Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-07-2024 04:57

General

  • Target

    fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exe

  • Size

    1.3MB

  • MD5

    f3dcd81603a7b53421fcedce515a7c80

  • SHA1

    6f5e15a2415801651cbe54b63eeaddd7df07ab45

  • SHA256

    fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab

  • SHA512

    f5e969de331afee0b3bed2a58d5159d95c9bbe93eb419980fe061cdcac8de94cc4dfcdd917951c9b6af0003f58f737f7716884472b1fb11a334af78073f51220

  • SSDEEP

    24576:fAHnh+eWsN3skA4RV1Hom2KXMmHaRJKismWzPkXLPsvfOo/LwJ5:Ch+ZkldoPK8YaRlEbk7Psvf4

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

Ranko7

C2

kennyremcosbelintourismedleonline.gleeze.com:7027

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-OEVWWH

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exe
    "C:\Users\Admin\AppData\Local\Temp\fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5068
    • C:\Users\Admin\AppData\Local\caprone\nouses.exe
      "C:\Users\Admin\AppData\Local\Temp\fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:3036
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab.exe"
        3⤵
          PID:816

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\chiffons

      Filesize

      28KB

      MD5

      afaf8231eb3ca65fab3692ce2bc01752

      SHA1

      7423205a0a2ba079d87afcd696514d7774a5a767

      SHA256

      1530b374165530f6156105c241b036bd707eda46030e48d8a2ca5a80de042e95

      SHA512

      7cd28b7e9ca7bb8321a2b4c7063d304dd3cb0aa47e2f1d77efd83846845edb630fc7d7027fed072b96703f651c65ed2b2ea629deb9fd4d9891fa9df5f186cb4e

    • C:\Users\Admin\AppData\Local\Temp\oxmanship

      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • C:\Users\Admin\AppData\Local\caprone\nouses.exe

      Filesize

      1.3MB

      MD5

      f3dcd81603a7b53421fcedce515a7c80

      SHA1

      6f5e15a2415801651cbe54b63eeaddd7df07ab45

      SHA256

      fdd56eff190fb7974b5432cafd9f0071049c37c853f229ffb69400e9687f49ab

      SHA512

      f5e969de331afee0b3bed2a58d5159d95c9bbe93eb419980fe061cdcac8de94cc4dfcdd917951c9b6af0003f58f737f7716884472b1fb11a334af78073f51220

    • memory/816-34-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/816-36-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/816-29-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/816-30-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/816-31-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/816-32-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/816-33-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/816-46-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/816-35-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/816-28-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/816-37-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/816-38-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/816-39-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/816-40-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/816-41-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/816-42-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/816-43-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/816-44-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/816-45-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/5068-10-0x00000000011B0000-0x00000000011B4000-memory.dmp

      Filesize

      16KB