Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
22/04/2024, 16:04
General
- Target z1PROOFOFPAYMENT.exe
- Size 963KB
- Sample240422-thxv4add2s
- SHA256 efbde8c3fc0f8f18b6b2c93fae4c7aaaa137f866a9d112ebdc534b8477485261
Malware Config
Extracted
-
remcos
-
STHost
-
89.249.73.162:2479
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-TH3UQH
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\z1PROOFOFPAYMENT.exe"C:\Users\Admin\AppData\Local\Temp\z1PROOFOFPAYMENT.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VbYQdeNcfJk.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VbYQdeNcfJk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp84C0.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\z1PROOFOFPAYMENT.exe"C:\Users\Admin\AppData\Local\Temp\z1PROOFOFPAYMENT.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\z1PROOFOFPAYMENT.exe"C:\Users\Admin\AppData\Local\Temp\z1PROOFOFPAYMENT.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
logs.dat
__PSScriptPolicyTest_0bestx5p.lx4.ps1
tmp84C0.tmp
memory/1328-86-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1328-81-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1328-100-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1328-99-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1328-94-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1328-93-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1328-87-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1328-35-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1328-107-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1328-105-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1328-80-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1328-78-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1328-46-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1328-44-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1328-112-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1328-43-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1328-113-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1328-41-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1328-38-0x0000000000400000-0x0000000000482000-memory.dmp
memory/1328-34-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4584-19-0x0000000005420000-0x0000000005430000-memory.dmp
memory/4584-66-0x0000000007E60000-0x0000000007EF6000-memory.dmp
memory/4584-16-0x0000000005300000-0x0000000005336000-memory.dmp
memory/4584-23-0x0000000006200000-0x0000000006266000-memory.dmp
memory/4584-29-0x00000000062E0000-0x0000000006346000-memory.dmp
memory/4584-22-0x00000000058F0000-0x0000000005912000-memory.dmp
memory/4584-20-0x0000000005420000-0x0000000005430000-memory.dmp
memory/4584-45-0x00000000068D0000-0x00000000068EE000-memory.dmp
memory/4584-17-0x0000000074A50000-0x0000000075200000-memory.dmp
memory/4584-47-0x0000000006960000-0x00000000069AC000-memory.dmp
memory/4584-48-0x000000007F690000-0x000000007F6A0000-memory.dmp
memory/4584-49-0x0000000006E70000-0x0000000006EA2000-memory.dmp
memory/4584-50-0x0000000073520000-0x000000007356C000-memory.dmp
memory/4584-60-0x0000000006E50000-0x0000000006E6E000-memory.dmp
memory/4584-61-0x0000000005420000-0x0000000005430000-memory.dmp
memory/4584-62-0x0000000007AD0000-0x0000000007B73000-memory.dmp
memory/4584-63-0x0000000008220000-0x000000000889A000-memory.dmp
memory/4584-64-0x0000000007BE0000-0x0000000007BFA000-memory.dmp
memory/4584-65-0x0000000007C50000-0x0000000007C5A000-memory.dmp
memory/4584-36-0x0000000006530000-0x0000000006884000-memory.dmp
memory/4584-67-0x0000000007DE0000-0x0000000007DF1000-memory.dmp
memory/4584-68-0x0000000007E10000-0x0000000007E1E000-memory.dmp
memory/4584-69-0x0000000007E20000-0x0000000007E34000-memory.dmp
memory/4584-70-0x0000000007F20000-0x0000000007F3A000-memory.dmp
memory/4584-71-0x0000000007F00000-0x0000000007F08000-memory.dmp
memory/4584-74-0x0000000074A50000-0x0000000075200000-memory.dmp
memory/4584-18-0x0000000005A60000-0x0000000006088000-memory.dmp
memory/4864-7-0x0000000005020000-0x0000000005038000-memory.dmp
memory/4864-40-0x0000000074A50000-0x0000000075200000-memory.dmp
memory/4864-11-0x000000000CE00000-0x000000000CE9C000-memory.dmp
memory/4864-10-0x0000000009CA0000-0x0000000009D60000-memory.dmp
memory/4864-9-0x0000000005390000-0x00000000053A4000-memory.dmp
memory/4864-8-0x0000000005380000-0x000000000538E000-memory.dmp
memory/4864-0-0x00000000002E0000-0x00000000003D6000-memory.dmp
memory/4864-6-0x0000000007790000-0x000000000786E000-memory.dmp
memory/4864-5-0x0000000004DA0000-0x0000000004DAA000-memory.dmp
memory/4864-4-0x0000000005060000-0x0000000005070000-memory.dmp
memory/4864-3-0x0000000004DF0000-0x0000000004E82000-memory.dmp
memory/4864-2-0x00000000053A0000-0x0000000005944000-memory.dmp
memory/4864-1-0x0000000074A50000-0x0000000075200000-memory.dmp