Analysis

  • max time kernel
    157s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-04-2024 09:58

General

  • Target

    TSTS 0005A.exe

  • Size

    922KB

  • MD5

    b195643d6d8c3f81c7409533ad14726c

  • SHA1

    c09b56928fb1f448ed9b3610a0b930f77e2ebcfe

  • SHA256

    f4eaa74eb268a58cff6f5d37607758bd49cc00af060da799857ae10cfd59efb2

  • SHA512

    b843153f581be5a77b8575cf09e25333d5eaf5af3b689441ad0af336c4494a6181d5882dfa8b2ba2d90acb64cd3db9ab26f1cf87e1991f996d26cbb6990c5fb8

  • SSDEEP

    24576:JgjHr6DLW5Gaxs00MUVXdtS6seDmw+Op8lCua51:WrpDxclG65mg8lCuo

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

sembe.duckdns.org:14645

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    notess

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Rmc-P0AEMX

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe
    "C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3492
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vcEDbAjawlTHE.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2056
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vcEDbAjawlTHE" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF6A4.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:4688
    • C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe
      "C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"
      2⤵
        PID:1016
      • C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe
        "C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"
        2⤵
        • Suspicious use of SetWindowsHookEx
        PID:3812

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hmo2wrkp.h20.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\tmpF6A4.tmp

      Filesize

      1KB

      MD5

      b20c06883107d63b685d3c8db54f8130

      SHA1

      a02d767b8cdc3f6035a1435e50afd9f5177efc3f

      SHA256

      c76e0d7649b4b824719a9fec959c6d8044cac6b521ebdaea4f4b7eaa1562bed6

      SHA512

      6f16c83537e5fbc273a304a2d0f03b2cdcbff184f5168f7b884f9b9669b026b308fdc33b9af4f9c85e6d5d226d89c8bd8d6d2857417aca8249f1c3cf9b4cb510

    • C:\Users\Admin\AppData\Roaming\notess\logs.dat

      Filesize

      144B

      MD5

      a715fe5fe9ddec241ac1106b2bf75ea5

      SHA1

      3a366df86ff827857d3c56e642120bf6b26605cd

      SHA256

      6b47caa2c7f8ac8d5373469bd4c6d6005a85f7630c1dee886c995b869687dbe8

      SHA512

      8577ee0183514920d243a1f8ba402665148dc3024c341deaca0e9294930626a73230b628a017ee1a5b96591ef0e71766e28f717da18bf4923f2ab5a9725e05cd

    • memory/2056-44-0x0000000005D90000-0x00000000060E4000-memory.dmp

      Filesize

      3.3MB

    • memory/2056-73-0x0000000007790000-0x00000000077A1000-memory.dmp

      Filesize

      68KB

    • memory/2056-67-0x00000000067C0000-0x00000000067DE000-memory.dmp

      Filesize

      120KB

    • memory/2056-57-0x0000000071070000-0x00000000710BC000-memory.dmp

      Filesize

      304KB

    • memory/2056-46-0x0000000006210000-0x000000000622E000-memory.dmp

      Filesize

      120KB

    • memory/2056-56-0x0000000006860000-0x0000000006892000-memory.dmp

      Filesize

      200KB

    • memory/2056-55-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

      Filesize

      64KB

    • memory/2056-69-0x0000000007BD0000-0x000000000824A000-memory.dmp

      Filesize

      6.5MB

    • memory/2056-70-0x0000000007590000-0x00000000075AA000-memory.dmp

      Filesize

      104KB

    • memory/2056-71-0x0000000007600000-0x000000000760A000-memory.dmp

      Filesize

      40KB

    • memory/2056-47-0x00000000067F0000-0x000000000683C000-memory.dmp

      Filesize

      304KB

    • memory/2056-72-0x0000000007810000-0x00000000078A6000-memory.dmp

      Filesize

      600KB

    • memory/2056-68-0x0000000007280000-0x0000000007323000-memory.dmp

      Filesize

      652KB

    • memory/2056-18-0x0000000074BD0000-0x0000000075380000-memory.dmp

      Filesize

      7.7MB

    • memory/2056-20-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

      Filesize

      64KB

    • memory/2056-21-0x0000000005400000-0x0000000005A28000-memory.dmp

      Filesize

      6.2MB

    • memory/2056-16-0x0000000004C90000-0x0000000004CC6000-memory.dmp

      Filesize

      216KB

    • memory/2056-80-0x0000000074BD0000-0x0000000075380000-memory.dmp

      Filesize

      7.7MB

    • memory/2056-77-0x00000000078B0000-0x00000000078B8000-memory.dmp

      Filesize

      32KB

    • memory/2056-76-0x00000000078D0000-0x00000000078EA000-memory.dmp

      Filesize

      104KB

    • memory/2056-30-0x0000000005AE0000-0x0000000005B02000-memory.dmp

      Filesize

      136KB

    • memory/2056-75-0x00000000077D0000-0x00000000077E4000-memory.dmp

      Filesize

      80KB

    • memory/2056-19-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

      Filesize

      64KB

    • memory/2056-37-0x0000000005B80000-0x0000000005BE6000-memory.dmp

      Filesize

      408KB

    • memory/2056-74-0x00000000077C0000-0x00000000077CE000-memory.dmp

      Filesize

      56KB

    • memory/2056-39-0x0000000005BF0000-0x0000000005C56000-memory.dmp

      Filesize

      408KB

    • memory/3492-7-0x0000000006C40000-0x0000000006C4C000-memory.dmp

      Filesize

      48KB

    • memory/3492-14-0x00000000059D0000-0x00000000059E0000-memory.dmp

      Filesize

      64KB

    • memory/3492-13-0x0000000074BD0000-0x0000000075380000-memory.dmp

      Filesize

      7.7MB

    • memory/3492-2-0x0000000005F00000-0x00000000064A4000-memory.dmp

      Filesize

      5.6MB

    • memory/3492-9-0x00000000097B0000-0x000000000984C000-memory.dmp

      Filesize

      624KB

    • memory/3492-8-0x0000000007110000-0x00000000071D0000-memory.dmp

      Filesize

      768KB

    • memory/3492-26-0x0000000074BD0000-0x0000000075380000-memory.dmp

      Filesize

      7.7MB

    • memory/3492-6-0x0000000006C20000-0x0000000006C30000-memory.dmp

      Filesize

      64KB

    • memory/3492-5-0x00000000059C0000-0x00000000059CA000-memory.dmp

      Filesize

      40KB

    • memory/3492-4-0x00000000059D0000-0x00000000059E0000-memory.dmp

      Filesize

      64KB

    • memory/3492-3-0x00000000059F0000-0x0000000005A82000-memory.dmp

      Filesize

      584KB

    • memory/3492-1-0x0000000000EC0000-0x0000000000FA8000-memory.dmp

      Filesize

      928KB

    • memory/3492-0-0x0000000074BD0000-0x0000000075380000-memory.dmp

      Filesize

      7.7MB

    • memory/3812-22-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3812-52-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3812-50-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3812-49-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3812-48-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3812-103-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3812-38-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3812-31-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3812-28-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3812-27-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3812-25-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3812-23-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3812-84-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3812-86-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3812-87-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3812-94-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3812-95-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3812-102-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3812-45-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3812-109-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3812-110-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB