Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    10/04/2024, 08:56

General

  • Target

    pdtzx.scr

  • Size

    984KB

  • MD5

    98e7bfbf542d7b12f7b7614991743557

  • SHA1

    9eec15369db22c4bcdf39407042545715466292b

  • SHA256

    2320bdd2ef439c3c079ecf8c1c89ff9e8d2c20ed47f459c29186b00c476fa7d4

  • SHA512

    2411a485a66d6aafbe59a576afadb78c1cffd13f4b09595155fe2a9e5f03d57eb2f102cf924e8ebf6918449661197f270e7143c7ce938bdd4dfdaaf277a6e5f9

  • SSDEEP

    24576:6oOBrBls3VEr6ZgFMH+zfQE75oZUPgVQwDqsQ1xAT/qH3:10BlsDZgFMqS1Axu/qH

Malware Config

Extracted

Family

remcos

Botnet

28PDT

C2

psolver827.ddns.net:1974

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    28pdt

  • mouse_option

    false

  • mutex

    Rmc-9BVBM5

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\pdtzx.scr
    "C:\Users\Admin\AppData\Local\Temp\pdtzx.scr" /S
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2960
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\pdtzx.scr"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2996
    • C:\Users\Admin\AppData\Local\Temp\pdtzx.scr
      "C:\Users\Admin\AppData\Local\Temp\pdtzx.scr"
      2⤵
        PID:2592
      • C:\Users\Admin\AppData\Local\Temp\pdtzx.scr
        "C:\Users\Admin\AppData\Local\Temp\pdtzx.scr"
        2⤵
          PID:2652
        • C:\Users\Admin\AppData\Local\Temp\pdtzx.scr
          "C:\Users\Admin\AppData\Local\Temp\pdtzx.scr"
          2⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2656
          • C:\Users\Admin\AppData\Local\Temp\pdtzx.scr
            C:\Users\Admin\AppData\Local\Temp\pdtzx.scr /stext "C:\Users\Admin\AppData\Local\Temp\toafdlcshwcgyipayhqaavjd"
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:2820
          • C:\Users\Admin\AppData\Local\Temp\pdtzx.scr
            C:\Users\Admin\AppData\Local\Temp\pdtzx.scr /stext "C:\Users\Admin\AppData\Local\Temp\digqeenlveulaodmprcclielkno"
            3⤵
              PID:2916
            • C:\Users\Admin\AppData\Local\Temp\pdtzx.scr
              C:\Users\Admin\AppData\Local\Temp\pdtzx.scr /stext "C:\Users\Admin\AppData\Local\Temp\digqeenlveulaodmprcclielkno"
              3⤵
              • Accesses Microsoft Outlook accounts
              PID:3064
            • C:\Users\Admin\AppData\Local\Temp\pdtzx.scr
              C:\Users\Admin\AppData\Local\Temp\pdtzx.scr /stext "C:\Users\Admin\AppData\Local\Temp\gktiwoxnjmmyluzqycxvonyctuxufl"
              3⤵
                PID:880
              • C:\Users\Admin\AppData\Local\Temp\pdtzx.scr
                C:\Users\Admin\AppData\Local\Temp\pdtzx.scr /stext "C:\Users\Admin\AppData\Local\Temp\gktiwoxnjmmyluzqycxvonyctuxufl"
                3⤵
                  PID:612
                • C:\Users\Admin\AppData\Local\Temp\pdtzx.scr
                  C:\Users\Admin\AppData\Local\Temp\pdtzx.scr /stext "C:\Users\Admin\AppData\Local\Temp\gktiwoxnjmmyluzqycxvonyctuxufl"
                  3⤵
                    PID:1944
                  • C:\Users\Admin\AppData\Local\Temp\pdtzx.scr
                    C:\Users\Admin\AppData\Local\Temp\pdtzx.scr /stext "C:\Users\Admin\AppData\Local\Temp\gktiwoxnjmmyluzqycxvonyctuxufl"
                    3⤵
                      PID:556
                    • C:\Users\Admin\AppData\Local\Temp\pdtzx.scr
                      C:\Users\Admin\AppData\Local\Temp\pdtzx.scr /stext "C:\Users\Admin\AppData\Local\Temp\gktiwoxnjmmyluzqycxvonyctuxufl"
                      3⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1552

                Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\ProgramData\28pdt\logs.dat

                        Filesize

                        144B

                        MD5

                        a73aedde31116dd66bf7fd65c63c7847

                        SHA1

                        2f3ac5c56dffb28c836d3fd4aafee347d8d7fb1c

                        SHA256

                        6c9cb0eef1c78ba5d403e94b876f399a180d5f6e0e3ab18dbe36ef03a4f2594b

                        SHA512

                        5207c23b23107dc7155fa4e8290d39dc173549fe4e4725290283a1a10335dd21e280cd2125e91def4e7f7d9d8460f3bff1c24a422e8967dd6746e9d063cf2a7b

                      • C:\Users\Admin\AppData\Local\Temp\toafdlcshwcgyipayhqaavjd

                        Filesize

                        2B

                        MD5

                        f3b25701fe362ec84616a93a45ce9998

                        SHA1

                        d62636d8caec13f04e28442a0a6fa1afeb024bbb

                        SHA256

                        b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                        SHA512

                        98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                      • memory/1552-61-0x0000000000400000-0x0000000000424000-memory.dmp

                        Filesize

                        144KB

                      • memory/1552-64-0x0000000000400000-0x0000000000424000-memory.dmp

                        Filesize

                        144KB

                      • memory/1552-63-0x0000000000400000-0x0000000000424000-memory.dmp

                        Filesize

                        144KB

                      • memory/1552-62-0x0000000000400000-0x0000000000424000-memory.dmp

                        Filesize

                        144KB

                      • memory/1552-59-0x0000000000400000-0x0000000000424000-memory.dmp

                        Filesize

                        144KB

                      • memory/2656-40-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-77-0x0000000010000000-0x0000000010019000-memory.dmp

                        Filesize

                        100KB

                      • memory/2656-9-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-10-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-12-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-14-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-16-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-18-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                        Filesize

                        4KB

                      • memory/2656-21-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-23-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-116-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-24-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-29-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-30-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-115-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-31-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-108-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-107-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-100-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-99-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-91-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-38-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-39-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-41-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-87-0x0000000010000000-0x0000000010019000-memory.dmp

                        Filesize

                        100KB

                      • memory/2656-43-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-83-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-8-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-82-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-79-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2656-78-0x0000000010000000-0x0000000010019000-memory.dmp

                        Filesize

                        100KB

                      • memory/2656-76-0x0000000010000000-0x0000000010019000-memory.dmp

                        Filesize

                        100KB

                      • memory/2656-73-0x0000000010000000-0x0000000010019000-memory.dmp

                        Filesize

                        100KB

                      • memory/2656-7-0x0000000000400000-0x0000000000482000-memory.dmp

                        Filesize

                        520KB

                      • memory/2820-51-0x0000000000400000-0x0000000000478000-memory.dmp

                        Filesize

                        480KB

                      • memory/2820-49-0x0000000000400000-0x0000000000478000-memory.dmp

                        Filesize

                        480KB

                      • memory/2820-69-0x0000000000400000-0x0000000000478000-memory.dmp

                        Filesize

                        480KB

                      • memory/2820-44-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                        Filesize

                        4KB

                      • memory/2820-46-0x0000000000400000-0x0000000000478000-memory.dmp

                        Filesize

                        480KB

                      • memory/2960-5-0x0000000000460000-0x000000000046C000-memory.dmp

                        Filesize

                        48KB

                      • memory/2960-4-0x0000000000420000-0x0000000000428000-memory.dmp

                        Filesize

                        32KB

                      • memory/2960-25-0x0000000073EC0000-0x00000000745AE000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/2960-1-0x0000000073EC0000-0x00000000745AE000-memory.dmp

                        Filesize

                        6.9MB

                      • memory/2960-6-0x0000000005A40000-0x0000000005B00000-memory.dmp

                        Filesize

                        768KB

                      • memory/2960-2-0x0000000004370000-0x00000000043B0000-memory.dmp

                        Filesize

                        256KB

                      • memory/2960-0-0x00000000001B0000-0x00000000002A8000-memory.dmp

                        Filesize

                        992KB

                      • memory/2960-3-0x0000000000440000-0x000000000045C000-memory.dmp

                        Filesize

                        112KB

                      • memory/2996-34-0x000000006ED30000-0x000000006F2DB000-memory.dmp

                        Filesize

                        5.7MB

                      • memory/2996-37-0x000000006ED30000-0x000000006F2DB000-memory.dmp

                        Filesize

                        5.7MB

                      • memory/2996-35-0x00000000029C0000-0x0000000002A00000-memory.dmp

                        Filesize

                        256KB

                      • memory/2996-36-0x00000000029C0000-0x0000000002A00000-memory.dmp

                        Filesize

                        256KB

                      • memory/2996-33-0x00000000029C0000-0x0000000002A00000-memory.dmp

                        Filesize

                        256KB

                      • memory/2996-32-0x000000006ED30000-0x000000006F2DB000-memory.dmp

                        Filesize

                        5.7MB

                      • memory/3064-52-0x0000000000400000-0x0000000000462000-memory.dmp

                        Filesize

                        392KB

                      • memory/3064-56-0x0000000000400000-0x0000000000462000-memory.dmp

                        Filesize

                        392KB

                      • memory/3064-72-0x0000000000400000-0x0000000000462000-memory.dmp

                        Filesize

                        392KB

                      • memory/3064-54-0x0000000000400000-0x0000000000462000-memory.dmp

                        Filesize

                        392KB