Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/04/2024, 07:25

General

  • Target

    31c0d26c2edd1b2d59a360ce272eb19ffed3b630757e94336a75c2e1e6a3f729.exe

  • Size

    1.6MB

  • MD5

    983199bbc9855444da45fd3470542c93

  • SHA1

    6358b2bf1dc6e8aff646ad6ab919be865fa19870

  • SHA256

    31c0d26c2edd1b2d59a360ce272eb19ffed3b630757e94336a75c2e1e6a3f729

  • SHA512

    9d48594222420487bc7a8d0e888806edbd5bac819669504d2a854912d403b22fb761f0e4e0a220412e2a18165ee8d20afe4fa21bea6f73a908428a2116557684

  • SSDEEP

    49152:IEnnpprnZS5N5KF+PBoW0Pc2pjzUNjLfy:7nptn+N5KIPBoWnQwJy

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

Ene20

C2

amsdkjeduejfhdgerop.duckdns.org:2223

Attributes
  • audio_folder

    MicRecords

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    AdminShell

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    NQUjfd3E3e5dje-JHD8X5

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

  • take_screenshot_title

    wikipedia;solitaire;

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Blocklisted process makes network request 64 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\31c0d26c2edd1b2d59a360ce272eb19ffed3b630757e94336a75c2e1e6a3f729.exe
    "C:\Users\Admin\AppData\Local\Temp\31c0d26c2edd1b2d59a360ce272eb19ffed3b630757e94336a75c2e1e6a3f729.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1744
    • C:\Users\Admin\AppData\Local\Temp\plier.exe
      C:\Users\Admin\AppData\Local\Temp\plier.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2768
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
        • Blocklisted process makes network request
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        PID:3204
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1092
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat" /t REG_DWORD /d 0"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4140
      • C:\Windows\SysWOW64\reg.exe
        reg.exe add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Roaming\Adobe\Acrobat" /t REG_DWORD /d 0
        3⤵
          PID:3644

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\Cornhusk

            Filesize

            1.5MB

            MD5

            32604f4797fafd34895f707137146e3a

            SHA1

            86bb7be89f74c85a1f77e52879ab1354af5b00be

            SHA256

            f4e553e609fd70e9e21f5ea68adaa120bd93df0ad5befb3d2889db38bdb2211a

            SHA512

            e391f0f16b668d5b07a53e13178f105f35f517fa189764eef811a521d292e16a6f738efe0f1992f98f393ec463f486719f80777dd4967fd1787e561005e62721

          • C:\Users\Admin\AppData\Local\Temp\Umbellule.DLL

            Filesize

            17KB

            MD5

            6000783aeacd1836db8f8d7c10330a3b

            SHA1

            ba0176243cc0568dd0d10a1762ab69498e1dcb44

            SHA256

            573eca694d4fde714b97227d2a71950021fa8bb038f35ba998a448a5c8264f65

            SHA512

            954da3704d60acb61ff3bf0949141f2ec95858906b1bca792d98075a9841bb77372de168ba44972e6b53e103ef4bfc3d166e791390981e32db808dfce12bc248

          • C:\Users\Admin\AppData\Roaming\AdminShell\logs.dat

            Filesize

            74B

            MD5

            d4efae098a46095c49ddfe77b608cd6b

            SHA1

            7151a5d93149c5189a75d8487a62ba8c8a772a46

            SHA256

            44412ebb6748adcff1d5adf06b42c8d28845194f85d4201e456f6188860506ad

            SHA512

            2b7d7adab5ae4bea31a56df05b3e218b1694381a5715ead80b44031ef332e29439473aa5e6f7e60171202f636283cf3e0803ef88f90ab90a3e31fb5410e6d363

          • C:\Windows\win.ini

            Filesize

            517B

            MD5

            893cae59ab5945a94a7da007d47a1255

            SHA1

            d4cfd81c6647ca64022bd307c08a7fb4bbbd4c06

            SHA256

            edfa0f2d3bea9f737e0315971c6f81d3d8e7d460b60a19351ada0316a093c938

            SHA512

            d66e454781f54f45df814ad32d687b0f100578c2a4ffca62de81add04281fb881a550702bd2d058933d3736d14e88624af268a86ce24b0c3935242b206ffdcc9

          • \Users\Admin\AppData\Local\Temp\plier.exe

            Filesize

            4KB

            MD5

            11c8f037f0e1a68ff1c74cbcac6e3c6e

            SHA1

            bb50ac196dfd3a194b7b7161947a012a0d49886c

            SHA256

            aed09c9a90b38e324fa49b4b8b5b6e263413b49768d5b38f921c2ee4245a6b34

            SHA512

            05da2d9cd1ce41a11d4ba0f82512790357139c815894f1be4468df137680ecd577660807c368d9c9c6e95aad10e2caa0f00cf1c5739b36644c75a2e8eeae6c2b

          • memory/2768-33-0x0000000000220000-0x0000000000224000-memory.dmp

            Filesize

            16KB

          • memory/2768-34-0x0000000000260000-0x0000000000267000-memory.dmp

            Filesize

            28KB

          • memory/2768-35-0x0000000000230000-0x0000000000231000-memory.dmp

            Filesize

            4KB

          • memory/2768-10041-0x00000000002A0000-0x00000000002C2000-memory.dmp

            Filesize

            136KB

          • memory/3204-10103-0x0000000074540000-0x0000000074780000-memory.dmp

            Filesize

            2.2MB

          • memory/3204-10092-0x0000000000080000-0x0000000000083000-memory.dmp

            Filesize

            12KB

          • memory/3204-10107-0x0000000074540000-0x0000000074780000-memory.dmp

            Filesize

            2.2MB

          • memory/3204-10109-0x0000000074540000-0x0000000074780000-memory.dmp

            Filesize

            2.2MB

          • memory/3204-10112-0x0000000074540000-0x0000000074780000-memory.dmp

            Filesize

            2.2MB

          • memory/3204-10042-0x0000000000090000-0x0000000000096000-memory.dmp

            Filesize

            24KB

          • memory/3204-10116-0x0000000074540000-0x0000000074780000-memory.dmp

            Filesize

            2.2MB

          • memory/3204-10118-0x0000000074540000-0x0000000074780000-memory.dmp

            Filesize

            2.2MB

          • memory/3204-10119-0x0000000074540000-0x0000000074780000-memory.dmp

            Filesize

            2.2MB

          • memory/3204-10121-0x0000000074540000-0x0000000074780000-memory.dmp

            Filesize

            2.2MB

          • memory/3204-10124-0x0000000074540000-0x0000000074780000-memory.dmp

            Filesize

            2.2MB