Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-07-2024 06:32

General

  • Target

    5d0fc271f0606b92ab5c9ad53a790cb0N.exe

  • Size

    1.8MB

  • MD5

    5d0fc271f0606b92ab5c9ad53a790cb0

  • SHA1

    c127a41f0cbd5fdb93126f99df6b411db705051c

  • SHA256

    5046511eb489387b7a835a990ea3b36b77185f3fad905511c4bce30aa654c60b

  • SHA512

    295be396acfb54e1211a54479aa628d67ba6e0658533724b9b19e904bbbc509170fe53b3d4b179a7837f766a29a83d86d24baf8fdd52ae5068b83bd5f00ed7e5

  • SSDEEP

    49152:9ayHCQ8W4dod2vKSsd4rGj8fCs4bIwaRsAOwcd0bVNtcqOjLc:UE8oQvj+wpwaqAOd0JcqY

Malware Config

Extracted

Family

remcos

Botnet

spacolombia2707RAPTOR

C2

areaseguras.con-ip.com:2707

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    loggsdSSC

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    Rmc121455011-7TOVMS

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5d0fc271f0606b92ab5c9ad53a790cb0N.exe
    "C:\Users\Admin\AppData\Local\Temp\5d0fc271f0606b92ab5c9ad53a790cb0N.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Users\Admin\AppData\Local\Temp\5d0fc271f0606b92ab5c9ad53a790cb0N.exe
      "C:\Users\Admin\AppData\Local\Temp\5d0fc271f0606b92ab5c9ad53a790cb0N.exe"
      2⤵
      • Suspicious use of SetWindowsHookEx
      PID:4412

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\loggsdSSC\logs.dat

    Filesize

    184B

    MD5

    82c3adf6dd74b41775765e289e479b5e

    SHA1

    895191e89f044cb21afaab41e38355b91c231597

    SHA256

    6f0b216b78efa2d2e9162386e187a62038edf686552f00c77b32a0b85c8eb404

    SHA512

    76beeaaf3d3b01c02aa1e9dcd322d4a1d167438b140888cee7c7fc500124acdea59ab8b6f329adb36a907ad3b185093d69b69ba93410f959fcd0fd5a6a040ba1

  • memory/1992-54-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-24-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-3-0x0000000005430000-0x00000000055F8000-memory.dmp

    Filesize

    1.8MB

  • memory/1992-4-0x0000000005740000-0x000000000599C000-memory.dmp

    Filesize

    2.4MB

  • memory/1992-12-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-22-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-16-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-14-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-10-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-6-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-8-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-5-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-18-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-28-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-58-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-68-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-50-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-64-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-62-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-61-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-56-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-0-0x0000000074F5E000-0x0000000074F5F000-memory.dmp

    Filesize

    4KB

  • memory/1992-46-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-1-0x00000000008B0000-0x0000000000A88000-memory.dmp

    Filesize

    1.8MB

  • memory/1992-66-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-52-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-44-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-42-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-38-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-36-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-34-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-32-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-30-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-26-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-2-0x0000000074F50000-0x0000000075700000-memory.dmp

    Filesize

    7.7MB

  • memory/1992-20-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-40-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/1992-4867-0x0000000074F50000-0x0000000075700000-memory.dmp

    Filesize

    7.7MB

  • memory/1992-4868-0x0000000005690000-0x000000000572A000-memory.dmp

    Filesize

    616KB

  • memory/1992-4869-0x00000000059D0000-0x0000000005A1C000-memory.dmp

    Filesize

    304KB

  • memory/1992-4870-0x0000000006340000-0x00000000068E4000-memory.dmp

    Filesize

    5.6MB

  • memory/1992-4871-0x0000000005BA0000-0x0000000005BF4000-memory.dmp

    Filesize

    336KB

  • memory/1992-4878-0x0000000074F50000-0x0000000075700000-memory.dmp

    Filesize

    7.7MB

  • memory/1992-48-0x0000000005740000-0x0000000005995000-memory.dmp

    Filesize

    2.3MB

  • memory/4412-4877-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4412-4895-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB