Analysis
- max time kernel
151s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
25/03/2024, 16:26
General
- Target Ref [HSBC Ref# H240322-X793Y1] Transaction_Confirmation_2024.exe
- Size 966KB
- Sample240325-txhpqaff2s
- SHA256 e825cdfc2e4a1b1c6a56602cce16417f55e4f42c699cea18b4dddbbf85d9527f
Malware Config
Extracted
-
remcos
-
RemoteHost
-
91.92.247.97:2505
-
stefracino.store:2505
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
keylog_crypt
true
-
keylog_file
togs.dat
-
keylog_flag
false
-
keylog_folder
stefcos
-
mouse_option
false
-
mutex
Rmc-POOUYY
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ref [HSBC Ref# H240322-X793Y1] Transaction_Confirmation_2024.exe"C:\Users\Admin\AppData\Local\Temp\Ref [HSBC Ref# H240322-X793Y1] Transaction_Confirmation_2024.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Ref [HSBC Ref# H240322-X793Y1] Transaction_Confirmation_2024.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UlvywtFnmZtH.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UlvywtFnmZtH" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB0C2.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
__PSScriptPolicyTest_usfmofov.3vf.ps1
tmpB0C2.tmp
memory/1508-88-0x0000000007E00000-0x0000000007E96000-memory.dmp
memory/1508-18-0x0000000005A30000-0x0000000006058000-memory.dmp
memory/1508-37-0x0000000006280000-0x00000000065D4000-memory.dmp
memory/1508-97-0x00000000744B0000-0x0000000074C60000-memory.dmp
memory/1508-24-0x0000000005790000-0x00000000057B2000-memory.dmp
memory/1508-92-0x0000000007EC0000-0x0000000007EDA000-memory.dmp
memory/1508-89-0x0000000007D80000-0x0000000007D91000-memory.dmp
memory/1508-14-0x0000000002F30000-0x0000000002F66000-memory.dmp
memory/1508-15-0x00000000744B0000-0x0000000074C60000-memory.dmp
memory/1508-17-0x0000000002FE0000-0x0000000002FF0000-memory.dmp
memory/1508-16-0x0000000002FE0000-0x0000000002FF0000-memory.dmp
memory/1508-59-0x0000000002FE0000-0x0000000002FF0000-memory.dmp
memory/1508-60-0x000000007F610000-0x000000007F620000-memory.dmp
memory/1508-74-0x0000000070AA0000-0x0000000070AEC000-memory.dmp
memory/1508-61-0x0000000006E30000-0x0000000006E62000-memory.dmp
memory/3988-99-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3988-102-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3988-53-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3988-56-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3988-101-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3988-103-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3988-100-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3988-43-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3988-47-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3988-49-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3988-54-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3988-52-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3988-51-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4088-19-0x00000000744B0000-0x0000000074C60000-memory.dmp
memory/4088-85-0x0000000007AB0000-0x000000000812A000-memory.dmp
memory/4088-26-0x0000000005A10000-0x0000000005A76000-memory.dmp
memory/4088-55-0x0000000006170000-0x000000000618E000-memory.dmp
memory/4088-57-0x0000000006200000-0x000000000624C000-memory.dmp
memory/4088-58-0x0000000002930000-0x0000000002940000-memory.dmp
memory/4088-25-0x0000000005130000-0x0000000005196000-memory.dmp
memory/4088-62-0x0000000070AA0000-0x0000000070AEC000-memory.dmp
memory/4088-63-0x000000007F330000-0x000000007F340000-memory.dmp
memory/4088-22-0x0000000002930000-0x0000000002940000-memory.dmp
memory/4088-73-0x00000000070C0000-0x00000000070DE000-memory.dmp
memory/4088-84-0x0000000007130000-0x00000000071D3000-memory.dmp
memory/4088-98-0x00000000744B0000-0x0000000074C60000-memory.dmp
memory/4088-20-0x0000000002930000-0x0000000002940000-memory.dmp
memory/4088-86-0x0000000007470000-0x000000000748A000-memory.dmp
memory/4088-93-0x0000000007790000-0x0000000007798000-memory.dmp
memory/4088-87-0x00000000074E0000-0x00000000074EA000-memory.dmp
memory/4088-91-0x00000000076B0000-0x00000000076C4000-memory.dmp
memory/4088-90-0x00000000076A0000-0x00000000076AE000-memory.dmp
memory/4216-9-0x0000000006370000-0x0000000006430000-memory.dmp
memory/4216-0-0x00000000744B0000-0x0000000074C60000-memory.dmp
memory/4216-8-0x0000000005140000-0x000000000514C000-memory.dmp
memory/4216-50-0x00000000744B0000-0x0000000074C60000-memory.dmp
memory/4216-7-0x0000000004E20000-0x0000000004E32000-memory.dmp
memory/4216-21-0x00000000744B0000-0x0000000074C60000-memory.dmp
memory/4216-6-0x0000000004D80000-0x0000000004E1C000-memory.dmp
memory/4216-5-0x0000000004BA0000-0x0000000004BAA000-memory.dmp
memory/4216-4-0x0000000004C80000-0x0000000004C90000-memory.dmp
memory/4216-3-0x0000000004AE0000-0x0000000004B72000-memory.dmp
memory/4216-2-0x0000000005150000-0x00000000056F4000-memory.dmp
memory/4216-1-0x0000000000050000-0x0000000000146000-memory.dmp