075420000-memory.dmp
memory/3504-10-0x000000000A670000-0x000000000A70C000-memory.dmp
memory/3504-0-0x0000000000B20000-0x0000000000BFE000-memory.dmp
memory/3504-2-0x0000000005B30000-0x00000000060D4000-memory.dmp
memory/3504-3-0x0000000005620000-0x00000000056B2000-memory.dmp
memory/3504-4-0x0000000005860000-0x0000000005870000-memory.dmp
memory/3504-5-0x0000000005610000-0x000000000561A000-memory.dmp
memory/3504-6-0x0000000005840000-0x0000000005858000-memory.dmp
memory/3504-7-0x0000000005A20000-0x0000000005A28000-memory.dmp
memory/3504-1-0x0000000074C70000-0x0000000075420000-memory.dmp
memory/3504-8-0x0000000005A30000-0x0000000005A3C000-memory.dmp
memory/3504-9-0x0000000007EE0000-0x0000000007F98000-memory.dmp
memory/4124-103-0x0000000010000000-0x0000000010019000-memory.dmp
memory/4124-107-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4124-21-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4124-22-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4124-25-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4124-34-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4124-40-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4124-33-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4124-112-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4124-111-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4124-110-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4124-109-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4124-108-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4124-104-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4124-106-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4124-61-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4124-105-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4124-67-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4124-45-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4124-60-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4124-102-0x0000000010000000-0x0000000010019000-memory.dmp
memory/4124-100-0x0000000010000000-0x0000000010019000-memory.dmp
memory/4124-44-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4124-101-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4124-99-0x0000000010000000-0x0000000010019000-memory.dmp
memory/4124-96-0x0000000010000000-0x0000000010019000-memory.dmp
memory/4428-93-0x0000000000400000-0x0000000000478000-memory.dmp
memory/4428-77-0x0000000000400000-0x0000000000478000-memory.dmp
memory/4428-83-0x0000000000400000-0x0000000000478000-memory.dmp
memory/4428-80-0x0000000000400000-0x0000000000478000-memory.dmp
memory/4620-85-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4620-89-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4620-90-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4620-91-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4620-81-0x0000000000400000-0x0000000000424000-memory.dmp