Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/03/2024, 02:44

General

  • Target

    a932316f192e4a8d361857aa3555cd6597b96364e9ce1fa379e419b8dd437edc.exe

  • Size

    1.0MB

  • MD5

    1511c1ff371af5f37e1d5470c1d5caf1

  • SHA1

    60296d0d34cf13621e5c749ef913c6fc234ee43b

  • SHA256

    a932316f192e4a8d361857aa3555cd6597b96364e9ce1fa379e419b8dd437edc

  • SHA512

    fe716743aab089e745e69a30748bc8bf5d5089cd4779c954bf717d76d505b1393429aff757fca7b379f4902f607555958f5046392a5c934c3fa762008551850b

  • SSDEEP

    24576:+PF6DSSEvVi8ds05OTOfYIOBRaR6URr0GDp6esPEM:+PazuAOfh4RaR6URrNpI

Malware Config

Extracted

Family

remcos

Botnet

JONS

C2

172.245.208.13:4445

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-R7QS5C

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 30 IoCs
  • Detects executables built or packed with MPress PE compressor 17 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 2 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 2 IoCs
  • ModiLoader Second Stage 1 IoCs
  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a932316f192e4a8d361857aa3555cd6597b96364e9ce1fa379e419b8dd437edc.exe
    "C:\Users\Admin\AppData\Local\Temp\a932316f192e4a8d361857aa3555cd6597b96364e9ce1fa379e419b8dd437edc.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1588
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c mkdir "\\?\C:\Windows "
      2⤵
        PID:2744
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c mkdir "\\?\C:\Windows \System32"
        2⤵
          PID:3816
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c "C:\Windows \System32\1933734.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:880
          • C:\Windows \System32\1933734.exe
            "C:\Windows \System32\1933734.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:800
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1544
              • C:\Windows\system32\cmd.exe
                cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:4464
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4392
        • C:\Windows\SysWOW64\extrac32.exe
          C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\AppData\Local\Temp\a932316f192e4a8d361857aa3555cd6597b96364e9ce1fa379e419b8dd437edc.exe C:\\Users\\Public\\Libraries\\Jpfwfpvi.PIF
          2⤵
            PID:640
          • C:\Users\Public\Libraries\ivpfwfpJ.pif
            C:\Users\Public\Libraries\ivpfwfpJ.pif
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:732
            • C:\Users\Public\Libraries\ivpfwfpJ.pif
              C:\Users\Public\Libraries\ivpfwfpJ.pif /stext "C:\Users\Admin\AppData\Local\Temp\sekqciwmbvuulocxwkxbejjm"
              3⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:4652
            • C:\Users\Public\Libraries\ivpfwfpJ.pif
              C:\Users\Public\Libraries\ivpfwfpJ.pif /stext "C:\Users\Admin\AppData\Local\Temp\czqadahgpdmzwvqjnvkdhwddosv"
              3⤵
              • Executes dropped EXE
              • Accesses Microsoft Outlook accounts
              PID:1180
            • C:\Users\Public\Libraries\ivpfwfpJ.pif
              C:\Users\Public\Libraries\ivpfwfpJ.pif /stext "C:\Users\Admin\AppData\Local\Temp\nbdtetshdleeyjmnwgwwsaymwynucn"
              3⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1204

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\ProgramData\remcos\logs.dat

                Filesize

                144B

                MD5

                435228a31f3a4424999eea93f5521b0f

                SHA1

                257dc73619e86368f011b4d7486d33703761c622

                SHA256

                abf9d6e2a71b93791549e844dda394454c7c6360d21bc1aee0bd67b69f4317d3

                SHA512

                ddd29d37d0ca5b168466bf2f29db097079b1d1dbb2ea7feb78be29ebf2670189f9bd377759f416a6eaa35b97daac3a53c059988fd4375498c04199c85c1e2f94

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_otuqwdzq.y5c.ps1

                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              • C:\Users\Admin\AppData\Local\Temp\sekqciwmbvuulocxwkxbejjm

                Filesize

                4KB

                MD5

                789c726863f720a7ba5d255e7a000734

                SHA1

                0427bac5473ae472d38f2f03e8de82d2dfb1a302

                SHA256

                2dbc369b0667f9cd7459735e998c13ffb3a06b91024e8d483f7776b292a9b627

                SHA512

                e469fd47e55e9c0548bb63868d57ec66f3c50ad69686cfaabd4a0e1e160ef56dc74caabc3643622b2c1769b026ea6a5651e0cc18f1d64e8454feb4fa529e1ce8

              • C:\Users\Public\Libraries\ivpfwfpJ.pif

                Filesize

                66KB

                MD5

                c116d3604ceafe7057d77ff27552c215

                SHA1

                452b14432fb5758b46f2897aeccd89f7c82a727d

                SHA256

                7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301

                SHA512

                9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

              • C:\Windows \System32\1933734.exe

                Filesize

                128KB

                MD5

                231ce1e1d7d98b44371ffff407d68b59

                SHA1

                25510d0f6353dbf0c9f72fc880de7585e34b28ff

                SHA256

                30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

                SHA512

                520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

              • C:\Windows \System32\netutils.dll

                Filesize

                112KB

                MD5

                fa7aa88417d0c48807144a1a48fe3fbc

                SHA1

                6f5ec990b12d4a6075050a94e0d68d03781fa46d

                SHA256

                2019dcd18ba7d5554a4a9da882740aa883941670af3de9396960081a0f8aa098

                SHA512

                99b2eb6f8e7d00a3803cba229149e5e0cb67a3deb607782c55fbacd25d9c074cce83759de15490eff939d5ad98f26cdbd44395cc79ffe22753e16c3d9e3b5fff

              • C:\windows \system32\KDECO.bat

                Filesize

                11KB

                MD5

                c545650595b479c81ad6b9d8882aae39

                SHA1

                7a98aa2e6eee23b3c1bba876955d525bc618b3f0

                SHA256

                a3a80983cb33159f0455fa0135789402558baa1460db94d0071318512b8cb5f9

                SHA512

                85ac596a7da9072a28c4178e4fdedc98f1b49c8e3fe5612cfe464833297b13f65d2dc59b52d7fc9970cff8f98d954111229aec0ed9dded454e03b0cf4ebb6ff3

              • memory/732-101-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/732-57-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/732-134-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/732-133-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/732-132-0x0000000000400000-0x0000000000482000-memory.dmp

                Filesize

                520KB

              • memory/732-129-0x0000000000400000-0x0000000000482000-memory.dmp

                Filesize

                520KB

              • memory/732-126-0x0000000000400000-0x0000000000482000-memory.dmp

                Filesize

                520KB

              • memory/732-123-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/732-42-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/732-122-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/732-45-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/732-47-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/732-49-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/732-50-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/732-52-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/732-53-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/732-54-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/732-55-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/732-121-0x0000000000400000-0x0000000000482000-memory.dmp

                Filesize

                520KB

              • memory/732-58-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/732-60-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/732-118-0x0000000000400000-0x0000000000482000-memory.dmp

                Filesize

                520KB

              • memory/732-115-0x0000000000400000-0x0000000000482000-memory.dmp

                Filesize

                520KB

              • memory/732-111-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/732-110-0x0000000000400000-0x0000000000482000-memory.dmp

                Filesize

                520KB

              • memory/732-108-0x0000000032460000-0x0000000032479000-memory.dmp

                Filesize

                100KB

              • memory/732-106-0x0000000000400000-0x0000000000482000-memory.dmp

                Filesize

                520KB

              • memory/732-103-0x0000000000400000-0x0000000000482000-memory.dmp

                Filesize

                520KB

              • memory/732-95-0x0000000032460000-0x0000000032479000-memory.dmp

                Filesize

                100KB

              • memory/732-100-0x0000000032460000-0x0000000032479000-memory.dmp

                Filesize

                100KB

              • memory/732-98-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/732-99-0x0000000032460000-0x0000000032479000-memory.dmp

                Filesize

                100KB

              • memory/732-96-0x0000000000400000-0x0000000000482000-memory.dmp

                Filesize

                520KB

              • memory/732-91-0x0000000032460000-0x0000000032479000-memory.dmp

                Filesize

                100KB

              • memory/732-89-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/800-15-0x00000000613C0000-0x00000000613E3000-memory.dmp

                Filesize

                140KB

              • memory/1180-75-0x0000000000400000-0x0000000000462000-memory.dmp

                Filesize

                392KB

              • memory/1180-65-0x0000000000400000-0x0000000000462000-memory.dmp

                Filesize

                392KB

              • memory/1180-72-0x0000000000400000-0x0000000000462000-memory.dmp

                Filesize

                392KB

              • memory/1180-70-0x0000000000400000-0x0000000000462000-memory.dmp

                Filesize

                392KB

              • memory/1204-71-0x0000000000400000-0x0000000000424000-memory.dmp

                Filesize

                144KB

              • memory/1204-79-0x0000000000400000-0x0000000000424000-memory.dmp

                Filesize

                144KB

              • memory/1204-82-0x0000000000400000-0x0000000000424000-memory.dmp

                Filesize

                144KB

              • memory/1204-87-0x0000000000400000-0x0000000000424000-memory.dmp

                Filesize

                144KB

              • memory/1588-30-0x00000000022F0000-0x00000000022F1000-memory.dmp

                Filesize

                4KB

              • memory/1588-1-0x0000000004050000-0x0000000005050000-memory.dmp

                Filesize

                16.0MB

              • memory/1588-2-0x0000000004050000-0x0000000005050000-memory.dmp

                Filesize

                16.0MB

              • memory/1588-0-0x00000000022F0000-0x00000000022F1000-memory.dmp

                Filesize

                4KB

              • memory/1588-4-0x0000000000400000-0x000000000050F000-memory.dmp

                Filesize

                1.1MB

              • memory/4392-19-0x0000020269B40000-0x0000020269B62000-memory.dmp

                Filesize

                136KB

              • memory/4392-33-0x00007FFD4E260000-0x00007FFD4ED21000-memory.dmp

                Filesize

                10.8MB

              • memory/4392-29-0x0000020269180000-0x0000020269190000-memory.dmp

                Filesize

                64KB

              • memory/4392-28-0x0000020269180000-0x0000020269190000-memory.dmp

                Filesize

                64KB

              • memory/4392-27-0x00007FFD4E260000-0x00007FFD4ED21000-memory.dmp

                Filesize

                10.8MB

              • memory/4652-61-0x0000000000400000-0x0000000000478000-memory.dmp

                Filesize

                480KB

              • memory/4652-67-0x0000000000400000-0x0000000000478000-memory.dmp

                Filesize

                480KB

              • memory/4652-64-0x0000000000400000-0x0000000000478000-memory.dmp

                Filesize

                480KB

              • memory/4652-84-0x0000000000400000-0x0000000000478000-memory.dmp

                Filesize

                480KB