Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
03/07/2024, 01:26
General
- Target Requirement reference for quotation.exe
- Size 3.2MB
- Sample240703-btrt4szfph
- SHA256 f49fc0151c871c2e0544b32f7c238c810988e9bd63cd2d691adb8f3a34ec02fb
Malware Config
Extracted
-
remcos
-
MyDesktop
-
157.254.236.96:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-GB22VA
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- UAC bypass 3 TTPs 1 IoCs
- Windows security bypass 2 TTPs 2 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
- NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
- Nirsoft 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Windows security modification 2 TTPs 3 IoCs
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 55 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Requirement reference for quotation.exe"C:\Users\Admin\AppData\Local\Temp\Requirement reference for quotation.exe"1⤵
- UAC bypass
- Windows security bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Requirement reference for quotation.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"2⤵
-
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe /stext "C:\Users\Admin\AppData\Local\Temp\ykdhpwxmeswckhtftoqqgwjzkyfet"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe /stext "C:\Users\Admin\AppData\Local\Temp\aeizqhhnsaohmvpjczdjrieqtfpnuqtp"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe /stext "C:\Users\Admin\AppData\Local\Temp\aeizqhhnsaohmvpjczdjrieqtfpnuqtp"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe /stext "C:\Users\Admin\AppData\Local\Temp\aeizqhhnsaohmvpjczdjrieqtfpnuqtp"3⤵
- Accesses Microsoft Outlook accounts
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe /stext "C:\Users\Admin\AppData\Local\Temp\kgos"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
4Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_5zfxazdh.cgi.ps1
ykdhpwxmeswckhtftoqqgwjzkyfet
memory/2232-38-0x0000000000400000-0x0000000000462000-memory.dmp
memory/2232-42-0x0000000000400000-0x0000000000462000-memory.dmp
memory/2232-35-0x0000000000400000-0x0000000000462000-memory.dmp
memory/2344-22-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2344-53-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2344-64-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2344-63-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2344-62-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2344-61-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2344-21-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2344-59-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2344-23-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2344-24-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2344-25-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2344-26-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2344-60-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2344-28-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2344-29-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2344-30-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2344-31-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2344-58-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2344-57-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2344-56-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2344-55-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2344-54-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2344-33-0x0000000000400000-0x0000000000482000-memory.dmp
memory/2344-52-0x0000000010000000-0x0000000010019000-memory.dmp
memory/2344-51-0x0000000010000000-0x0000000010019000-memory.dmp
memory/2344-48-0x0000000010000000-0x0000000010019000-memory.dmp
memory/2684-39-0x0000000000400000-0x0000000000478000-memory.dmp
memory/2684-34-0x0000000000400000-0x0000000000478000-memory.dmp
memory/2684-36-0x0000000000400000-0x0000000000478000-memory.dmp
memory/2896-40-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2896-41-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2896-37-0x0000000000400000-0x0000000000424000-memory.dmp
memory/3948-6-0x0000022B3B530000-0x0000022B3B552000-memory.dmp
memory/3948-20-0x00007FF820C30000-0x00007FF8216F1000-memory.dmp
memory/3948-17-0x00007FF820C30000-0x00007FF8216F1000-memory.dmp
memory/3948-16-0x00007FF820C30000-0x00007FF8216F1000-memory.dmp
memory/3948-5-0x00007FF820C30000-0x00007FF8216F1000-memory.dmp
memory/4860-3-0x0000018AB1DB0000-0x0000018AB1E82000-memory.dmp
memory/4860-2-0x0000018AB1A70000-0x0000018AB1A7C000-memory.dmp
memory/4860-1-0x00007FF820C33000-0x00007FF820C35000-memory.dmp
memory/4860-4-0x00007FF820C30000-0x00007FF8216F1000-memory.dmp
memory/4860-27-0x00007FF820C30000-0x00007FF8216F1000-memory.dmp
memory/4860-0-0x0000018A97500000-0x0000018A9750C000-memory.dmp