Analysis

  • max time kernel
    1322s
  • max time network
    1328s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/04/2024, 13:58

General

  • Target

    New Purchase Order-030220- SMART SOURCING INC.exe

  • Size

    678KB

  • MD5

    3207acb14184189a3800a8e20a82b023

  • SHA1

    65d2ad175339e0dc644b301c85e7f02f098bbb63

  • SHA256

    1f3358783cef07f7a60b0530c0de90be8a1131715faaf9d841ce830d9116434b

  • SHA512

    71ccfda46c9c98944153398afebe09708d9c071da3e821f238b865fb77551734e94fbf6e39445c45da926efac9a7b6f9fcc6fe0d93ba8a2274d0fdc25c569bd0

  • SSDEEP

    12288:qMu7vJgCfeUA94QAyS3ewHXsnn38zVzMfpNemioprHlJ:q5mZ2emcnn38pzE4In

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

SOLOMON

C2

grantadistciaret.com:3212

grantadistciaret.com:3223

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %Temp%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    RmcxeJ-GSQVVR

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Purchase Order-030220- SMART SOURCING INC.exe
    "C:\Users\Admin\AppData\Local\Temp\New Purchase Order-030220- SMART SOURCING INC.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4216
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      2⤵
        PID:2360
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
        2⤵
        • Suspicious use of SetWindowsHookEx
        PID:1300

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\remcos\logs.dat

            Filesize

            144B

            MD5

            9b75b0bbc861b238e9f3def6cbc4c8cf

            SHA1

            83b4f45842997c94bd6efbdee5c50728342439f0

            SHA256

            8a6330a191ed148e67a69b4c92997333a03dc32e277a48baa59a5333b254ba44

            SHA512

            72c9820df1f93c0ece15b84a720c53e2bbe95d2402cc96b7426abb2060cf5844602d0c86dc67edf2521ba9c077ffca2f693833360dc1e668eb2124d49f40bbc0

          • memory/1300-78-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-123-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-11-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-12-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-193-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-192-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-186-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-180-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-179-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-14-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-15-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-16-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-21-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-23-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-8-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-28-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-29-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-34-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-91-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-42-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-47-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-53-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-54-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-60-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-66-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-67-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-72-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-6-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-10-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-80-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-41-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-92-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-97-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-104-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-105-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-110-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-116-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-117-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-85-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-129-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-130-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-135-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-141-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-143-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-148-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-154-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-155-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-160-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-167-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-168-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/1300-173-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/4216-4-0x000002888A430000-0x000002888A440000-memory.dmp

            Filesize

            64KB

          • memory/4216-3-0x00007FF84BB00000-0x00007FF84C5C1000-memory.dmp

            Filesize

            10.8MB

          • memory/4216-2-0x0000028888C70000-0x0000028888C76000-memory.dmp

            Filesize

            24KB

          • memory/4216-1-0x000002888A360000-0x000002888A3E6000-memory.dmp

            Filesize

            536KB

          • memory/4216-0-0x0000028888580000-0x000002888862E000-memory.dmp

            Filesize

            696KB

          • memory/4216-5-0x0000028888C80000-0x0000028888C8A000-memory.dmp

            Filesize

            40KB

          • memory/4216-9-0x00007FF84BB00000-0x00007FF84C5C1000-memory.dmp

            Filesize

            10.8MB