Analysis
- max time kernel
148s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
15/05/2024, 01:32
General
- Target 841200c9e115b489adb33d27e4fcd1f6769609e5c378a45ef1d371200bd9a41c.exe
- Size 1.1MB
- Sample240515-bygvpsbb43
- SHA256 841200c9e115b489adb33d27e4fcd1f6769609e5c378a45ef1d371200bd9a41c
Malware Config
Extracted
-
remcos
-
RemoteHost
-
107.175.229.139:8087
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-TLPQMO
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 16 IoCs
- Detects executables built or packed with MPress PE compressor 12 IoCs
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
- Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs
- NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
- NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
- Nirsoft 3 IoCs
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: MapViewOfSection 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\841200c9e115b489adb33d27e4fcd1f6769609e5c378a45ef1d371200bd9a41c.exe"C:\Users\Admin\AppData\Local\Temp\841200c9e115b489adb33d27e4fcd1f6769609e5c378a45ef1d371200bd9a41c.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\extrac32.exeC:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\AppData\Local\Temp\841200c9e115b489adb33d27e4fcd1f6769609e5c378a45ef1d371200bd9a41c.exe C:\\Users\\Public\\Libraries\\Jsqwmpul.PIF2⤵
-
-
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\System32\colorcpl.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\vxjdgnedzusvffnkjxyygmndyf"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\frowgfpfnclihljwahlajqhmhlamgf"3⤵
- Accesses Microsoft Outlook accounts
-
-
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\ilcozyayjkdmrrxajsxtududqsjvzqbvb"3⤵
-
-
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\ilcozyayjkdmrrxajsxtududqsjvzqbvb"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
logs.dat
vxjdgnedzusvffnkjxyygmndyf
memory/1884-26-0x0000000000400000-0x0000000000478000-memory.dmp
memory/1884-21-0x0000000000400000-0x0000000000478000-memory.dmp
memory/1884-23-0x0000000000400000-0x0000000000478000-memory.dmp
memory/2124-25-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2124-28-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2124-29-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2876-0-0x0000000002300000-0x0000000002301000-memory.dmp
memory/2876-5-0x0000000000400000-0x0000000000517000-memory.dmp
memory/3232-22-0x0000000000400000-0x0000000000462000-memory.dmp
memory/3232-24-0x0000000000400000-0x0000000000462000-memory.dmp
memory/3232-27-0x0000000000400000-0x0000000000462000-memory.dmp
memory/4468-15-0x000000001C550000-0x000000001C5D2000-memory.dmp
memory/4468-13-0x000000001C550000-0x000000001C5D2000-memory.dmp
memory/4468-18-0x000000001C550000-0x000000001C5D2000-memory.dmp
memory/4468-17-0x000000001C550000-0x000000001C5D2000-memory.dmp
memory/4468-16-0x000000001C550000-0x000000001C5D2000-memory.dmp
memory/4468-7-0x000000001C550000-0x000000001C5D2000-memory.dmp
memory/4468-9-0x000000001C550000-0x000000001C5D2000-memory.dmp
memory/4468-11-0x000000001C550000-0x000000001C5D2000-memory.dmp
memory/4468-6-0x00000000047D0000-0x00000000057D0000-memory.dmp
memory/4468-20-0x000000001C550000-0x000000001C5D2000-memory.dmp
memory/4468-36-0x000000001C840000-0x000000001C859000-memory.dmp
memory/4468-40-0x000000001C840000-0x000000001C859000-memory.dmp
memory/4468-39-0x000000001C840000-0x000000001C859000-memory.dmp
memory/4468-41-0x000000001C550000-0x000000001C5D2000-memory.dmp
memory/4468-42-0x000000001C550000-0x000000001C5D2000-memory.dmp
memory/4468-43-0x000000001C550000-0x000000001C5D2000-memory.dmp
memory/4468-47-0x000000001C550000-0x000000001C5D2000-memory.dmp
memory/4468-12-0x000000001C550000-0x000000001C5D2000-memory.dmp
memory/4468-51-0x000000001C550000-0x000000001C5D2000-memory.dmp
memory/4468-52-0x000000001C550000-0x000000001C5D2000-memory.dmp