Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
04-06-2024 13:52
General
-
Target
dfa64dc7ba3712eec6272c7284549f3f5f7f280eb45f33f2d943e189e7cdd056.exe
-
Size
1005KB
-
MD5
362f334df96de91f3bc1804514111a11
-
SHA1
b6cb9298287887ba02b99fe16da4f4956ce29658
-
SHA256
dfa64dc7ba3712eec6272c7284549f3f5f7f280eb45f33f2d943e189e7cdd056
-
SHA512
18c279c8dc1a7f05f71cba73427a0bf240a9f5dad63b636fbac8a02aef88685ff1d51bf3f349320277a421a3537068488068582c1e5d2b60f3f9b99353a18918
-
SSDEEP
24576:Tdnt4t3pfCejOh92+K0n3oFDQMibhNU08FDUvS:T0nj6l73olShSFDUa
Malware Config
Extracted
remcos
EZEMUO 2024
chimaasd.duckdns.org:1958
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-4TLB08
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
UAC bypass 3 TTPs 1 IoCs
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious behavior: MapViewOfSection 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfa64dc7ba3712eec6272c7284549f3f5f7f280eb45f33f2d943e189e7cdd056.exe"C:\Users\Admin\AppData\Local\Temp\dfa64dc7ba3712eec6272c7284549f3f5f7f280eb45f33f2d943e189e7cdd056.exe"1⤵
- UAC bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\dfa64dc7ba3712eec6272c7284549f3f5f7f280eb45f33f2d943e189e7cdd056.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"2⤵
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\vqtsxocxugevpyyzlcqi"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\gsylygnyiowazeulvndknmq"3⤵
- Accesses Microsoft Outlook accounts
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\qmddyyyswwofckipmpqdyzkcavf"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\Windows Mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Scripting
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD507a67434674e231574ef291e6cb0066d
SHA1d6eb41abfe55e388f5655fe72e5d290cf002f0a4
SHA25637b793505dcd07eddf057ee90f9141f76472235addd9eead57864fbffa075900
SHA51273c8a2c8210799ff06d76180993946500ae31d7eb3d03e1f98658dd8c45187f86f3cbb31719efa104ca90a06ae9fd950632db9e727d4216f1f45a7ffddd4cc47
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
4KB
-
Filesize
200KB
-
Filesize
9.9MB
-
Filesize
24KB
-
Filesize
832KB
-
Filesize
9.9MB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
512KB