Analysis

  • max time kernel
    148s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05-04-2024 11:41

General

  • Target

    TSTS 0005A.exe

  • Size

    922KB

  • MD5

    b195643d6d8c3f81c7409533ad14726c

  • SHA1

    c09b56928fb1f448ed9b3610a0b930f77e2ebcfe

  • SHA256

    f4eaa74eb268a58cff6f5d37607758bd49cc00af060da799857ae10cfd59efb2

  • SHA512

    b843153f581be5a77b8575cf09e25333d5eaf5af3b689441ad0af336c4494a6181d5882dfa8b2ba2d90acb64cd3db9ab26f1cf87e1991f996d26cbb6990c5fb8

  • SSDEEP

    24576:JgjHr6DLW5Gaxs00MUVXdtS6seDmw+Op8lCua51:WrpDxclG65mg8lCuo

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

sembe.duckdns.org:14645

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    notess

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Rmc-P0AEMX

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe
    "C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2276
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vcEDbAjawlTHE.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1980
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vcEDbAjawlTHE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp48A4.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2656
    • C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe
      "C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:2784

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp48A4.tmp

    Filesize

    1KB

    MD5

    b0dbfda50a11ba2f398c2de3049cddab

    SHA1

    4c7ec19e990cefcf6182c3c9580ed70dac7ec655

    SHA256

    ce16e075234483ce823675820b1544d16148e4340e852a1b049df30dfd51a995

    SHA512

    fcf7d79e2bedc6d05bc1548d36d5a1c67c094e4c71d6e8c1a211e011e95969f1ddd0b7d6b6e7781735507c00832684bb4d3f1faffde66ab1188cf0defde74075

  • C:\Users\Admin\AppData\Roaming\notess\logs.dat

    Filesize

    144B

    MD5

    8d35c03abb01c9c58fd94dd704e98326

    SHA1

    c53104898af6d9cd4c7906004e6aaef533a1c0b8

    SHA256

    37df8bcee1574b291aab1e384ceb719d07bd7a70cc781904a33bf365db17569b

    SHA512

    0e7bb997411a9f64f283ec4b7a0d793e09a5f38da3d5e4ba7a6c8e954b053bf208925b5ded8f8e9fe0872bd27e8e231c6e075195ab5435cac1759adfc892876c

  • memory/1980-39-0x0000000001D20000-0x0000000001D60000-memory.dmp

    Filesize

    256KB

  • memory/1980-42-0x000000006E880000-0x000000006EE2B000-memory.dmp

    Filesize

    5.7MB

  • memory/1980-38-0x0000000001D20000-0x0000000001D60000-memory.dmp

    Filesize

    256KB

  • memory/1980-36-0x0000000001D20000-0x0000000001D60000-memory.dmp

    Filesize

    256KB

  • memory/1980-34-0x000000006E880000-0x000000006EE2B000-memory.dmp

    Filesize

    5.7MB

  • memory/2276-3-0x00000000002A0000-0x00000000002B0000-memory.dmp

    Filesize

    64KB

  • memory/2276-4-0x0000000000420000-0x000000000042C000-memory.dmp

    Filesize

    48KB

  • memory/2276-5-0x00000000054D0000-0x0000000005590000-memory.dmp

    Filesize

    768KB

  • memory/2276-2-0x0000000004340000-0x0000000004380000-memory.dmp

    Filesize

    256KB

  • memory/2276-1-0x00000000742A0000-0x000000007498E000-memory.dmp

    Filesize

    6.9MB

  • memory/2276-31-0x00000000742A0000-0x000000007498E000-memory.dmp

    Filesize

    6.9MB

  • memory/2276-0-0x00000000002C0000-0x00000000003A8000-memory.dmp

    Filesize

    928KB

  • memory/2784-18-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2784-15-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2784-29-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2784-26-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2784-32-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2784-24-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2784-22-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2784-20-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2784-37-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2784-40-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2784-17-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2784-33-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2784-41-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2784-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2784-43-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2784-44-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2784-45-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2784-13-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2784-53-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2784-54-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2784-55-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2784-62-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2784-70-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2784-71-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2784-78-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2784-79-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB