Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/02/2024, 02:22

General

  • Target

    3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe

  • Size

    1.0MB

  • MD5

    e5d2981fd9c531b3cfb780cf781bac91

  • SHA1

    aaf7084c369138eb5588051eda8aec9aa3c4ac26

  • SHA256

    3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b

  • SHA512

    ec10e5de423564c17caac9e3c8a4ab2d1ed51882c9cfe145374d69e9f18382d7bd23d370f0389fb56c3b77073da11351978e803dc53c7135e618bbf0507be539

  • SSDEEP

    24576:Aazz87bccsW43UyDBU7RCFYK9i3iOpOnC+yqiQDi/DtS:AOz8732BdUCYK9i3X6CPqinDo

Malware Config

Extracted

Family

remcos

Botnet

P2-bin

C2

84.38.132.126:61445

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-ANE1CN

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 26 IoCs
  • Detects executables built or packed with MPress PE compressor 18 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 3 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 3 IoCs
  • NirSoft MailPassView 3 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 8 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
    "C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:116
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4652
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bZurkfs.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:996
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bZurkfs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp76B2.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1156
    • C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
      "C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe"
      2⤵
        PID:4976
      • C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
        "C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3772
        • C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
          C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe /stext "C:\Users\Admin\AppData\Local\Temp\joqibzhdro"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2552
        • C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
          C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe /stext "C:\Users\Admin\AppData\Local\Temp\tjvabrrxfwsor"
          3⤵
          • Accesses Microsoft Outlook accounts
          PID:3572
        • C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe
          C:\Users\Admin\AppData\Local\Temp\3758ece40a4e7fdefd1d742e694dc86ddbd87f1d78bafcfb48934c450630d10b.exe /stext "C:\Users\Admin\AppData\Local\Temp\wlblukcytekstzclj"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2660

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\remcos\logs.dat

            Filesize

            144B

            MD5

            f7317fdc71d30fe75bfc822d892d817c

            SHA1

            44356ef7ce7d4eceacc50527b7e2b3b71d8a2a6f

            SHA256

            ec622888b888eaf65051631e7e83a27b3910ea923ce9a50337d9ce4392ec1ed5

            SHA512

            7802521aee26138519a813e7053e5025db85f04b2e282498095e636f10211da7c8bfecada404b7714683ba7653e645f98201a751b88f3256984f5c1b1da4e58e

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5fflbhxw.kwd.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • C:\Users\Admin\AppData\Local\Temp\joqibzhdro

            Filesize

            4KB

            MD5

            320830fb2990210b35d02eb559f1b3f2

            SHA1

            fba985836640a92e69c58c643929b75f7635ee33

            SHA256

            155c37d976ae56d6d9d7bed09e2802dade565be58b8af769b1e815ceb044c318

            SHA512

            6e0536d68bc7f2c053a02879aaabeabb390913028f5986be4d2c3eee67db27f1c9bf1675e33ef28bad5afb7c542070cdae31b31a1493328dc6e36c23a78a9073

          • C:\Users\Admin\AppData\Local\Temp\tmp76B2.tmp

            Filesize

            1KB

            MD5

            0d68ba61317bd7e6027c177af31ad262

            SHA1

            c227d201e0703b292eb244d576395112933e0cd6

            SHA256

            42b8166e931ed6fa5af31bf3a1cee048f3ddf8b89b44f657bb0da831fd9df3d1

            SHA512

            efb288a47a76f84425e748f5b4f32a1cb9e1cb64227fe9144a38ea63dba09e9e357b4a169c497aaa5e7655eecd5416dde451500b6ddb2529eb490f153c65ae9c

          • memory/116-4-0x0000000003310000-0x0000000003320000-memory.dmp

            Filesize

            64KB

          • memory/116-11-0x0000000074B00000-0x00000000752B0000-memory.dmp

            Filesize

            7.7MB

          • memory/116-6-0x000000000A8C0000-0x000000000A95C000-memory.dmp

            Filesize

            624KB

          • memory/116-7-0x0000000003160000-0x0000000003174000-memory.dmp

            Filesize

            80KB

          • memory/116-8-0x00000000031A0000-0x00000000031AA000-memory.dmp

            Filesize

            40KB

          • memory/116-9-0x00000000031B0000-0x00000000031BE000-memory.dmp

            Filesize

            56KB

          • memory/116-10-0x000000000AFC0000-0x000000000B086000-memory.dmp

            Filesize

            792KB

          • memory/116-5-0x00000000058E0000-0x00000000058EA000-memory.dmp

            Filesize

            40KB

          • memory/116-3-0x0000000007DF0000-0x0000000007E82000-memory.dmp

            Filesize

            584KB

          • memory/116-0-0x0000000074B00000-0x00000000752B0000-memory.dmp

            Filesize

            7.7MB

          • memory/116-2-0x00000000083A0000-0x0000000008944000-memory.dmp

            Filesize

            5.6MB

          • memory/116-19-0x0000000003310000-0x0000000003320000-memory.dmp

            Filesize

            64KB

          • memory/116-48-0x0000000074B00000-0x00000000752B0000-memory.dmp

            Filesize

            7.7MB

          • memory/116-1-0x0000000000D90000-0x0000000000E9A000-memory.dmp

            Filesize

            1.0MB

          • memory/996-24-0x0000000005950000-0x0000000005972000-memory.dmp

            Filesize

            136KB

          • memory/996-102-0x000000007F7C0000-0x000000007F7D0000-memory.dmp

            Filesize

            64KB

          • memory/996-64-0x0000000006EC0000-0x0000000006F0C000-memory.dmp

            Filesize

            304KB

          • memory/996-135-0x0000000007E60000-0x0000000007E74000-memory.dmp

            Filesize

            80KB

          • memory/996-131-0x0000000007E20000-0x0000000007E31000-memory.dmp

            Filesize

            68KB

          • memory/996-26-0x00000000062A0000-0x0000000006306000-memory.dmp

            Filesize

            408KB

          • memory/996-128-0x0000000007C20000-0x0000000007C3A000-memory.dmp

            Filesize

            104KB

          • memory/996-21-0x0000000074B00000-0x00000000752B0000-memory.dmp

            Filesize

            7.7MB

          • memory/996-125-0x0000000006E80000-0x0000000006E9E000-memory.dmp

            Filesize

            120KB

          • memory/996-139-0x0000000007F40000-0x0000000007F48000-memory.dmp

            Filesize

            32KB

          • memory/996-105-0x00000000712F0000-0x000000007133C000-memory.dmp

            Filesize

            304KB

          • memory/996-22-0x0000000003080000-0x0000000003090000-memory.dmp

            Filesize

            64KB

          • memory/996-97-0x0000000003080000-0x0000000003090000-memory.dmp

            Filesize

            64KB

          • memory/996-144-0x0000000074B00000-0x00000000752B0000-memory.dmp

            Filesize

            7.7MB

          • memory/2552-89-0x0000000000400000-0x0000000000478000-memory.dmp

            Filesize

            480KB

          • memory/2552-76-0x0000000000400000-0x0000000000478000-memory.dmp

            Filesize

            480KB

          • memory/2552-69-0x0000000000400000-0x0000000000478000-memory.dmp

            Filesize

            480KB

          • memory/2552-65-0x0000000000400000-0x0000000000478000-memory.dmp

            Filesize

            480KB

          • memory/2660-79-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/2660-83-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/2660-77-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/2660-149-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/2660-71-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/3572-78-0x0000000000400000-0x0000000000457000-memory.dmp

            Filesize

            348KB

          • memory/3572-80-0x0000000000400000-0x0000000000457000-memory.dmp

            Filesize

            348KB

          • memory/3572-67-0x0000000000400000-0x0000000000457000-memory.dmp

            Filesize

            348KB

          • memory/3572-72-0x0000000000400000-0x0000000000457000-memory.dmp

            Filesize

            348KB

          • memory/3572-84-0x0000000000400000-0x0000000000457000-memory.dmp

            Filesize

            348KB

          • memory/3772-94-0x0000000010000000-0x0000000010019000-memory.dmp

            Filesize

            100KB

          • memory/3772-38-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/3772-61-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/3772-59-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/3772-58-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/3772-62-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/3772-57-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/3772-82-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/3772-68-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/3772-56-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/3772-60-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/3772-55-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/3772-27-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/3772-96-0x0000000010000000-0x0000000010019000-memory.dmp

            Filesize

            100KB

          • memory/3772-91-0x0000000010000000-0x0000000010019000-memory.dmp

            Filesize

            100KB

          • memory/3772-74-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/3772-170-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/3772-98-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/3772-99-0x0000000010000000-0x0000000010019000-memory.dmp

            Filesize

            100KB

          • memory/3772-169-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/3772-54-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/3772-162-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/3772-44-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/3772-161-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/3772-153-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/3772-35-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/3772-147-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/3772-140-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/3772-28-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/3772-138-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/4652-103-0x000000007F6F0000-0x000000007F700000-memory.dmp

            Filesize

            64KB

          • memory/4652-130-0x00000000073C0000-0x0000000007456000-memory.dmp

            Filesize

            600KB

          • memory/4652-132-0x0000000004B90000-0x0000000004BA0000-memory.dmp

            Filesize

            64KB

          • memory/4652-133-0x0000000004B90000-0x0000000004BA0000-memory.dmp

            Filesize

            64KB

          • memory/4652-134-0x0000000007370000-0x000000000737E000-memory.dmp

            Filesize

            56KB

          • memory/4652-136-0x0000000007380000-0x0000000007394000-memory.dmp

            Filesize

            80KB

          • memory/4652-25-0x0000000004F00000-0x0000000004F66000-memory.dmp

            Filesize

            408KB

          • memory/4652-137-0x0000000007480000-0x000000000749A000-memory.dmp

            Filesize

            104KB

          • memory/4652-20-0x00000000051D0000-0x00000000057F8000-memory.dmp

            Filesize

            6.2MB

          • memory/4652-129-0x00000000071B0000-0x00000000071BA000-memory.dmp

            Filesize

            40KB

          • memory/4652-127-0x0000000007780000-0x0000000007DFA000-memory.dmp

            Filesize

            6.5MB

          • memory/4652-18-0x0000000004B90000-0x0000000004BA0000-memory.dmp

            Filesize

            64KB

          • memory/4652-145-0x0000000074B00000-0x00000000752B0000-memory.dmp

            Filesize

            7.7MB

          • memory/4652-126-0x0000000006E10000-0x0000000006EB3000-memory.dmp

            Filesize

            652KB

          • memory/4652-16-0x0000000074B00000-0x00000000752B0000-memory.dmp

            Filesize

            7.7MB

          • memory/4652-15-0x00000000024F0000-0x0000000002526000-memory.dmp

            Filesize

            216KB

          • memory/4652-115-0x00000000712F0000-0x000000007133C000-memory.dmp

            Filesize

            304KB

          • memory/4652-104-0x0000000006DD0000-0x0000000006E02000-memory.dmp

            Filesize

            200KB

          • memory/4652-63-0x0000000004BB0000-0x0000000004BCE000-memory.dmp

            Filesize

            120KB

          • memory/4652-100-0x0000000074B00000-0x00000000752B0000-memory.dmp

            Filesize

            7.7MB

          • memory/4652-49-0x0000000005870000-0x0000000005BC4000-memory.dmp

            Filesize

            3.3MB