Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    04-04-2024 07:01

General

  • Target

    Ref [HSBC Ref# H240322-X793Y2] Transaction_Confirmation_2024.exe

  • Size

    961KB

  • MD5

    73d358a6b2ad4ced8a885895e0c12dba

  • SHA1

    5dfb45244f148645ac66417bddc76cd4bb441e89

  • SHA256

    74a07ee3f0060987ebcb09e588ac1299a9d2a19e2f4139385f7880c229e2c8cf

  • SHA512

    e59e9b877001c22a3fe0990b8b3a9daba8567d4db456f56e00d8bb170dddd1462d29c839832825ddbef5edcbf082a9fe04b060c7a55b8930b5f9b9689fb5e7a6

  • SSDEEP

    24576:24FOzdtX2DtZzBRPOoY34+t5EEtG6XuRvyMnllW:Ted2DtZlRmoe4seEtBXuRvyU

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

91.92.253.150:2505

stefracino.store:2505

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    seefus

  • mouse_option

    false

  • mutex

    Rmc-WJ9LCC

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ref [HSBC Ref# H240322-X793Y2] Transaction_Confirmation_2024.exe
    "C:\Users\Admin\AppData\Local\Temp\Ref [HSBC Ref# H240322-X793Y2] Transaction_Confirmation_2024.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1636
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Ref [HSBC Ref# H240322-X793Y2] Transaction_Confirmation_2024.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2572
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GzaqkFxrVt.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2480
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GzaqkFxrVt" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3A52.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2812
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
        PID:2672

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp3A52.tmp

      Filesize

      1KB

      MD5

      ec52ec854b096e0815303da20440aee1

      SHA1

      1d49ed71b2c2fc21e0eb7282c5b0d06dc5c70137

      SHA256

      c13cab905be16d0238b13c305e89302005e7dae563d70f68996bee554e5be011

      SHA512

      7c20219adc7135402d521c5c2bec8312c4760aa6849a161acbebeb397a4e7fa793a26fbdbf12be991065469225e06025dd44cde7fd34f7a836d95a6d7667b9e9

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0PRQFEK8HBLZTC0TQCX7.temp

      Filesize

      7KB

      MD5

      4fb8806c7400da869dc36a4320094df9

      SHA1

      362d0e858a319510ce8646e9b563242ee227b4a2

      SHA256

      4a2ba7bfcce527d2a6cd6359874f319af5ee3fb12be5a7f9553b3b2b3a257d4d

      SHA512

      7bb66d362c82f7557a89bfabbc62bad1639b328e25084e6eb96717c1678f1fed43ad138bfe4505174a1a285d23ccaa890c869a0be42e581ed0ecf5769ead9f20

    • memory/1636-3-0x0000000000400000-0x0000000000410000-memory.dmp

      Filesize

      64KB

    • memory/1636-4-0x00000000005C0000-0x00000000005CC000-memory.dmp

      Filesize

      48KB

    • memory/1636-5-0x0000000005D40000-0x0000000005E00000-memory.dmp

      Filesize

      768KB

    • memory/1636-2-0x00000000003C0000-0x0000000000400000-memory.dmp

      Filesize

      256KB

    • memory/1636-1-0x0000000074920000-0x000000007500E000-memory.dmp

      Filesize

      6.9MB

    • memory/1636-47-0x0000000074920000-0x000000007500E000-memory.dmp

      Filesize

      6.9MB

    • memory/1636-0-0x0000000001290000-0x0000000001384000-memory.dmp

      Filesize

      976KB

    • memory/2480-31-0x0000000001E30000-0x0000000001E70000-memory.dmp

      Filesize

      256KB

    • memory/2480-49-0x000000006E3F0000-0x000000006E99B000-memory.dmp

      Filesize

      5.7MB

    • memory/2480-33-0x0000000001E30000-0x0000000001E70000-memory.dmp

      Filesize

      256KB

    • memory/2480-23-0x000000006E3F0000-0x000000006E99B000-memory.dmp

      Filesize

      5.7MB

    • memory/2480-25-0x0000000001E30000-0x0000000001E70000-memory.dmp

      Filesize

      256KB

    • memory/2480-27-0x000000006E3F0000-0x000000006E99B000-memory.dmp

      Filesize

      5.7MB

    • memory/2572-29-0x0000000002860000-0x00000000028A0000-memory.dmp

      Filesize

      256KB

    • memory/2572-39-0x000000006E3F0000-0x000000006E99B000-memory.dmp

      Filesize

      5.7MB

    • memory/2572-35-0x0000000002860000-0x00000000028A0000-memory.dmp

      Filesize

      256KB

    • memory/2572-37-0x0000000002860000-0x00000000028A0000-memory.dmp

      Filesize

      256KB

    • memory/2572-19-0x000000006E3F0000-0x000000006E99B000-memory.dmp

      Filesize

      5.7MB

    • memory/2572-48-0x000000006E3F0000-0x000000006E99B000-memory.dmp

      Filesize

      5.7MB

    • memory/2672-24-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2672-21-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2672-28-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2672-40-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2672-42-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2672-44-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

      Filesize

      4KB

    • memory/2672-45-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2672-18-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2672-32-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2672-36-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB