Resubmissions
09-04-2024 14:14
240409-rj3fvsce6t 1009-04-2024 14:14
240409-rj2vbsce6s 1009-04-2024 14:14
240409-rj18ssce51 1009-04-2024 14:14
240409-rj1x2ahb79 1004-04-2024 02:44
240404-c8cjeada69 10Analysis
-
max time kernel
606s -
max time network
618s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
09-04-2024 14:14
General
-
Target
e6284eafa60ee032f4517d1ce32329cf9a43918aed4026e68b486bc0986bd392.exe
-
Size
522KB
-
MD5
366b352bad65c71445747135fe315aec
-
SHA1
4307b086d0a9f38d0cf4620e4f3f6ac77e7d6d3f
-
SHA256
e6284eafa60ee032f4517d1ce32329cf9a43918aed4026e68b486bc0986bd392
-
SHA512
49f75b2c87e3d2b78901c05c0fef7011d1ea5de6d91d4eeca8dd8b9c7229efabd015b5b03501c1e4e4bd93fccae336520ecb04d6c00eb57123fc8e68ec4541a1
-
SSDEEP
12288:YiVvIoaAY5T3SBGmWb7T/CWX8/hbAqm4lgova5WMvEAmD:rIoN+jSBMT/k/Vrm4Cuc
Score
10/10
Malware Config
Extracted
Family
remcos
Version
1.7 Pro
Botnet
gg
C2
62.102.148.185:9771
Attributes
-
audio_folder
audio
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
5
-
copy_file
remcos.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
newstart
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
remcos_wgwfvnfssp
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screens
-
screenshot_path
%AppData%
-
screenshot_time
1
-
startup_value
remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 39 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6284eafa60ee032f4517d1ce32329cf9a43918aed4026e68b486bc0986bd392.exe"C:\Users\Admin\AppData\Local\Temp\e6284eafa60ee032f4517d1ce32329cf9a43918aed4026e68b486bc0986bd392.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\e6284eafa60ee032f4517d1ce32329cf9a43918aed4026e68b486bc0986bd392.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gAmdlUtlZn.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gAmdlUtlZn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2315.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\e6284eafa60ee032f4517d1ce32329cf9a43918aed4026e68b486bc0986bd392.exe"C:\Users\Admin\AppData\Local\Temp\e6284eafa60ee032f4517d1ce32329cf9a43918aed4026e68b486bc0986bd392.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:81⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3716 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ljs2db54.j1u.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmp2315.tmpFilesize
1KB
MD500e77f4f893eb15b5df81e8b89bebe4e
SHA14f4893d3b45b08e99e5503f6419ba643b7a61f89
SHA256cfedd07eac60f168b99140f9541cdaa44e617fc769d7037dd251115b3dcb9dda
SHA512ca3c58f5f28195f386867ef7a489b3e0f31d22b01e38a909c61bdad5cb6572a4131d6a943d43a25e964e93da7a7a3da1e1ec9674bf2a065c3287825e25c4eee7
-
memory/1064-4-0x0000000074F30000-0x00000000756E0000-memory.dmpFilesize
7.7MB
-
memory/1064-3-0x0000000005A70000-0x0000000005B02000-memory.dmpFilesize
584KB
-
memory/1064-5-0x0000000005C00000-0x0000000005C10000-memory.dmpFilesize
64KB
-
memory/1064-6-0x0000000001AB0000-0x0000000001ABA000-memory.dmpFilesize
40KB
-
memory/1064-7-0x0000000005C00000-0x0000000005C10000-memory.dmpFilesize
64KB
-
memory/1064-8-0x0000000005F70000-0x0000000005F82000-memory.dmpFilesize
72KB
-
memory/1064-9-0x00000000065A0000-0x00000000065AC000-memory.dmpFilesize
48KB
-
memory/1064-10-0x0000000007690000-0x00000000076EE000-memory.dmpFilesize
376KB
-
memory/1064-11-0x0000000009D20000-0x0000000009DBC000-memory.dmpFilesize
624KB
-
memory/1064-2-0x0000000005F80000-0x0000000006524000-memory.dmpFilesize
5.6MB
-
memory/1064-0-0x0000000074F30000-0x00000000756E0000-memory.dmpFilesize
7.7MB
-
memory/1064-1-0x0000000000F70000-0x0000000000FF8000-memory.dmpFilesize
544KB
-
memory/1064-32-0x0000000074F30000-0x00000000756E0000-memory.dmpFilesize
7.7MB
-
memory/2352-92-0x00000000067F0000-0x0000000006893000-memory.dmpFilesize
652KB
-
memory/2352-98-0x00000000068B0000-0x00000000068BA000-memory.dmpFilesize
40KB
-
memory/2352-112-0x0000000074F30000-0x00000000756E0000-memory.dmpFilesize
7.7MB
-
memory/2352-107-0x0000000007890000-0x00000000078AA000-memory.dmpFilesize
104KB
-
memory/2352-106-0x00000000077B0000-0x00000000077C4000-memory.dmpFilesize
80KB
-
memory/2352-103-0x000000007F570000-0x000000007F580000-memory.dmpFilesize
64KB
-
memory/2352-99-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/2352-29-0x0000000005270000-0x0000000005292000-memory.dmpFilesize
136KB
-
memory/2352-97-0x0000000007560000-0x000000000757A000-memory.dmpFilesize
104KB
-
memory/2352-31-0x0000000005A10000-0x0000000005A76000-memory.dmpFilesize
408KB
-
memory/2352-17-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/2352-12-0x0000000074F30000-0x00000000756E0000-memory.dmpFilesize
7.7MB
-
memory/2352-15-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/2352-91-0x0000000000DA0000-0x0000000000DBE000-memory.dmpFilesize
120KB
-
memory/2352-37-0x0000000074F30000-0x00000000756E0000-memory.dmpFilesize
7.7MB
-
memory/2352-16-0x0000000004C50000-0x0000000004C86000-memory.dmpFilesize
216KB
-
memory/2352-48-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/2352-57-0x0000000005D80000-0x00000000060D4000-memory.dmpFilesize
3.3MB
-
memory/2352-58-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/2352-71-0x0000000071210000-0x000000007125C000-memory.dmpFilesize
304KB
-
memory/2352-68-0x000000007F570000-0x000000007F580000-memory.dmpFilesize
64KB
-
memory/2352-66-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/2352-64-0x0000000006300000-0x000000000634C000-memory.dmpFilesize
304KB
-
memory/3416-96-0x0000000007430000-0x0000000007AAA000-memory.dmpFilesize
6.5MB
-
memory/3416-21-0x00000000045A0000-0x00000000045B0000-memory.dmpFilesize
64KB
-
memory/3416-63-0x0000000005A40000-0x0000000005A5E000-memory.dmpFilesize
120KB
-
memory/3416-67-0x00000000045A0000-0x00000000045B0000-memory.dmpFilesize
64KB
-
memory/3416-61-0x00000000045A0000-0x00000000045B0000-memory.dmpFilesize
64KB
-
memory/3416-69-0x000000007FDC0000-0x000000007FDD0000-memory.dmpFilesize
64KB
-
memory/3416-70-0x0000000005ED0000-0x0000000005F02000-memory.dmpFilesize
200KB
-
memory/3416-59-0x0000000074F30000-0x00000000756E0000-memory.dmpFilesize
7.7MB
-
memory/3416-74-0x0000000071210000-0x000000007125C000-memory.dmpFilesize
304KB
-
memory/3416-30-0x0000000004B20000-0x0000000004B86000-memory.dmpFilesize
408KB
-
memory/3416-111-0x0000000074F30000-0x00000000756E0000-memory.dmpFilesize
7.7MB
-
memory/3416-108-0x0000000007070000-0x0000000007078000-memory.dmpFilesize
32KB
-
memory/3416-62-0x00000000045A0000-0x00000000045B0000-memory.dmpFilesize
64KB
-
memory/3416-23-0x00000000045A0000-0x00000000045B0000-memory.dmpFilesize
64KB
-
memory/3416-105-0x0000000007030000-0x000000000703E000-memory.dmpFilesize
56KB
-
memory/3416-20-0x0000000074F30000-0x00000000756E0000-memory.dmpFilesize
7.7MB
-
memory/3416-100-0x00000000045A0000-0x00000000045B0000-memory.dmpFilesize
64KB
-
memory/3416-101-0x0000000007080000-0x0000000007116000-memory.dmpFilesize
600KB
-
memory/3416-102-0x00000000060E0000-0x00000000060F1000-memory.dmpFilesize
68KB
-
memory/3416-22-0x0000000004BE0000-0x0000000005208000-memory.dmpFilesize
6.2MB
-
memory/3416-104-0x000000007FDC0000-0x000000007FDD0000-memory.dmpFilesize
64KB
-
memory/3668-25-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3668-28-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3668-65-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3668-33-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3668-34-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB
-
memory/3668-36-0x0000000000400000-0x0000000000417000-memory.dmpFilesize
92KB