Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
12/02/2024, 11:33
General
- Target rORDERCONFIRMATION93892873984883782.exe
- Size 1.0MB
- Sample240212-nn32eadh57
- SHA256 3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b
Malware Config
Extracted
-
remcos
-
P2-bin
-
84.38.132.126:61445
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-ANE1CN
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
- NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
- Nirsoft 7 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious behavior: MapViewOfSection 4 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 36 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exe"C:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bZurkfs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bZurkfs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp87FC.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exe"C:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exeC:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exe /stext "C:\Users\Admin\AppData\Local\Temp\izsgxzcmarvf"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exeC:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exe /stext "C:\Users\Admin\AppData\Local\Temp\ktyqysnovznktvk"3⤵
- Accesses Microsoft Outlook accounts
-
-
C:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exeC:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exe /stext "C:\Users\Admin\AppData\Local\Temp\izsgxzcmarvf"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exeC:\Users\Admin\AppData\Local\Temp\rORDERCONFIRMATION93892873984883782.exe /stext "C:\Users\Admin\AppData\Local\Temp\vwdjrkyhjhfxvjysjy"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
logs.dat
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_bekd4roj.53b.ps1
izsgxzcmarvf
tmp87FC.tmp
memory/624-120-0x0000000000400000-0x0000000000424000-memory.dmp
memory/624-106-0x0000000000400000-0x0000000000424000-memory.dmp
memory/624-118-0x0000000000400000-0x0000000000424000-memory.dmp
memory/624-119-0x0000000000400000-0x0000000000424000-memory.dmp
memory/624-116-0x0000000000400000-0x0000000000424000-memory.dmp
memory/792-111-0x0000000000400000-0x0000000000457000-memory.dmp
memory/792-103-0x0000000000400000-0x0000000000457000-memory.dmp
memory/792-107-0x0000000000400000-0x0000000000457000-memory.dmp
memory/792-115-0x0000000000400000-0x0000000000457000-memory.dmp
memory/968-61-0x0000000000400000-0x0000000000482000-memory.dmp
memory/968-143-0x0000000000400000-0x0000000000482000-memory.dmp
memory/968-140-0x0000000010000000-0x0000000010019000-memory.dmp
memory/968-141-0x0000000000400000-0x0000000000482000-memory.dmp
memory/968-156-0x0000000000400000-0x0000000000482000-memory.dmp
memory/968-139-0x0000000010000000-0x0000000010019000-memory.dmp
memory/968-138-0x0000000010000000-0x0000000010019000-memory.dmp
memory/968-163-0x0000000000400000-0x0000000000482000-memory.dmp
memory/968-135-0x0000000010000000-0x0000000010019000-memory.dmp
memory/968-155-0x0000000000400000-0x0000000000482000-memory.dmp
memory/968-39-0x0000000000400000-0x0000000000482000-memory.dmp
memory/968-50-0x0000000000400000-0x0000000000482000-memory.dmp
memory/968-150-0x0000000010000000-0x0000000010019000-memory.dmp
memory/968-51-0x0000000000400000-0x0000000000482000-memory.dmp
memory/968-93-0x0000000000400000-0x0000000000482000-memory.dmp
memory/968-54-0x0000000000400000-0x0000000000482000-memory.dmp
memory/968-55-0x0000000000400000-0x0000000000482000-memory.dmp
memory/968-37-0x0000000000400000-0x0000000000482000-memory.dmp
memory/968-56-0x0000000000400000-0x0000000000482000-memory.dmp
memory/968-81-0x0000000000400000-0x0000000000482000-memory.dmp
memory/968-172-0x0000000000400000-0x0000000000482000-memory.dmp
memory/968-59-0x0000000000400000-0x0000000000482000-memory.dmp
memory/968-60-0x0000000000400000-0x0000000000482000-memory.dmp
memory/968-164-0x0000000000400000-0x0000000000482000-memory.dmp
memory/968-62-0x0000000000400000-0x0000000000482000-memory.dmp
memory/968-63-0x0000000000400000-0x0000000000482000-memory.dmp
memory/968-64-0x0000000000400000-0x0000000000482000-memory.dmp
memory/968-171-0x0000000000400000-0x0000000000482000-memory.dmp
memory/968-147-0x0000000000400000-0x0000000000482000-memory.dmp
memory/968-146-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1124-109-0x0000000000400000-0x0000000000478000-memory.dmp
memory/1124-101-0x0000000000400000-0x0000000000478000-memory.dmp
memory/1124-126-0x0000000000400000-0x0000000000478000-memory.dmp
memory/1124-104-0x0000000000400000-0x0000000000478000-memory.dmp
memory/1504-5-0x0000000002AB0000-0x0000000002ABA000-memory.dmp
memory/1504-4-0x0000000007550000-0x0000000007560000-memory.dmp
memory/1504-0-0x00000000005C0000-0x00000000006CA000-memory.dmp
memory/1504-52-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/1504-2-0x0000000007A70000-0x0000000008014000-memory.dmp
memory/1504-3-0x00000000075A0000-0x0000000007632000-memory.dmp
memory/1504-6-0x000000000A050000-0x000000000A0EC000-memory.dmp
memory/1504-7-0x0000000009FA0000-0x0000000009FB4000-memory.dmp
memory/1504-8-0x000000000A390000-0x000000000A39A000-memory.dmp
memory/1504-9-0x000000000A3A0000-0x000000000A3AE000-memory.dmp
memory/1504-10-0x000000000A490000-0x000000000A556000-memory.dmp
memory/1504-1-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/1504-20-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/4520-92-0x0000000005440000-0x0000000005450000-memory.dmp
memory/4520-57-0x00000000067F0000-0x000000000680E000-memory.dmp
memory/4520-100-0x0000000007D40000-0x0000000007D51000-memory.dmp
memory/4520-24-0x0000000005850000-0x0000000005872000-memory.dmp
memory/4520-98-0x0000000007BB0000-0x0000000007BBA000-memory.dmp
memory/4520-68-0x000000007EF10000-0x000000007EF20000-memory.dmp
memory/4520-97-0x0000000007B40000-0x0000000007B5A000-memory.dmp
memory/4520-58-0x0000000006840000-0x000000000688C000-memory.dmp
memory/4520-25-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/4520-21-0x0000000005440000-0x0000000005450000-memory.dmp
memory/4520-22-0x0000000005440000-0x0000000005450000-memory.dmp
memory/4520-133-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/4520-27-0x0000000006220000-0x0000000006286000-memory.dmp
memory/4520-79-0x0000000073DE0000-0x0000000073E2C000-memory.dmp
memory/5004-82-0x00000000074B0000-0x0000000007553000-memory.dmp
memory/5004-124-0x00000000078C0000-0x00000000078C8000-memory.dmp
memory/5004-132-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/5004-123-0x00000000078E0000-0x00000000078FA000-memory.dmp
memory/5004-121-0x00000000077D0000-0x00000000077DE000-memory.dmp
memory/5004-122-0x00000000077E0000-0x00000000077F4000-memory.dmp
memory/5004-117-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/5004-99-0x0000000007820000-0x00000000078B6000-memory.dmp
memory/5004-96-0x0000000007BF0000-0x000000000826A000-memory.dmp
memory/5004-80-0x00000000029F0000-0x0000000002A00000-memory.dmp
memory/5004-78-0x0000000006820000-0x000000000683E000-memory.dmp
memory/5004-65-0x000000007EE70000-0x000000007EE80000-memory.dmp
memory/5004-67-0x0000000073DE0000-0x0000000073E2C000-memory.dmp
memory/5004-66-0x0000000006840000-0x0000000006872000-memory.dmp
memory/5004-38-0x0000000005CE0000-0x0000000006034000-memory.dmp
memory/5004-26-0x0000000005B90000-0x0000000005BF6000-memory.dmp
memory/5004-16-0x0000000075310000-0x0000000075AC0000-memory.dmp
memory/5004-17-0x00000000029F0000-0x0000000002A00000-memory.dmp
memory/5004-19-0x00000000029F0000-0x0000000002A00000-memory.dmp
memory/5004-18-0x0000000005470000-0x0000000005A98000-memory.dmp
memory/5004-15-0x0000000002970000-0x00000000029A6000-memory.dmp