Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    25-07-2024 07:08

General

  • Target

    14729cf354a2bcd9a764ea35732b2ebc.exe

  • Size

    15.4MB

  • MD5

    14729cf354a2bcd9a764ea35732b2ebc

  • SHA1

    de5ab85e0531ffc7dcbde2dfa37111e90e212396

  • SHA256

    1bfbe3e1ad1988b74e65a9675a05c796d71fa728440afbcccc7afd12c92104ef

  • SHA512

    9c7754e704a5b594e1d48e69b08c489342c64e9ae34616661c04d376651308b60ccb38c48f474191ff897e96019873d078a422d312b92e9dac4b9312b7ae82fb

  • SSDEEP

    393216:84uckLcEl+yYTUKIKF4rBQQeOwR9Erj9vjNiDkN9UPZHw9C:DEcEsyHfbAvCRvBiD2fC

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

5.253.86.233:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-TNTD7F

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • UAC bypass 3 TTPs 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 9 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • System policy modification 1 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14729cf354a2bcd9a764ea35732b2ebc.exe
    "C:\Users\Admin\AppData\Local\Temp\14729cf354a2bcd9a764ea35732b2ebc.exe"
    1⤵
    • UAC bypass
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2572
    • C:\Users\Admin\AppData\Local\Temp\651\651.exe
      "C:\Users\Admin\AppData\Local\Temp\651\651.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2172
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\oks.exe
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\oks.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2984
        • C:\Windows\SysWOW64\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\1040.INF
          4⤵
          • System Location Discovery: System Language Discovery
          • Opens file in notepad (likely ransom note)
          PID:2676
        • C:\Users\Admin\AppData\Roaming\START.EXE
          "C:\Users\Admin\AppData\Roaming\START.EXE"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of NtCreateThreadExHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1976
          • C:\Users\Admin\AppData\Roaming\START.EXE
            "C:\Users\Admin\AppData\Roaming\START.EXE"
            5⤵
            • Loads dropped DLL
            PID:1400
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*madrePuta" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\ChromeUpdater.dll",EntryPoint /f & exit
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2352
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*madrePuta" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\ChromeUpdater.dll",EntryPoint /f
              6⤵
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              PID:2432
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 2172 -s 160
        3⤵
        • Loads dropped DLL
        PID:1840

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\borlndmm.dll

    Filesize

    2.8MB

    MD5

    0a59ba1ec5a791c0891678f3ac02852a

    SHA1

    fa03a911a3bd61ecd1b0ddd002ba12b629481eab

    SHA256

    334965e87da4a0cc19e62a7a773fdc7a23013162196e242690377ecb315549c0

    SHA512

    c8d366c32dd54ea7abe37332fa00dba3e94851ffedc295b828717e66e4cf0a2e012cf17a72c4a2d66d56cd2d0e0a3efc47fef36f4232a95a2095986fc40ba6f2

  • \Users\Admin\AppData\Local\Temp\651\651.exe

    Filesize

    7.7MB

    MD5

    186b6bf2fd5d1f3608f8c568a33aba2b

    SHA1

    03ac334f463e4125f0498cbe3a017c4e0dc9eec3

    SHA256

    82155ffb1e678544d90c4d3e7973029fa44936edc52e41bd99f22a51846e7755

    SHA512

    1bede595abf9ba44b0160f07a5a5b4de26b4dce9b5590c45af071d3d11565a92781356d12e127f732d1814f3b64feb8fc8e9e5d7366eee954cd450a919e9e9d3

  • \Users\Admin\AppData\Roaming\START.EXE

    Filesize

    1.6MB

    MD5

    8fefb5372a86943f8468f348df360a3e

    SHA1

    df18d766996b41e5fd678cdbb319b97fd1ca58b4

    SHA256

    a75db91dc62805ba25ce77ada06a10c6e202e698141f0673936342b3956ad734

    SHA512

    e9747d64401828db590093550f05c7014ae417025959925d29983fbd8b219cb733febb83926fcd90f07213fb2e69d582f3837e5321e809c08760710e950510cf

  • memory/1400-83-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-56-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-84-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-53-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/1400-86-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-57-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-59-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-115-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-51-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/1400-50-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1400-48-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-60-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-114-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-62-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-63-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-64-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-65-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-66-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-71-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-73-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-74-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-75-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-76-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-77-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-78-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-79-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-80-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-81-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-82-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-113-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-112-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-111-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-85-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-87-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-88-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-89-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-90-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-91-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-92-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-93-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-94-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-95-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-96-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-97-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-98-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-99-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-100-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-101-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-102-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-103-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-104-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-105-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-106-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-107-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-108-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-109-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1400-110-0x0000000000350000-0x00000000003D2000-memory.dmp

    Filesize

    520KB

  • memory/1976-46-0x0000000010000000-0x00000000102D7000-memory.dmp

    Filesize

    2.8MB

  • memory/1976-61-0x0000000000010000-0x00000000001A0000-memory.dmp

    Filesize

    1.6MB

  • memory/1976-55-0x0000000010000000-0x00000000102D7000-memory.dmp

    Filesize

    2.8MB

  • memory/2172-23-0x0000000002210000-0x0000000002220000-memory.dmp

    Filesize

    64KB

  • memory/2572-17-0x0000000000D50000-0x0000000000D51000-memory.dmp

    Filesize

    4KB