Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-07-2024 07:08

General

  • Target

    14729cf354a2bcd9a764ea35732b2ebc.exe

  • Size

    15.4MB

  • MD5

    14729cf354a2bcd9a764ea35732b2ebc

  • SHA1

    de5ab85e0531ffc7dcbde2dfa37111e90e212396

  • SHA256

    1bfbe3e1ad1988b74e65a9675a05c796d71fa728440afbcccc7afd12c92104ef

  • SHA512

    9c7754e704a5b594e1d48e69b08c489342c64e9ae34616661c04d376651308b60ccb38c48f474191ff897e96019873d078a422d312b92e9dac4b9312b7ae82fb

  • SSDEEP

    393216:84uckLcEl+yYTUKIKF4rBQQeOwR9Erj9vjNiDkN9UPZHw9C:DEcEsyHfbAvCRvBiD2fC

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

5.253.86.233:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-TNTD7F

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • UAC bypass 3 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • System policy modification 1 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14729cf354a2bcd9a764ea35732b2ebc.exe
    "C:\Users\Admin\AppData\Local\Temp\14729cf354a2bcd9a764ea35732b2ebc.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2576
    • C:\Users\Admin\AppData\Local\Temp\651\651.exe
      "C:\Users\Admin\AppData\Local\Temp\651\651.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3376
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\oks.exe
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\oks.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1236
        • C:\Windows\SysWOW64\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\1040.INF
          4⤵
          • System Location Discovery: System Language Discovery
          • Opens file in notepad (likely ransom note)
          PID:4196
        • C:\Users\Admin\AppData\Roaming\START.EXE
          "C:\Users\Admin\AppData\Roaming\START.EXE"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of NtCreateThreadExHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2308
          • C:\Users\Admin\AppData\Roaming\START.EXE
            "C:\Users\Admin\AppData\Roaming\START.EXE"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1512
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*madrePuta" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\ChromeUpdater.dll",EntryPoint /f & exit
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3108
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*madrePuta" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\ChromeUpdater.dll",EntryPoint /f
              6⤵
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              PID:1552

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\651\651.exe

    Filesize

    7.7MB

    MD5

    186b6bf2fd5d1f3608f8c568a33aba2b

    SHA1

    03ac334f463e4125f0498cbe3a017c4e0dc9eec3

    SHA256

    82155ffb1e678544d90c4d3e7973029fa44936edc52e41bd99f22a51846e7755

    SHA512

    1bede595abf9ba44b0160f07a5a5b4de26b4dce9b5590c45af071d3d11565a92781356d12e127f732d1814f3b64feb8fc8e9e5d7366eee954cd450a919e9e9d3

  • C:\Users\Admin\AppData\Roaming\START.EXE

    Filesize

    1.6MB

    MD5

    8fefb5372a86943f8468f348df360a3e

    SHA1

    df18d766996b41e5fd678cdbb319b97fd1ca58b4

    SHA256

    a75db91dc62805ba25ce77ada06a10c6e202e698141f0673936342b3956ad734

    SHA512

    e9747d64401828db590093550f05c7014ae417025959925d29983fbd8b219cb733febb83926fcd90f07213fb2e69d582f3837e5321e809c08760710e950510cf

  • C:\Users\Admin\AppData\Roaming\borlndmm.dll

    Filesize

    2.8MB

    MD5

    0a59ba1ec5a791c0891678f3ac02852a

    SHA1

    fa03a911a3bd61ecd1b0ddd002ba12b629481eab

    SHA256

    334965e87da4a0cc19e62a7a773fdc7a23013162196e242690377ecb315549c0

    SHA512

    c8d366c32dd54ea7abe37332fa00dba3e94851ffedc295b828717e66e4cf0a2e012cf17a72c4a2d66d56cd2d0e0a3efc47fef36f4232a95a2095986fc40ba6f2

  • memory/1512-81-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-109-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-82-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-53-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-84-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-58-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-59-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-60-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-111-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-61-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-62-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-63-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-64-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-65-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-66-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-67-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-68-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-69-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-70-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-71-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-72-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-73-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-74-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-75-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-76-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-77-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-78-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-79-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-80-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-51-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-55-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-56-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-47-0x00000000005F0000-0x00000000005F1000-memory.dmp

    Filesize

    4KB

  • memory/1512-85-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-86-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-87-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-88-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-89-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-90-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-91-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-92-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-93-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-94-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-95-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-96-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-97-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-98-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-99-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-100-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-101-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-102-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-103-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-104-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-105-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-106-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-107-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-108-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-83-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/1512-110-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2308-46-0x0000000010000000-0x00000000102D7000-memory.dmp

    Filesize

    2.8MB

  • memory/2308-54-0x0000000010000000-0x00000000102D7000-memory.dmp

    Filesize

    2.8MB

  • memory/2308-57-0x0000000000010000-0x00000000001A0000-memory.dmp

    Filesize

    1.6MB