Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-05-2024 02:38

General

  • Target

    HSBC PAYMENT CONFIRMATION COPY.PDF.exe

  • Size

    692KB

  • MD5

    904ff58ae02442b30663c9be0f4d9e77

  • SHA1

    9009f89ab55e84c8bbf70303247c62f8048deb77

  • SHA256

    c4e9719f719092bcb6dac7893d6e3601a32ff93a9ff5d51ba55af82cebd902f5

  • SHA512

    46aceab3cd6a6ba0ad1405d4c4f124863f4fc07a5dd0ee7df2c210c285eeb0c367d91d4e7e6e7c4865e6f494dbd3c211fb09ff4485621f69e819be3ebbb722fa

  • SSDEEP

    12288:K2Co9kUzVAtb/WMdXDKDAObjsZt7P68BmPE:Kt39W8aTbjsH7P

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

93.95.115.2:9462

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-VI6D4O

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 6 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HSBC PAYMENT CONFIRMATION COPY.PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\HSBC PAYMENT CONFIRMATION COPY.PDF.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:224
    • C:\Users\Admin\AppData\Local\Temp\HSBC PAYMENT CONFIRMATION COPY.PDF.exe
      "C:\Users\Admin\AppData\Local\Temp\HSBC PAYMENT CONFIRMATION COPY.PDF.exe"
      2⤵
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3516
      • C:\Users\Admin\AppData\Local\Temp\HSBC PAYMENT CONFIRMATION COPY.PDF.exe
        "C:\Users\Admin\AppData\Local\Temp\HSBC PAYMENT CONFIRMATION COPY.PDF.exe" /stext "C:\Users\Admin\AppData\Local\Temp\isgrvjb"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4544
      • C:\Users\Admin\AppData\Local\Temp\HSBC PAYMENT CONFIRMATION COPY.PDF.exe
        "C:\Users\Admin\AppData\Local\Temp\HSBC PAYMENT CONFIRMATION COPY.PDF.exe" /stext "C:\Users\Admin\AppData\Local\Temp\smmcvbmhmb"
        3⤵
        • Accesses Microsoft Outlook accounts
        PID:996
      • C:\Users\Admin\AppData\Local\Temp\HSBC PAYMENT CONFIRMATION COPY.PDF.exe
        "C:\Users\Admin\AppData\Local\Temp\HSBC PAYMENT CONFIRMATION COPY.PDF.exe" /stext "C:\Users\Admin\AppData\Local\Temp\cozuwuwbajcyy"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3508

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\remcos\logs.dat

    Filesize

    144B

    MD5

    89b56c55bfb3dde8af9e3eaedec2938d

    SHA1

    cdb19a0ec9a711efb0c80aab1ceba1a6efc2057d

    SHA256

    59e4cf3e20e6483fe845c7648fb91982cbd809d3c2f58c0847179ce9476166a4

    SHA512

    a2f067697568e5f0b5592e535b8925fba6db549c59870a59d7cf5ab94181cbcb9c0714904003162dab128bdf7d620e4cd98de01e82dea157e627042715028dc3

  • C:\Users\Admin\AppData\Local\Temp\isgrvjb

    Filesize

    4KB

    MD5

    135c60fadfa99b241d9109417db8b53c

    SHA1

    b73785818a32e8d84bb55c02ccdc3d546a615526

    SHA256

    01fc52f877352f6252d3d9351993fc35d7b6b0051ac6d3146184e12f9bc6e704

    SHA512

    76812b91e51f1a206e3829b44cf13ee4cc4e5e90d88c0b0b3755b1e092eee26e6a4b18ef038a311a9443dab138761ff45fdd18145931207764c2355047611f51

  • C:\Users\Admin\AppData\Local\Temp\nsz518D.tmp\System.dll

    Filesize

    11KB

    MD5

    75ed96254fbf894e42058062b4b4f0d1

    SHA1

    996503f1383b49021eb3427bc28d13b5bbd11977

    SHA256

    a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7

    SHA512

    58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4

  • memory/224-16-0x0000000004A80000-0x0000000006AC0000-memory.dmp

    Filesize

    32.2MB

  • memory/224-17-0x0000000077241000-0x0000000077361000-memory.dmp

    Filesize

    1.1MB

  • memory/224-18-0x0000000073E94000-0x0000000073E95000-memory.dmp

    Filesize

    4KB

  • memory/224-24-0x0000000004A80000-0x0000000006AC0000-memory.dmp

    Filesize

    32.2MB

  • memory/996-36-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/996-42-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/996-27-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/996-37-0x0000000000400000-0x0000000000462000-memory.dmp

    Filesize

    392KB

  • memory/3508-28-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/3508-30-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/3508-35-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/3508-31-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/3516-19-0x0000000001730000-0x0000000003770000-memory.dmp

    Filesize

    32.2MB

  • memory/3516-56-0x00000000004D0000-0x0000000001724000-memory.dmp

    Filesize

    18.3MB

  • memory/3516-90-0x00000000004D0000-0x0000000001724000-memory.dmp

    Filesize

    18.3MB

  • memory/3516-87-0x00000000004D0000-0x0000000001724000-memory.dmp

    Filesize

    18.3MB

  • memory/3516-48-0x0000000034740000-0x0000000034759000-memory.dmp

    Filesize

    100KB

  • memory/3516-52-0x0000000034740000-0x0000000034759000-memory.dmp

    Filesize

    100KB

  • memory/3516-20-0x00000000004D0000-0x0000000001724000-memory.dmp

    Filesize

    18.3MB

  • memory/3516-51-0x0000000034740000-0x0000000034759000-memory.dmp

    Filesize

    100KB

  • memory/3516-53-0x00000000004D0000-0x0000000001724000-memory.dmp

    Filesize

    18.3MB

  • memory/3516-84-0x00000000004D0000-0x0000000001724000-memory.dmp

    Filesize

    18.3MB

  • memory/3516-58-0x0000000001730000-0x0000000003770000-memory.dmp

    Filesize

    32.2MB

  • memory/3516-60-0x00000000004D0000-0x0000000001724000-memory.dmp

    Filesize

    18.3MB

  • memory/3516-81-0x00000000004D0000-0x0000000001724000-memory.dmp

    Filesize

    18.3MB

  • memory/3516-63-0x00000000004D0000-0x0000000001724000-memory.dmp

    Filesize

    18.3MB

  • memory/3516-66-0x00000000004D0000-0x0000000001724000-memory.dmp

    Filesize

    18.3MB

  • memory/3516-78-0x00000000004D0000-0x0000000001724000-memory.dmp

    Filesize

    18.3MB

  • memory/4544-34-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4544-32-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4544-45-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB

  • memory/4544-26-0x0000000000400000-0x0000000000478000-memory.dmp

    Filesize

    480KB