Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    23-07-2024 06:40

General

  • Target

    DHL Shipment Document Waybill .exe

  • Size

    1.7MB

  • MD5

    658e8867a46096faafb9939ba1faeb1a

  • SHA1

    bfe077b029a1a6d4beeda154fa706f4ff0cfff82

  • SHA256

    589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a

  • SHA512

    ead89fa50f5c499e04fccf187257ca634d6168de6a662fa139282e871447a361ca33fd94a96b152a9324af2bc532c9fa2045af945dd0a86a11909aeac770689b

  • SSDEEP

    24576:WR3njD6TaOQ5KJh7WXePuq5LktSbm5ktGn:qjD65Q5Kz7WXJq5Lkt6m/n

Malware Config

Extracted

Family

remcos

Botnet

Dollar Man

C2

178.23.190.118:52499

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-SJ9MVF

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Detected Nirsoft tools 4 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Runs regedit.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DHL Shipment Document Waybill .exe
    "C:\Users\Admin\AppData\Local\Temp\DHL Shipment Document Waybill .exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2528
    • C:\Windows\regedit.exe
      "C:\Windows\regedit.exe"
      2⤵
      • Runs regedit.exe
      PID:2056
    • C:\Windows\System32\svchost.exe
      "C:\Windows\System32\svchost.exe"
      2⤵
        PID:716
      • C:\Windows\System32\calc.exe
        "C:\Windows\System32\calc.exe"
        2⤵
          PID:2860
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
          2⤵
            PID:2400
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
            2⤵
              PID:2788
            • C:\Windows\System32\notepad.exe
              "C:\Windows\System32\notepad.exe"
              2⤵
                PID:2784
              • C:\Program Files (x86)\Internet Explorer\iexplore.exe
                "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
                2⤵
                  PID:2740
                • C:\Program Files (x86)\Windows Mail\wab.exe
                  "C:\Program Files (x86)\Windows Mail\wab.exe"
                  2⤵
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of SetWindowsHookEx
                  PID:3040
                  • C:\Program Files (x86)\Windows Mail\wab.exe
                    "C:\Program Files (x86)\Windows Mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\wywqfevsgsresoprejcctffsexpdykxs"
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2112
                  • C:\Program Files (x86)\Windows Mail\wab.exe
                    "C:\Program Files (x86)\Windows Mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\hacj"
                    3⤵
                    • Accesses Microsoft Outlook accounts
                    PID:888
                  • C:\Program Files (x86)\Windows Mail\wab.exe
                    "C:\Program Files (x86)\Windows Mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\jupthhr"
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1964
                • C:\Program Files (x86)\Windows Mail\wab.exe
                  "C:\Program Files (x86)\Windows Mail\wab.exe"
                  2⤵
                    PID:2328

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\ProgramData\remcos\logs.dat

                  Filesize

                  144B

                  MD5

                  8acc7bf3bf8986fed8af634437a6808b

                  SHA1

                  5369e02b5cab76d204e188f64cde7505a4e17dfa

                  SHA256

                  27848fd3f4f16f52d97a054718d84aa6be081b0274f38d626a42066dc286ee53

                  SHA512

                  65bb72c6a5522b1914c3674452e3e39beabe267f51ff10c84d50afadfe1c275630d6cf1afe9ac535ab33f2bb9f77333c6a21cc172ed2f296cd213b4ac1003e05

                • C:\Users\Admin\AppData\Local\Temp\wywqfevsgsresoprejcctffsexpdykxs

                  Filesize

                  2B

                  MD5

                  f3b25701fe362ec84616a93a45ce9998

                  SHA1

                  d62636d8caec13f04e28442a0a6fa1afeb024bbb

                  SHA256

                  b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                  SHA512

                  98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                • memory/888-107-0x0000000000400000-0x0000000000462000-memory.dmp

                  Filesize

                  392KB

                • memory/888-116-0x0000000000400000-0x0000000000462000-memory.dmp

                  Filesize

                  392KB

                • memory/2056-4-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/2056-9-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/2056-10-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/2056-13-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/2056-12-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/2056-11-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/2056-8-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/2056-6-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/2112-113-0x0000000000400000-0x0000000000478000-memory.dmp

                  Filesize

                  480KB

                • memory/2112-106-0x0000000000400000-0x0000000000478000-memory.dmp

                  Filesize

                  480KB

                • memory/2528-78-0x000007FEF6660000-0x000007FEF704C000-memory.dmp

                  Filesize

                  9.9MB

                • memory/2528-0-0x000007FEF6663000-0x000007FEF6664000-memory.dmp

                  Filesize

                  4KB

                • memory/2528-3-0x000000001B4B0000-0x000000001B582000-memory.dmp

                  Filesize

                  840KB

                • memory/2528-2-0x000007FEF6660000-0x000007FEF704C000-memory.dmp

                  Filesize

                  9.9MB

                • memory/2528-1-0x00000000009C0000-0x00000000009E8000-memory.dmp

                  Filesize

                  160KB

                • memory/3040-79-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/3040-76-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB

                • memory/3040-126-0x0000000000400000-0x0000000000482000-memory.dmp

                  Filesize

                  520KB