Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-07-2024 02:07

General

  • Target

    71f697fbfa6976c3bac86e640c707e329826f2443aceb23121635e84ac7c3479.exe

  • Size

    875KB

  • MD5

    b29eb1b413376848dc700b96a393ab98

  • SHA1

    26b86ed9263feae50c905fd8aac0ba6257cbbd14

  • SHA256

    71f697fbfa6976c3bac86e640c707e329826f2443aceb23121635e84ac7c3479

  • SHA512

    e88673ea821df08febed19f9f22df23eb4d1c95db6ca9e44c405f0d30cf8d7059fae59590ed032a63643fbce827a97e8c4e2f6c7833e9c43da3b8e215e1f772c

  • SSDEEP

    12288:YdbUDRl8U+i+U7o9l6eZi/0K+GKS8Dk3M1DgteFpLXV:MalWi+U7Ylc/H+A8AcRFpLX

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

sembe.duckdns.org:14645

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    nots.dat

  • keylog_flag

    false

  • keylog_folder

    note

  • keylog_path

    %Temp%

  • mouse_option

    false

  • mutex

    Rmc-999Z97

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71f697fbfa6976c3bac86e640c707e329826f2443aceb23121635e84ac7c3479.exe
    "C:\Users\Admin\AppData\Local\Temp\71f697fbfa6976c3bac86e640c707e329826f2443aceb23121635e84ac7c3479.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2272
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4500

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\note\nots.dat

    Filesize

    144B

    MD5

    97059bc7c02796ce532fe08379d8eea4

    SHA1

    cffeabe7a9a7f95b72ee85e2554b644daef4458c

    SHA256

    b689fbba8acaf27b4048b1b8b2c3326165617f29d305423d35d70560274bf2a5

    SHA512

    9dc70409e80647750dfe9a95c86fe258e5800b55fd946f8a95d7ab678da1679ab9662266127b148001f5c325752913c2cac7b0fd6d21aec9fbefa68f563e0aff

  • memory/2272-14-0x0000000006160000-0x0000000006166000-memory.dmp

    Filesize

    24KB

  • memory/2272-1-0x0000000000D50000-0x0000000000E30000-memory.dmp

    Filesize

    896KB

  • memory/2272-3-0x0000000075130000-0x00000000758E0000-memory.dmp

    Filesize

    7.7MB

  • memory/2272-4-0x000000007513E000-0x000000007513F000-memory.dmp

    Filesize

    4KB

  • memory/2272-5-0x00000000098F0000-0x0000000009BB2000-memory.dmp

    Filesize

    2.8MB

  • memory/2272-6-0x000000000F830000-0x000000000FDD4000-memory.dmp

    Filesize

    5.6MB

  • memory/2272-7-0x0000000005CD0000-0x0000000005D62000-memory.dmp

    Filesize

    584KB

  • memory/2272-8-0x0000000005C60000-0x0000000005C6A000-memory.dmp

    Filesize

    40KB

  • memory/2272-9-0x0000000006040000-0x0000000006046000-memory.dmp

    Filesize

    24KB

  • memory/2272-10-0x0000000075130000-0x00000000758E0000-memory.dmp

    Filesize

    7.7MB

  • memory/2272-11-0x0000000075130000-0x00000000758E0000-memory.dmp

    Filesize

    7.7MB

  • memory/2272-12-0x0000000075130000-0x00000000758E0000-memory.dmp

    Filesize

    7.7MB

  • memory/2272-13-0x0000000005BF0000-0x0000000005C0A000-memory.dmp

    Filesize

    104KB

  • memory/2272-2-0x0000000005200000-0x000000000529C000-memory.dmp

    Filesize

    624KB

  • memory/2272-22-0x0000000075130000-0x00000000758E0000-memory.dmp

    Filesize

    7.7MB

  • memory/2272-0-0x000000007513E000-0x000000007513F000-memory.dmp

    Filesize

    4KB

  • memory/4500-18-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4500-21-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4500-15-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4500-23-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4500-25-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4500-24-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4500-26-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4500-33-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4500-34-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4500-17-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4500-41-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4500-42-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB