Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    24-07-2024 01:48

General

  • Target

    589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe

  • Size

    1.7MB

  • MD5

    658e8867a46096faafb9939ba1faeb1a

  • SHA1

    bfe077b029a1a6d4beeda154fa706f4ff0cfff82

  • SHA256

    589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a

  • SHA512

    ead89fa50f5c499e04fccf187257ca634d6168de6a662fa139282e871447a361ca33fd94a96b152a9324af2bc532c9fa2045af945dd0a86a11909aeac770689b

  • SSDEEP

    24576:WR3njD6TaOQ5KJh7WXePuq5LktSbm5ktGn:qjD65Q5Kz7WXJq5Lkt6m/n

Malware Config

Extracted

Family

remcos

Botnet

Dollar Man

C2

178.23.190.118:52499

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-SJ9MVF

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Detected Nirsoft tools 4 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe
    "C:\Users\Admin\AppData\Local\Temp\589b172cac7eb931e013d04820f31d1e7f6b7d710d1155dbb64ebb6c2fa2826a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2968
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
      2⤵
        PID:2536
      • C:\Windows\System32\svchost.exe
        "C:\Windows\System32\svchost.exe"
        2⤵
          PID:2312
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
          2⤵
            PID:2712
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
            2⤵
              PID:2796
            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
              2⤵
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2880
              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /stext "C:\Users\Admin\AppData\Local\Temp\nbaxtuupiysgloaspe"
                3⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1628
              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /stext "C:\Users\Admin\AppData\Local\Temp\xvgqumfjwgklvcwwgpkou"
                3⤵
                • Accesses Microsoft Outlook accounts
                • System Location Discovery: System Language Discovery
                PID:556
              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /stext "C:\Users\Admin\AppData\Local\Temp\zptivfqlspcyxikapafqfosd"
                3⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:1544
            • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
              "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
              2⤵
                PID:2600

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\ProgramData\remcos\logs.dat

              Filesize

              144B

              MD5

              a81c9318bc6e74457434009e6cd29591

              SHA1

              21ad528e56c8a3e304b54c0b79cbc85824eeed62

              SHA256

              d2d782040d30d7e0f29b66f2f056079016b250612579ee603d147ab2b933e378

              SHA512

              cd90bcb161069c1301e3330fb6270970c36d5f6fdbff531c4b8d988d63bfc3a8b2405d49c8e7bd6cc69118fa7798df05a788b82d4bb77aee4a47c3005bd600f4

            • C:\Users\Admin\AppData\Local\Temp\nbaxtuupiysgloaspe

              Filesize

              2B

              MD5

              f3b25701fe362ec84616a93a45ce9998

              SHA1

              d62636d8caec13f04e28442a0a6fa1afeb024bbb

              SHA256

              b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

              SHA512

              98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

            • memory/556-110-0x0000000000400000-0x0000000000462000-memory.dmp

              Filesize

              392KB

            • memory/556-100-0x0000000000400000-0x0000000000462000-memory.dmp

              Filesize

              392KB

            • memory/1628-99-0x0000000000400000-0x0000000000478000-memory.dmp

              Filesize

              480KB

            • memory/1628-107-0x0000000000400000-0x0000000000478000-memory.dmp

              Filesize

              480KB

            • memory/2536-12-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2536-4-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2536-16-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2536-14-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2536-10-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2536-18-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2536-8-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2536-6-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2880-122-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2880-70-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2880-71-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2880-72-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2968-77-0x000007FEF5050000-0x000007FEF5A3C000-memory.dmp

              Filesize

              9.9MB

            • memory/2968-3-0x000000001B440000-0x000000001B512000-memory.dmp

              Filesize

              840KB

            • memory/2968-2-0x000007FEF5050000-0x000007FEF5A3C000-memory.dmp

              Filesize

              9.9MB

            • memory/2968-0-0x000007FEF5053000-0x000007FEF5054000-memory.dmp

              Filesize

              4KB

            • memory/2968-1-0x0000000000E90000-0x0000000000EB8000-memory.dmp

              Filesize

              160KB