Overview

overview

10

Static

static

1

'.exe

windows7-x64

3

'.exe

windows10-2004-x64

3

IMGES3.vbs

windows7-x64

8

IMGES3.vbs

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    IMGES3_Mia_kjhaleifa_JPG.zip
  • Size 5.1MB
  • Sample240331-bs6xmsbc6w
  • SHA256 d67ec67aea3e158c8a167d39329491e56e6fdeb5f52c941767624287d5cf6128
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
asyncratremcosxenoratauscadaaaa222newsssniceeeeeeeeeeeeeepersistencerattrojan

Malware Config

Extracted

Family

  • asyncrat

Version

  • 1.0.7

Botnet

  • CAdaaaa222

C2

  • 141.95.84.40:6262

Mutex

  • qw123123ecasdzcxqwe

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

  • remcos

Botnet

  • Newsss

C2

  • 141.95.84.40:4090

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    awcvvwvvwa-MZS2PC

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Family

  • remcos

Botnet

  • NICEEEEEEEEEEEEEE

C2

  • 141.95.84.40:3939

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    acwaw2-S0GXDB

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Family

  • xenorat

C2

  • 141.95.84.40

Mutex

  • asasasasa_nd891332d

Attributes
  • delay

    5000

  • install_path

    nothingset

  • port

    4444

  • startup_name

    nothingset

Extracted

Family

  • remcos

Botnet

  • AUS

C2

  • 141.95.84.40:3636

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    asasasasasadtssrsar-SCM43H

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target
      '
    • Size 5.1MB
    • SHA256 45126297c07c6ef56b51440cd0dc30acf7b3b938e2e9e656334886fe2f81f220
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral1behavioral2
    • Target
      IMGES3.vbs
    • Size 111KB
    • SHA256 84173441b7c16b960ee4e1532ae137955c12d0250696694405683a52e36920e6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    asyncratremcosxenoratauscadaaaa222newsssniceeeeeeeeeeeeeepersistencerattrojan

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • XenorRat

      XenorRat is a remote access trojan written in C#.

      trojanratxenorat

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • Suspicious use of SetThreadContext

    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks