Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-04-2024 07:11

General

  • Target

    Payment Invoice.exe

  • Size

    910KB

  • MD5

    783addabb1e7dcb48130649faaf852c7

  • SHA1

    c87553da7df62530e9262b35930d6a15aff4949a

  • SHA256

    b162074bf62543007615d08db1dffa75022858944a0ecc5de5ed8d3be561e3da

  • SHA512

    9f352fd443bd680a71ce1a4ece252baa81c2c293727d520ce57da93d461808f50be6c22f4a6f8e0a18f0857785b47f783f1f3cc6c41442275c12149e067b3c3b

  • SSDEEP

    24576:IsWW2f6w8r89u8TeWMkzIULsHTJMGoMzyc/VdK:IsT2fTC8BSWMkluMMzyctd

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

bignight.net:3363

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-1XSDBO

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Payment Invoice.exe
    "C:\Users\Admin\AppData\Local\Temp\Payment Invoice.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Payment Invoice.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4520
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HFqduGIsFotY.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2744
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HFqduGIsFotY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6409.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:4664
    • C:\Users\Admin\AppData\Local\Temp\Payment Invoice.exe
      "C:\Users\Admin\AppData\Local\Temp\Payment Invoice.exe"
      2⤵
        PID:4152
      • C:\Users\Admin\AppData\Local\Temp\Payment Invoice.exe
        "C:\Users\Admin\AppData\Local\Temp\Payment Invoice.exe"
        2⤵
          PID:2932
        • C:\Users\Admin\AppData\Local\Temp\Payment Invoice.exe
          "C:\Users\Admin\AppData\Local\Temp\Payment Invoice.exe"
          2⤵
            PID:3276
          • C:\Users\Admin\AppData\Local\Temp\Payment Invoice.exe
            "C:\Users\Admin\AppData\Local\Temp\Payment Invoice.exe"
            2⤵
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            PID:4776

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Execution

        Scheduled Task/Job

        1
        T1053

        Persistence

        Scheduled Task/Job

        1
        T1053

        Privilege Escalation

        Scheduled Task/Job

        1
        T1053

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        2
        T1082

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\remcos\logs.dat
          Filesize

          144B

          MD5

          62ef8dc98b85f23267b5270efb0c962c

          SHA1

          4ecfbff7842e100e49aaf52fd3989c8f2c1ca89b

          SHA256

          5146add6e99bf526973962cf62b83dc78ac2e2aa53cc4331f1a2717f35e01cfa

          SHA512

          a439737468b24546577ceec70beaa65b0e2bb1b11a4cbb5bedf6291dce2651929a864c3e5e5f947a0fb054f3de4dacf953cac7d429318394fa69671605abb1da

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
          Filesize

          2KB

          MD5

          968cb9309758126772781b83adb8a28f

          SHA1

          8da30e71accf186b2ba11da1797cf67f8f78b47c

          SHA256

          92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

          SHA512

          4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          18KB

          MD5

          f3b2f12e9d6d5bc142b80043c91b5416

          SHA1

          9ac9c4aab7e724c381be28c84833fa24a21e3d6c

          SHA256

          35eb48148391348ca31ba9a3fa599046355e7ee78059eed27f041bd82774eef8

          SHA512

          7b6fed69b3496e0c9f4dd748ee73dfa640a30c775b8ddbf05f665ad1427c57a1711e2e819bd1afad32684556ac7ed15d5dfd8635a95b259c7a0d2cdcb211b339

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l3fv0frb.3va.ps1
          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\tmp6409.tmp
          Filesize

          1KB

          MD5

          c5532a1b921db5f0d60f393e9897e0e6

          SHA1

          91e120a10fb0e2f43608196e6c8f2792f72357a9

          SHA256

          05990cf86ab5c77c43ef44b90341a3351371bed74de7744dd33aade87faa6c3b

          SHA512

          693a40d908b371157025b16edf423ca2f154fd9c723cfa4bc0bfc833214c529a246fa1aefc8fa0354b0bb61c3700ac8138e12abfffd4272a16c52f1de7bbbb0f

        • memory/2408-7-0x0000000004EA0000-0x0000000004EA8000-memory.dmp
          Filesize

          32KB

        • memory/2408-6-0x0000000005260000-0x0000000005278000-memory.dmp
          Filesize

          96KB

        • memory/2408-41-0x0000000075040000-0x00000000757F0000-memory.dmp
          Filesize

          7.7MB

        • memory/2408-8-0x0000000004FD0000-0x0000000004FDC000-memory.dmp
          Filesize

          48KB

        • memory/2408-9-0x000000000BF80000-0x000000000C040000-memory.dmp
          Filesize

          768KB

        • memory/2408-10-0x00000000077F0000-0x000000000788C000-memory.dmp
          Filesize

          624KB

        • memory/2408-5-0x0000000004DD0000-0x0000000004DDA000-memory.dmp
          Filesize

          40KB

        • memory/2408-4-0x0000000004BD0000-0x0000000004BE0000-memory.dmp
          Filesize

          64KB

        • memory/2408-1-0x0000000075040000-0x00000000757F0000-memory.dmp
          Filesize

          7.7MB

        • memory/2408-3-0x0000000004C20000-0x0000000004CB2000-memory.dmp
          Filesize

          584KB

        • memory/2408-0-0x0000000000140000-0x000000000022A000-memory.dmp
          Filesize

          936KB

        • memory/2408-2-0x0000000005290000-0x0000000005834000-memory.dmp
          Filesize

          5.6MB

        • memory/2744-95-0x00000000074F0000-0x000000000750A000-memory.dmp
          Filesize

          104KB

        • memory/2744-63-0x00000000726E0000-0x000000007272C000-memory.dmp
          Filesize

          304KB

        • memory/2744-26-0x0000000004AF0000-0x0000000004B00000-memory.dmp
          Filesize

          64KB

        • memory/2744-90-0x0000000007220000-0x000000000722A000-memory.dmp
          Filesize

          40KB

        • memory/2744-88-0x00000000077F0000-0x0000000007E6A000-memory.dmp
          Filesize

          6.5MB

        • memory/2744-86-0x0000000004AF0000-0x0000000004B00000-memory.dmp
          Filesize

          64KB

        • memory/2744-105-0x0000000075040000-0x00000000757F0000-memory.dmp
          Filesize

          7.7MB

        • memory/2744-22-0x0000000075040000-0x00000000757F0000-memory.dmp
          Filesize

          7.7MB

        • memory/2744-24-0x0000000004AF0000-0x0000000004B00000-memory.dmp
          Filesize

          64KB

        • memory/2744-85-0x0000000004AF0000-0x0000000004B00000-memory.dmp
          Filesize

          64KB

        • memory/2744-57-0x0000000005E60000-0x0000000005E7E000-memory.dmp
          Filesize

          120KB

        • memory/2744-60-0x0000000006E20000-0x0000000006E52000-memory.dmp
          Filesize

          200KB

        • memory/2744-59-0x000000007F840000-0x000000007F850000-memory.dmp
          Filesize

          64KB

        • memory/2744-58-0x0000000005E90000-0x0000000005EDC000-memory.dmp
          Filesize

          304KB

        • memory/4520-96-0x00000000073A0000-0x00000000073A8000-memory.dmp
          Filesize

          32KB

        • memory/4520-23-0x00000000056B0000-0x0000000005716000-memory.dmp
          Filesize

          408KB

        • memory/4520-15-0x0000000002470000-0x00000000024A6000-memory.dmp
          Filesize

          216KB

        • memory/4520-17-0x0000000005010000-0x0000000005638000-memory.dmp
          Filesize

          6.2MB

        • memory/4520-18-0x00000000049D0000-0x00000000049E0000-memory.dmp
          Filesize

          64KB

        • memory/4520-61-0x00000000726E0000-0x000000007272C000-memory.dmp
          Filesize

          304KB

        • memory/4520-16-0x0000000075040000-0x00000000757F0000-memory.dmp
          Filesize

          7.7MB

        • memory/4520-73-0x0000000006EE0000-0x0000000006EFE000-memory.dmp
          Filesize

          120KB

        • memory/4520-82-0x00000000049D0000-0x00000000049E0000-memory.dmp
          Filesize

          64KB

        • memory/4520-84-0x0000000006F40000-0x0000000006FE3000-memory.dmp
          Filesize

          652KB

        • memory/4520-21-0x0000000004EA0000-0x0000000004EC2000-memory.dmp
          Filesize

          136KB

        • memory/4520-25-0x0000000005720000-0x0000000005786000-memory.dmp
          Filesize

          408KB

        • memory/4520-101-0x0000000075040000-0x00000000757F0000-memory.dmp
          Filesize

          7.7MB

        • memory/4520-62-0x000000007F7F0000-0x000000007F800000-memory.dmp
          Filesize

          64KB

        • memory/4520-87-0x00000000049D0000-0x00000000049E0000-memory.dmp
          Filesize

          64KB

        • memory/4520-38-0x0000000005790000-0x0000000005AE4000-memory.dmp
          Filesize

          3.3MB

        • memory/4520-89-0x0000000007080000-0x000000000709A000-memory.dmp
          Filesize

          104KB

        • memory/4520-19-0x00000000049D0000-0x00000000049E0000-memory.dmp
          Filesize

          64KB

        • memory/4520-91-0x0000000007300000-0x0000000007396000-memory.dmp
          Filesize

          600KB

        • memory/4520-92-0x0000000007280000-0x0000000007291000-memory.dmp
          Filesize

          68KB

        • memory/4520-93-0x00000000072B0000-0x00000000072BE000-memory.dmp
          Filesize

          56KB

        • memory/4520-94-0x00000000072C0000-0x00000000072D4000-memory.dmp
          Filesize

          80KB

        • memory/4776-120-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-134-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-97-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-98-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-36-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-40-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-52-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-55-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-106-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-109-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-110-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-114-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-115-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-116-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-117-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-118-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-119-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-54-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-121-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-123-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-124-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-125-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-126-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-127-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-128-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-129-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-130-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-131-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-132-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-37-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-135-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-136-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-137-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-138-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-139-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-140-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-141-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-142-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-143-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-145-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-146-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-147-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-148-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-149-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-150-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-151-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-152-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-153-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-154-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-56-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-156-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-157-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-158-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-159-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-160-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-161-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-162-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB

        • memory/4776-163-0x0000000000400000-0x0000000000482000-memory.dmp
          Filesize

          520KB