Analysis

  • max time kernel
    136s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05-04-2024 01:14

General

  • Target

    a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe

  • Size

    1.6MB

  • MD5

    4e1e0180c5e140946d7970f64e644ac1

  • SHA1

    e5f939a05d817a4b56ef7ec74788ad9ce3b8cb27

  • SHA256

    a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd

  • SHA512

    f50883d44f5ccdccb9adf9cb6cc3f6c9d6947e9b0f85d7727af151424e54d1f041d3bb6238dd29f27c47ebed20ae7e74187d31b67fd285cc1aa7d28e66204954

  • SSDEEP

    49152:ay6imwGhfj4GBT2z95Zw/L+gwnz1nwyuPTh:azimw4f8iSuD+g

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

127.0.0.1:44999

127.0.0.1:54991

africarem.duckdns.org:54991

africarem.duckdns.org:44999

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-R571U4

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • ModiLoader Second Stage 1 IoCs
  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 6 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe
    "C:\Users\Admin\AppData\Local\Temp\a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1908
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c mkdir "\\?\C:\Windows "
      2⤵
        PID:2932
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c mkdir "\\?\C:\Windows \System32"
        2⤵
          PID:2564
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c "C:\Windows \System32\5171742.exe"
          2⤵
            PID:2548
            • C:\Windows \System32\5171742.exe
              "C:\Windows \System32\5171742.exe"
              3⤵
              • Executes dropped EXE
              PID:2884
            • C:\Windows \System32\5171742.exe
              "C:\Windows \System32\5171742.exe"
              3⤵
              • Executes dropped EXE
              PID:2728
          • C:\Windows\SysWOW64\extrac32.exe
            C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\AppData\Local\Temp\a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe C:\\Users\\Public\\Libraries\\Hmzvinyr.PIF
            2⤵
              PID:1588
            • C:\Users\Admin\AppData\Local\Temp\a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe
              C:\Users\Admin\AppData\Local\Temp\a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe /stext "C:\Users\Admin\AppData\Local\Temp\jmoyzvgglcwzrcnivkdjbsbqchveszuz"
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:1316
            • C:\Users\Admin\AppData\Local\Temp\a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe
              C:\Users\Admin\AppData\Local\Temp\a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe /stext "C:\Users\Admin\AppData\Local\Temp\tpcj"
              2⤵
              • Accesses Microsoft Outlook accounts
              PID:1048
            • C:\Users\Admin\AppData\Local\Temp\a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe
              C:\Users\Admin\AppData\Local\Temp\a108ae8bd69ac84bc8dd5fa7bdbb6eff9cd65a70c16567e0f36dae1f15d090fd.exe /stext "C:\Users\Admin\AppData\Local\Temp\djhbagj"
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1528

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

            Filesize

            68KB

            MD5

            29f65ba8e88c063813cc50a4ea544e93

            SHA1

            05a7040d5c127e68c25d81cc51271ffb8bef3568

            SHA256

            1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

            SHA512

            e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

          • C:\Users\Admin\AppData\Local\Temp\Tar7BEB.tmp

            Filesize

            177KB

            MD5

            435a9ac180383f9fa094131b173a2f7b

            SHA1

            76944ea657a9db94f9a4bef38f88c46ed4166983

            SHA256

            67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

            SHA512

            1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

          • C:\Users\Admin\AppData\Local\Temp\jmoyzvgglcwzrcnivkdjbsbqchveszuz

            Filesize

            2B

            MD5

            f3b25701fe362ec84616a93a45ce9998

            SHA1

            d62636d8caec13f04e28442a0a6fa1afeb024bbb

            SHA256

            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

            SHA512

            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

          • C:\Windows \System32\5171742.exe

            Filesize

            128KB

            MD5

            231ce1e1d7d98b44371ffff407d68b59

            SHA1

            25510d0f6353dbf0c9f72fc880de7585e34b28ff

            SHA256

            30951db8bfc21640645aa9144cfeaa294bb7c6980ef236d28552b6f4f3f92a96

            SHA512

            520887b01bda96b7c4f91b9330a5c03a12f7c7f266d4359432e7bacc76b0eef377c05a4361f8fa80ad0b94b5865699d747a5d94a2d3dcdb85dabf5887bb6c612

          • memory/1048-118-0x0000000000400000-0x0000000000462000-memory.dmp

            Filesize

            392KB

          • memory/1048-96-0x0000000000400000-0x0000000000462000-memory.dmp

            Filesize

            392KB

          • memory/1048-101-0x0000000000400000-0x0000000000462000-memory.dmp

            Filesize

            392KB

          • memory/1048-105-0x0000000000400000-0x0000000000462000-memory.dmp

            Filesize

            392KB

          • memory/1316-106-0x0000000000400000-0x0000000000478000-memory.dmp

            Filesize

            480KB

          • memory/1316-114-0x0000000000400000-0x0000000000478000-memory.dmp

            Filesize

            480KB

          • memory/1316-95-0x0000000000400000-0x0000000000478000-memory.dmp

            Filesize

            480KB

          • memory/1316-102-0x0000000000400000-0x0000000000478000-memory.dmp

            Filesize

            480KB

          • memory/1528-108-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/1528-103-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/1528-99-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/1528-109-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/1908-85-0x00000000158B0000-0x00000000168B0000-memory.dmp

            Filesize

            16.0MB

          • memory/1908-1-0x0000000002EA0000-0x0000000003EA0000-memory.dmp

            Filesize

            16.0MB

          • memory/1908-94-0x00000000158B0000-0x00000000168B0000-memory.dmp

            Filesize

            16.0MB

          • memory/1908-91-0x00000000158B0000-0x00000000168B0000-memory.dmp

            Filesize

            16.0MB

          • memory/1908-90-0x00000000158B0000-0x00000000168B0000-memory.dmp

            Filesize

            16.0MB

          • memory/1908-89-0x00000000158B0000-0x00000000168B0000-memory.dmp

            Filesize

            16.0MB

          • memory/1908-88-0x00000000158B0000-0x00000000168B0000-memory.dmp

            Filesize

            16.0MB

          • memory/1908-87-0x00000000158B0000-0x00000000168B0000-memory.dmp

            Filesize

            16.0MB

          • memory/1908-0-0x0000000000220000-0x0000000000221000-memory.dmp

            Filesize

            4KB

          • memory/1908-84-0x00000000158B0000-0x00000000168B0000-memory.dmp

            Filesize

            16.0MB

          • memory/1908-83-0x00000000158B0000-0x00000000168B0000-memory.dmp

            Filesize

            16.0MB

          • memory/1908-144-0x00000000158B0000-0x00000000168B0000-memory.dmp

            Filesize

            16.0MB

          • memory/1908-5-0x0000000000400000-0x00000000005AF000-memory.dmp

            Filesize

            1.7MB

          • memory/1908-4-0x0000000000220000-0x0000000000221000-memory.dmp

            Filesize

            4KB

          • memory/1908-2-0x0000000002EA0000-0x0000000003EA0000-memory.dmp

            Filesize

            16.0MB

          • memory/1908-92-0x00000000158B0000-0x00000000168B0000-memory.dmp

            Filesize

            16.0MB

          • memory/1908-120-0x0000000014880000-0x0000000014899000-memory.dmp

            Filesize

            100KB

          • memory/1908-123-0x0000000014880000-0x0000000014899000-memory.dmp

            Filesize

            100KB

          • memory/1908-125-0x0000000014880000-0x0000000014899000-memory.dmp

            Filesize

            100KB

          • memory/1908-124-0x0000000014880000-0x0000000014899000-memory.dmp

            Filesize

            100KB

          • memory/1908-126-0x0000000014880000-0x0000000014899000-memory.dmp

            Filesize

            100KB

          • memory/1908-127-0x00000000158B0000-0x00000000168B0000-memory.dmp

            Filesize

            16.0MB

          • memory/1908-128-0x00000000158B0000-0x00000000168B0000-memory.dmp

            Filesize

            16.0MB

          • memory/1908-129-0x00000000158B0000-0x00000000168B0000-memory.dmp

            Filesize

            16.0MB

          • memory/1908-131-0x0000000014880000-0x0000000014899000-memory.dmp

            Filesize

            100KB

          • memory/1908-134-0x00000000158B0000-0x00000000168B0000-memory.dmp

            Filesize

            16.0MB

          • memory/1908-139-0x00000000158B0000-0x00000000168B0000-memory.dmp

            Filesize

            16.0MB

          • memory/1908-140-0x00000000158B0000-0x00000000168B0000-memory.dmp

            Filesize

            16.0MB

          • memory/1908-143-0x00000000158B0000-0x00000000168B0000-memory.dmp

            Filesize

            16.0MB

          • memory/2548-67-0x0000000002210000-0x0000000002211000-memory.dmp

            Filesize

            4KB