Analysis

  • max time kernel
    1800s
  • max time network
    1808s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    10/04/2024, 13:58

General

  • Target

    New Purchase Order-030220- SMART SOURCING INC.exe

  • Size

    678KB

  • MD5

    3207acb14184189a3800a8e20a82b023

  • SHA1

    65d2ad175339e0dc644b301c85e7f02f098bbb63

  • SHA256

    1f3358783cef07f7a60b0530c0de90be8a1131715faaf9d841ce830d9116434b

  • SHA512

    71ccfda46c9c98944153398afebe09708d9c071da3e821f238b865fb77551734e94fbf6e39445c45da926efac9a7b6f9fcc6fe0d93ba8a2274d0fdc25c569bd0

  • SSDEEP

    12288:qMu7vJgCfeUA94QAyS3ewHXsnn38zVzMfpNemioprHlJ:q5mZ2emcnn38pzE4In

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

SOLOMON

C2

grantadistciaret.com:3212

grantadistciaret.com:3223

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %Temp%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    RmcxeJ-GSQVVR

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Purchase Order-030220- SMART SOURCING INC.exe
    "C:\Users\Admin\AppData\Local\Temp\New Purchase Order-030220- SMART SOURCING INC.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4204
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:676

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\remcos\logs.dat

          Filesize

          144B

          MD5

          a1269564ba4ead3b7202813b327ca586

          SHA1

          83211e4b9e6261f2e1bc12fd4639dd7c08e23cda

          SHA256

          cafccfc0d964867b3c2994d4bd038897d381eeefd5d510b880f14ba5d9a2214e

          SHA512

          9a37c4d73c5e5f08eb5364cb1cbac7a8da25ef284cd45a363c88401a2efb22c7737bb0b6b3c7ad5995adf12281e4f210c65b3e66d0d9fa5abff71998a3dc65a7

        • memory/676-79-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-129-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-12-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-11-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-193-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-192-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-185-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-180-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-179-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-14-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-15-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-16-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-20-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-23-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-8-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-28-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-29-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-34-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-40-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-41-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-47-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-48-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-53-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-54-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-59-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-66-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-67-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-72-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-9-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-78-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-141-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-91-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-92-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-97-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-103-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-105-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-110-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-116-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-117-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-122-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-6-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-130-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-135-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-85-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-142-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-148-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-154-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-155-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-160-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-166-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-168-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/676-173-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/4204-4-0x00000260E82A0000-0x00000260E82B0000-memory.dmp

          Filesize

          64KB

        • memory/4204-3-0x00000260CE070000-0x00000260CE076000-memory.dmp

          Filesize

          24KB

        • memory/4204-2-0x00000260E8070000-0x00000260E80F6000-memory.dmp

          Filesize

          536KB

        • memory/4204-1-0x00007FFB1CA40000-0x00007FFB1D502000-memory.dmp

          Filesize

          10.8MB

        • memory/4204-0-0x00000260CDBC0000-0x00000260CDC6E000-memory.dmp

          Filesize

          696KB

        • memory/4204-5-0x00000260CE090000-0x00000260CE09A000-memory.dmp

          Filesize

          40KB

        • memory/4204-10-0x00007FFB1CA40000-0x00007FFB1D502000-memory.dmp

          Filesize

          10.8MB