Analysis

  • max time kernel
    148s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-04-2024 11:41

General

  • Target

    TSTS 0005A.exe

  • Size

    922KB

  • MD5

    b195643d6d8c3f81c7409533ad14726c

  • SHA1

    c09b56928fb1f448ed9b3610a0b930f77e2ebcfe

  • SHA256

    f4eaa74eb268a58cff6f5d37607758bd49cc00af060da799857ae10cfd59efb2

  • SHA512

    b843153f581be5a77b8575cf09e25333d5eaf5af3b689441ad0af336c4494a6181d5882dfa8b2ba2d90acb64cd3db9ab26f1cf87e1991f996d26cbb6990c5fb8

  • SSDEEP

    24576:JgjHr6DLW5Gaxs00MUVXdtS6seDmw+Op8lCua51:WrpDxclG65mg8lCuo

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

sembe.duckdns.org:14645

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    notess

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Rmc-P0AEMX

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe
    "C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3168
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vcEDbAjawlTHE.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3520
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vcEDbAjawlTHE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6D12.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3068
    • C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe
      "C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"
      2⤵
        PID:404
      • C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe
        "C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"
        2⤵
          PID:2432
        • C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe
          "C:\Users\Admin\AppData\Local\Temp\TSTS 0005A.exe"
          2⤵
          • Suspicious use of SetWindowsHookEx
          PID:4196

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_431gzdhd.le1.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\tmp6D12.tmp

        Filesize

        1KB

        MD5

        35bfb4553ad9189205d20be5cc976305

        SHA1

        485c545ce3701f27694fe4df829b2557ed4f0f48

        SHA256

        dfa9b03022019b6b2fb30b73957c1bfdecb4b569345d932cf6fc7549e5aa5a7c

        SHA512

        fb48e2e0fe181865ee5bb481d7825bb6bb1e52feac2dc16f869d8c58458d432b0a4a0b1a62c05effb1a41c2d1d98d68a55771784bb590a8380ff0880082c0e5a

      • C:\Users\Admin\AppData\Roaming\notess\logs.dat

        Filesize

        144B

        MD5

        4cbbe1ca599b5a09cecc9bad75c441ff

        SHA1

        6fceb677d32c976de9311404b616001a8dfdcef5

        SHA256

        75dec0166b55f5ddc0641dbb14257ee904d33426c5a4f15b8e481c52d3b92d99

        SHA512

        f7f5f27de2c9ded88b091392849df65ad8a7547c47f279c16c77a01ab745c90e13006fe1787304f094b01943900630cee39e22f9df1f3b4c1a987ec72e490081

      • memory/3168-6-0x0000000005620000-0x0000000005630000-memory.dmp

        Filesize

        64KB

      • memory/3168-4-0x00000000056E0000-0x00000000056F0000-memory.dmp

        Filesize

        64KB

      • memory/3168-5-0x0000000005570000-0x000000000557A000-memory.dmp

        Filesize

        40KB

      • memory/3168-30-0x0000000074850000-0x0000000075000000-memory.dmp

        Filesize

        7.7MB

      • memory/3168-7-0x00000000056C0000-0x00000000056CC000-memory.dmp

        Filesize

        48KB

      • memory/3168-8-0x0000000006B70000-0x0000000006C30000-memory.dmp

        Filesize

        768KB

      • memory/3168-9-0x00000000091F0000-0x000000000928C000-memory.dmp

        Filesize

        624KB

      • memory/3168-3-0x0000000005470000-0x0000000005502000-memory.dmp

        Filesize

        584KB

      • memory/3168-0-0x00000000008F0000-0x00000000009D8000-memory.dmp

        Filesize

        928KB

      • memory/3168-2-0x0000000005A20000-0x0000000005FC4000-memory.dmp

        Filesize

        5.6MB

      • memory/3168-1-0x0000000074850000-0x0000000075000000-memory.dmp

        Filesize

        7.7MB

      • memory/3520-45-0x0000000006830000-0x000000000687C000-memory.dmp

        Filesize

        304KB

      • memory/3520-61-0x0000000007AC0000-0x0000000007ADA000-memory.dmp

        Filesize

        104KB

      • memory/3520-20-0x00000000056D0000-0x00000000056F2000-memory.dmp

        Filesize

        136KB

      • memory/3520-14-0x0000000002E70000-0x0000000002EA6000-memory.dmp

        Filesize

        216KB

      • memory/3520-76-0x0000000074850000-0x0000000075000000-memory.dmp

        Filesize

        7.7MB

      • memory/3520-73-0x0000000007DE0000-0x0000000007DE8000-memory.dmp

        Filesize

        32KB

      • memory/3520-23-0x00000000058E0000-0x0000000005946000-memory.dmp

        Filesize

        408KB

      • memory/3520-22-0x0000000005870000-0x00000000058D6000-memory.dmp

        Filesize

        408KB

      • memory/3520-72-0x0000000007E00000-0x0000000007E1A000-memory.dmp

        Filesize

        104KB

      • memory/3520-19-0x0000000005460000-0x0000000005470000-memory.dmp

        Filesize

        64KB

      • memory/3520-71-0x0000000007D00000-0x0000000007D14000-memory.dmp

        Filesize

        80KB

      • memory/3520-68-0x0000000007CF0000-0x0000000007CFE000-memory.dmp

        Filesize

        56KB

      • memory/3520-18-0x0000000005AA0000-0x00000000060C8000-memory.dmp

        Filesize

        6.2MB

      • memory/3520-66-0x0000000007CC0000-0x0000000007CD1000-memory.dmp

        Filesize

        68KB

      • memory/3520-28-0x0000000006180000-0x00000000064D4000-memory.dmp

        Filesize

        3.3MB

      • memory/3520-65-0x0000000007D40000-0x0000000007DD6000-memory.dmp

        Filesize

        600KB

      • memory/3520-44-0x00000000067A0000-0x00000000067BE000-memory.dmp

        Filesize

        120KB

      • memory/3520-15-0x0000000074850000-0x0000000075000000-memory.dmp

        Filesize

        7.7MB

      • memory/3520-47-0x0000000007720000-0x0000000007752000-memory.dmp

        Filesize

        200KB

      • memory/3520-46-0x000000007F050000-0x000000007F060000-memory.dmp

        Filesize

        64KB

      • memory/3520-48-0x0000000071EF0000-0x0000000071F3C000-memory.dmp

        Filesize

        304KB

      • memory/3520-58-0x0000000006D50000-0x0000000006D6E000-memory.dmp

        Filesize

        120KB

      • memory/3520-59-0x0000000007970000-0x0000000007A13000-memory.dmp

        Filesize

        652KB

      • memory/3520-17-0x0000000005460000-0x0000000005470000-memory.dmp

        Filesize

        64KB

      • memory/3520-60-0x0000000008110000-0x000000000878A000-memory.dmp

        Filesize

        6.5MB

      • memory/3520-63-0x0000000007B30000-0x0000000007B3A000-memory.dmp

        Filesize

        40KB

      • memory/4196-81-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/4196-100-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/4196-43-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/4196-38-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/4196-67-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/4196-37-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/4196-29-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/4196-62-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/4196-108-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/4196-64-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/4196-27-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/4196-24-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/4196-83-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/4196-84-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/4196-91-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/4196-92-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/4196-99-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/4196-21-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/4196-107-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/4196-26-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB