Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    19-05-2024 01:10

General

  • Target

    CodeBlock-wallet_v1.3.1.exe

  • Size

    99.4MB

  • MD5

    51214f407f63fa8b44b168e7fb1af2a4

  • SHA1

    5d253f197114361a2f80ca0d0e2fed6834c97b2b

  • SHA256

    0afab6861707ce6ad25f50fdf52af8dc3e637ba4c0fac93443fe073274cdc742

  • SHA512

    e891b1eeb33b0f8a80af771bb0caea27f8e1e586277ed030e5091380a3933cb81a34b8fde1eade0db993f9dd661bee7f72fd6c2f7fe5fa2590c4530250513ca7

  • SSDEEP

    49152:4WGtLBcXqFpBR6SVb8kq4pgquLMMji4NYxtJpkxhGjIHTbG3335:MtLutqgwh4NYxtJpkxhGx333

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

22077

C2

195.54.170.36:22077

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    VB786YNr-ICKPAO

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CodeBlock-wallet_v1.3.1.exe
    "C:\Users\Admin\AppData\Local\Temp\CodeBlock-wallet_v1.3.1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2604
    • C:\Users\Admin\AppData\Local\Temp\CodeBlock-wallet_v1.3.1.exe
      "C:\Users\Admin\AppData\Local\Temp\CodeBlock-wallet_v1.3.1.exe" /VERYSILENT
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2356
      • C:\Users\Admin\AppData\Roaming\UniversalInstaller.exe
        "C:\Users\Admin\AppData\Roaming\UniversalInstaller.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2632
        • C:\Users\Admin\AppData\Roaming\ruzNode_test\UniversalInstaller.exe
          C:\Users\Admin\AppData\Roaming\ruzNode_test\UniversalInstaller.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1888
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\SysWOW64\cmd.exe
            5⤵
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:2924
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              6⤵
                PID:2564

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\c41721ef

      Filesize

      1.2MB

      MD5

      1437436fe8fbcaa1622b084a09e02034

      SHA1

      e313eb25c537421fcf8fbe34f3570bf827adb3b5

      SHA256

      33cd6347c80ddb24edbd9c16d7740ba7284a94230f7401997006da6516333cdc

      SHA512

      ebcc9b999e3d11940da7354dffcbcf0e89e75063f9114969691985adb2fd0cf204d9b1e88b2e0e940ac92e2702a04e651ae13d7578abd435b4b9ddbfa1f21f5a

    • C:\Users\Admin\AppData\Roaming\UIxMarketPlugin.dll

      Filesize

      1.6MB

      MD5

      d1ba9412e78bfc98074c5d724a1a87d6

      SHA1

      0572f98d78fb0b366b5a086c2a74cc68b771d368

      SHA256

      cbcea8f28d8916219d1e8b0a8ca2db17e338eb812431bc4ad0cb36c06fd67f15

      SHA512

      8765de36d3824b12c0a4478c31b985878d4811bd0e5b6fba4ea07f8c76340bd66a2da3490d4871b95d9a12f96efc25507dfd87f431de211664dbe9a9c914af6f

    • C:\Users\Admin\AppData\Roaming\bigmouth.ai

      Filesize

      947KB

      MD5

      2006f33bd138198426dd0029bfb59d78

      SHA1

      b6331330a0ac4eec341c1c9eeb6f2f8cd202d1e4

      SHA256

      33a2f64783b7ccd9f66145d9d7288bff62a4a89b5ee3c82f7f5fe8d1bf68581f

      SHA512

      9fd5b2280c80b953fa74a5e5a8278b85b229daca0dfce988d8dafa14bc6db8906811da3b4628f27336886de8495822a173c36a72cfd9b8a90fbd8327fed5b649

    • C:\Users\Admin\AppData\Roaming\nighttime.xlsx

      Filesize

      59KB

      MD5

      6c6f6a14e9d0a4a4cccf42c556fbd674

      SHA1

      171078d45ebc27f5a8e448dc451d4f94947d82e5

      SHA256

      3b5e6c71c2ffbfb6e2db0338d44df9c403aca7778f487543cc6a1cb07a9a21e3

      SHA512

      8757f66f912ffb888229dbf9d21243dc14888bf21c401818e467d5d12865c7430c48fa0a9c5e6b96db3305f8413f2fe1200dcd9e9325839758a8c6ecac09477e

    • C:\Users\Admin\AppData\Roaming\relay.dll

      Filesize

      1.5MB

      MD5

      26f5bc7e93d04836018674ea346fcfc7

      SHA1

      3b7d74663bfc45388c403d2b4e242df5ee18e8f0

      SHA256

      2da4a73ab27ca87449151f119852b16280c64c8f7f4a1f3170a27875ae577163

      SHA512

      7e59b552b3c4b1b5278ad65f2da91bae9e1e429863b8f629ee8522ef330fe0973bb5c52bc69c4cb0b2af92274c2630246403debc9596f211921ed91ba736d7b9

    • \Users\Admin\AppData\Roaming\UniversalInstaller.exe

      Filesize

      2.4MB

      MD5

      9fb4770ced09aae3b437c1c6eb6d7334

      SHA1

      fe54b31b0db8665aa5b22bed147e8295afc88a03

      SHA256

      a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3

      SHA512

      140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256

    • memory/1888-45-0x0000000073EA0000-0x0000000074014000-memory.dmp

      Filesize

      1.5MB

    • memory/1888-43-0x0000000073EA0000-0x0000000074014000-memory.dmp

      Filesize

      1.5MB

    • memory/1888-44-0x0000000076D00000-0x0000000076EA9000-memory.dmp

      Filesize

      1.7MB

    • memory/2356-20-0x0000000000400000-0x0000000000712000-memory.dmp

      Filesize

      3.1MB

    • memory/2564-109-0x00000000000D0000-0x0000000000153000-memory.dmp

      Filesize

      524KB

    • memory/2564-97-0x00000000000D0000-0x0000000000153000-memory.dmp

      Filesize

      524KB

    • memory/2564-108-0x00000000000D0000-0x0000000000153000-memory.dmp

      Filesize

      524KB

    • memory/2564-107-0x00000000000D0000-0x0000000000153000-memory.dmp

      Filesize

      524KB

    • memory/2564-110-0x00000000000D0000-0x0000000000153000-memory.dmp

      Filesize

      524KB

    • memory/2564-106-0x00000000000D0000-0x0000000000153000-memory.dmp

      Filesize

      524KB

    • memory/2564-96-0x0000000076D00000-0x0000000076EA9000-memory.dmp

      Filesize

      1.7MB

    • memory/2564-111-0x00000000000D0000-0x0000000000153000-memory.dmp

      Filesize

      524KB

    • memory/2564-101-0x00000000000D0000-0x0000000000153000-memory.dmp

      Filesize

      524KB

    • memory/2564-102-0x00000000000D0000-0x0000000000153000-memory.dmp

      Filesize

      524KB

    • memory/2564-103-0x00000000000D0000-0x0000000000153000-memory.dmp

      Filesize

      524KB

    • memory/2564-104-0x00000000000D0000-0x0000000000153000-memory.dmp

      Filesize

      524KB

    • memory/2564-105-0x00000000000D0000-0x0000000000153000-memory.dmp

      Filesize

      524KB

    • memory/2604-0-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

    • memory/2604-3-0x0000000000400000-0x0000000000712000-memory.dmp

      Filesize

      3.1MB

    • memory/2632-26-0x00000000740D0000-0x0000000074244000-memory.dmp

      Filesize

      1.5MB

    • memory/2632-27-0x0000000076D00000-0x0000000076EA9000-memory.dmp

      Filesize

      1.7MB

    • memory/2924-94-0x0000000073EA0000-0x0000000074014000-memory.dmp

      Filesize

      1.5MB

    • memory/2924-48-0x0000000076D00000-0x0000000076EA9000-memory.dmp

      Filesize

      1.7MB