Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/03/2024, 02:12

General

  • Target

    4d02ef98d7fec3d3e752706c11c9a57130dba4b03022f85e12e7214fc92622bc.exe

  • Size

    1.0MB

  • MD5

    5dc4dfdc43b27b8e1664f4ba3c11cb08

  • SHA1

    b8650b9e3d5d0e054c7decffffaf06cb83b18ad4

  • SHA256

    4d02ef98d7fec3d3e752706c11c9a57130dba4b03022f85e12e7214fc92622bc

  • SHA512

    da2d4beef33a526519e5ef823a27df8c2fc83895778098162629dd635bd9bee846f0acc471ae62cc6b597f333f0c6b3bbd0234da3bb2cf52d75681d31dbb5fd0

  • SSDEEP

    24576:+PF6DSSEvVi8ds05OTOfYIOBRaR6URr0GDp6ezPEM:+PazuAOfh4RaR6URrNph

Malware Config

Extracted

Family

remcos

Botnet

JONS

C2

172.245.208.13:4445

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-R7QS5C

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 30 IoCs
  • Detects executables built or packed with MPress PE compressor 18 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 2 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 2 IoCs
  • ModiLoader Second Stage 1 IoCs
  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 7 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4d02ef98d7fec3d3e752706c11c9a57130dba4b03022f85e12e7214fc92622bc.exe
    "C:\Users\Admin\AppData\Local\Temp\4d02ef98d7fec3d3e752706c11c9a57130dba4b03022f85e12e7214fc92622bc.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4476
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c mkdir "\\?\C:\Windows "
      2⤵
        PID:5100
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c mkdir "\\?\C:\Windows \System32"
        2⤵
          PID:2332
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c "C:\Windows \System32\2082190.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1208
          • C:\Windows \System32\2082190.exe
            "C:\Windows \System32\2082190.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:4680
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:856
              • C:\Windows\system32\cmd.exe
                cmd /c powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:1792
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
                  6⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4440
        • C:\Windows\SysWOW64\extrac32.exe
          C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\AppData\Local\Temp\4d02ef98d7fec3d3e752706c11c9a57130dba4b03022f85e12e7214fc92622bc.exe C:\\Users\\Public\\Libraries\\Kqcgoosp.PIF
          2⤵
            PID:2352
          • C:\Users\Public\Libraries\psoogcqK.pif
            C:\Users\Public\Libraries\psoogcqK.pif
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2056
            • C:\Users\Public\Libraries\psoogcqK.pif
              C:\Users\Public\Libraries\psoogcqK.pif /stext "C:\Users\Admin\AppData\Local\Temp\ovkapolcqahybbbzmcjxxvrqa"
              3⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:4632
            • C:\Users\Public\Libraries\psoogcqK.pif
              C:\Users\Public\Libraries\psoogcqK.pif /stext "C:\Users\Admin\AppData\Local\Temp\qxplqgvedizdmhyddnwzaamzjrzll"
              3⤵
              • Executes dropped EXE
              • Accesses Microsoft Outlook accounts
              PID:3192
            • C:\Users\Public\Libraries\psoogcqK.pif
              C:\Users\Public\Libraries\psoogcqK.pif /stext "C:\Users\Admin\AppData\Local\Temp\arvdrzgyrqriovmhmxrslngqjxqumvhw"
              3⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2600

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\ProgramData\remcos\logs.dat

                Filesize

                144B

                MD5

                a7907a88c92139ecdc62cdeb57e68558

                SHA1

                5b305db84849a6b1e1600b84992b26d6425a8dda

                SHA256

                8f87bf8f33834081d1688d190396b5eb05fe663e29515f3a664def5d22cb8ce2

                SHA512

                8a7eb60ae613d11acee6624636d406a1a648497c3b90175929f874ba8800b44638be50716eda515731954a7ad5dbd705bf8a4b032d744553b9c318f296845fbb

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hauep5su.lkq.ps1

                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              • C:\Users\Admin\AppData\Local\Temp\ovkapolcqahybbbzmcjxxvrqa

                Filesize

                4KB

                MD5

                794bf931212af3178e85954ea35f687a

                SHA1

                e78eb5300a58c85256b08135673b991f8dfce664

                SHA256

                49911477803d5cea085304ff6af24310412e31d37b88ac30d5cbd890c98d5619

                SHA512

                4a1d63034421b56d8968da94049b83ed1a78f832d8fb92664e3dd5240531be8a277163a1c4ddefeafb18651e2cf8219adbdb82763d8b5c695e8ed8ce8250d6df

              • C:\Users\Public\Libraries\psoogcqK.pif

                Filesize

                66KB

                MD5

                c116d3604ceafe7057d77ff27552c215

                SHA1

                452b14432fb5758b46f2897aeccd89f7c82a727d

                SHA256

                7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301

                SHA512

                9202a00eeaf4c5be94de32fd41bfea40fc32d368955d49b7bad2b5c23c4ebc92dccb37d99f5a14e53ad674b63f1baa6efb1feb27225c86693ead3262a26d66c6

              • C:\Windows \System32\2082190.exe

                Filesize

                128KB

                MD5

                231ce1e1d7d98b44371ffff407d68b59

                SHA1

                25510d0f6353dbf0c9f72fc880de7585e34b28ff

                SHA256

                30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

                SHA512

                520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

              • C:\Windows \System32\netutils.dll

                Filesize

                112KB

                MD5

                fa7aa88417d0c48807144a1a48fe3fbc

                SHA1

                6f5ec990b12d4a6075050a94e0d68d03781fa46d

                SHA256

                2019dcd18ba7d5554a4a9da882740aa883941670af3de9396960081a0f8aa098

                SHA512

                99b2eb6f8e7d00a3803cba229149e5e0cb67a3deb607782c55fbacd25d9c074cce83759de15490eff939d5ad98f26cdbd44395cc79ffe22753e16c3d9e3b5fff

              • C:\windows \system32\KDECO.bat

                Filesize

                11KB

                MD5

                c545650595b479c81ad6b9d8882aae39

                SHA1

                7a98aa2e6eee23b3c1bba876955d525bc618b3f0

                SHA256

                a3a80983cb33159f0455fa0135789402558baa1460db94d0071318512b8cb5f9

                SHA512

                85ac596a7da9072a28c4178e4fdedc98f1b49c8e3fe5612cfe464833297b13f65d2dc59b52d7fc9970cff8f98d954111229aec0ed9dded454e03b0cf4ebb6ff3

              • memory/2056-100-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/2056-103-0x0000000000400000-0x0000000000482000-memory.dmp

                Filesize

                520KB

              • memory/2056-137-0x0000000000400000-0x0000000000482000-memory.dmp

                Filesize

                520KB

              • memory/2056-135-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/2056-134-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/2056-131-0x0000000000400000-0x0000000000482000-memory.dmp

                Filesize

                520KB

              • memory/2056-128-0x0000000000400000-0x0000000000482000-memory.dmp

                Filesize

                520KB

              • memory/2056-126-0x0000000000400000-0x0000000000482000-memory.dmp

                Filesize

                520KB

              • memory/2056-124-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/2056-123-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/2056-43-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/2056-46-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/2056-48-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/2056-50-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/2056-51-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/2056-53-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/2056-54-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/2056-55-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/2056-56-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/2056-57-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/2056-59-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/2056-61-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/2056-120-0x0000000000400000-0x0000000000482000-memory.dmp

                Filesize

                520KB

              • memory/2056-117-0x0000000000400000-0x0000000000482000-memory.dmp

                Filesize

                520KB

              • memory/2056-115-0x0000000000400000-0x0000000000482000-memory.dmp

                Filesize

                520KB

              • memory/2056-112-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/2056-110-0x0000000000400000-0x0000000000482000-memory.dmp

                Filesize

                520KB

              • memory/2056-108-0x0000000026580000-0x0000000026599000-memory.dmp

                Filesize

                100KB

              • memory/2056-106-0x0000000000400000-0x0000000000482000-memory.dmp

                Filesize

                520KB

              • memory/2056-98-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/2056-101-0x0000000000400000-0x0000000001400000-memory.dmp

                Filesize

                16.0MB

              • memory/2056-97-0x0000000026580000-0x0000000026599000-memory.dmp

                Filesize

                100KB

              • memory/2056-96-0x0000000026580000-0x0000000026599000-memory.dmp

                Filesize

                100KB

              • memory/2056-95-0x0000000026580000-0x0000000026599000-memory.dmp

                Filesize

                100KB

              • memory/2056-91-0x0000000026580000-0x0000000026599000-memory.dmp

                Filesize

                100KB

              • memory/2600-75-0x0000000000400000-0x0000000000424000-memory.dmp

                Filesize

                144KB

              • memory/2600-80-0x0000000000400000-0x0000000000424000-memory.dmp

                Filesize

                144KB

              • memory/2600-71-0x0000000000400000-0x0000000000424000-memory.dmp

                Filesize

                144KB

              • memory/2600-83-0x0000000000400000-0x0000000000424000-memory.dmp

                Filesize

                144KB

              • memory/2600-84-0x0000000000400000-0x0000000000424000-memory.dmp

                Filesize

                144KB

              • memory/3192-72-0x0000000000400000-0x0000000000462000-memory.dmp

                Filesize

                392KB

              • memory/3192-65-0x0000000000400000-0x0000000000462000-memory.dmp

                Filesize

                392KB

              • memory/3192-81-0x0000000000400000-0x0000000000462000-memory.dmp

                Filesize

                392KB

              • memory/3192-82-0x0000000000400000-0x0000000000462000-memory.dmp

                Filesize

                392KB

              • memory/4440-22-0x000002C06BAB0000-0x000002C06BAD2000-memory.dmp

                Filesize

                136KB

              • memory/4440-27-0x00007FFD7DD90000-0x00007FFD7E851000-memory.dmp

                Filesize

                10.8MB

              • memory/4440-28-0x000002C06B180000-0x000002C06B190000-memory.dmp

                Filesize

                64KB

              • memory/4440-30-0x000002C06B180000-0x000002C06B190000-memory.dmp

                Filesize

                64KB

              • memory/4440-29-0x000002C06B180000-0x000002C06B190000-memory.dmp

                Filesize

                64KB

              • memory/4440-33-0x00007FFD7DD90000-0x00007FFD7E851000-memory.dmp

                Filesize

                10.8MB

              • memory/4476-0-0x0000000000840000-0x0000000000841000-memory.dmp

                Filesize

                4KB

              • memory/4476-35-0x0000000000840000-0x0000000000841000-memory.dmp

                Filesize

                4KB

              • memory/4476-4-0x0000000000400000-0x000000000050F000-memory.dmp

                Filesize

                1.1MB

              • memory/4476-1-0x0000000004050000-0x0000000005050000-memory.dmp

                Filesize

                16.0MB

              • memory/4476-2-0x0000000004050000-0x0000000005050000-memory.dmp

                Filesize

                16.0MB

              • memory/4632-62-0x0000000000400000-0x0000000000478000-memory.dmp

                Filesize

                480KB

              • memory/4632-66-0x0000000000400000-0x0000000000478000-memory.dmp

                Filesize

                480KB

              • memory/4632-88-0x0000000000400000-0x0000000000478000-memory.dmp

                Filesize

                480KB

              • memory/4632-70-0x0000000000400000-0x0000000000478000-memory.dmp

                Filesize

                480KB

              • memory/4680-15-0x00000000613C0000-0x00000000613E3000-memory.dmp

                Filesize

                140KB