Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
22/05/2024, 17:16
General
- Target 6c7572f38ec5853112211eb940751b660538d61f67ae8097c8435991768af98f.exe
- Size 1.5MB
- Sample240522-vtbyfaac4x
- SHA256 6c7572f38ec5853112211eb940751b660538d61f67ae8097c8435991768af98f
Malware Config
Extracted
-
remcos
-
Protected
-
janbours92harbu01.duckdns.org:3980
-
janbours92harbu01.duckdns.org:3981
-
janbours92harbu02.duckdns.org:3980
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
kajsoiestc.dat
-
keylog_flag
false
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
aksoiestgb-1YOAXH
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- UAC bypass 3 TTPs 1 IoCs
- Windows security bypass 2 TTPs 2 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
- NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
- Nirsoft 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Windows security modification 2 TTPs 3 IoCs
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c7572f38ec5853112211eb940751b660538d61f67ae8097c8435991768af98f.exe"C:\Users\Admin\AppData\Local\Temp\6c7572f38ec5853112211eb940751b660538d61f67ae8097c8435991768af98f.exe"1⤵
- UAC bypass
- Windows security bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\6c7572f38ec5853112211eb940751b660538d61f67ae8097c8435991768af98f.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\zxwhnwmrm"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\czjsopxsacyb"3⤵
- Accesses Microsoft Outlook accounts
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\mtplpzimwkqgnip"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
4Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_zyg3i3xn.wnq.ps1
zxwhnwmrm
memory/940-45-0x0000000000400000-0x0000000000478000-memory.dmp
memory/940-42-0x0000000000400000-0x0000000000478000-memory.dmp
memory/940-39-0x0000000000400000-0x0000000000478000-memory.dmp
memory/1908-3-0x00007FFBFBB50000-0x00007FFBFC611000-memory.dmp
memory/1908-4-0x000001AD7B620000-0x000001AD7B6F0000-memory.dmp
memory/1908-2-0x00007FFBFBB50000-0x00007FFBFC611000-memory.dmp
memory/1908-1-0x000001AD62A60000-0x000001AD62A6A000-memory.dmp
memory/1908-0-0x00007FFBFBB53000-0x00007FFBFBB55000-memory.dmp
memory/1908-29-0x00007FFBFBB50000-0x00007FFBFC611000-memory.dmp
memory/2404-43-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2404-44-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2404-41-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2568-33-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2568-56-0x0000000010000000-0x0000000010019000-memory.dmp
memory/2568-65-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2568-64-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2568-30-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2568-32-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2568-31-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2568-34-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2568-63-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2568-36-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2568-62-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2568-61-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2568-12-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2568-60-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2568-59-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2568-11-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2568-8-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2568-6-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2568-7-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2568-5-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2568-53-0x0000000010000000-0x0000000010019000-memory.dmp
memory/2568-57-0x0000000010000000-0x0000000010019000-memory.dmp
memory/2568-58-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3264-16-0x0000020F45DB0000-0x0000020F45DD2000-memory.dmp
memory/3264-13-0x00007FFBFBB53000-0x00007FFBFBB55000-memory.dmp
memory/3264-14-0x00007FFBFBB50000-0x00007FFBFC611000-memory.dmp
memory/3264-15-0x00007FFBFBB50000-0x00007FFBFC611000-memory.dmp
memory/3264-28-0x00007FFBFBB50000-0x00007FFBFC611000-memory.dmp
memory/4028-46-0x0000000000400000-0x0000000000462000-memory.dmp
memory/4028-47-0x0000000000400000-0x0000000000462000-memory.dmp
memory/4028-40-0x0000000000400000-0x0000000000462000-memory.dmp