Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-07-2024 08:06

General

  • Target

    14729cf354a2bcd9a764ea35732b2ebc.exe

  • Size

    15.4MB

  • MD5

    14729cf354a2bcd9a764ea35732b2ebc

  • SHA1

    de5ab85e0531ffc7dcbde2dfa37111e90e212396

  • SHA256

    1bfbe3e1ad1988b74e65a9675a05c796d71fa728440afbcccc7afd12c92104ef

  • SHA512

    9c7754e704a5b594e1d48e69b08c489342c64e9ae34616661c04d376651308b60ccb38c48f474191ff897e96019873d078a422d312b92e9dac4b9312b7ae82fb

  • SSDEEP

    393216:84uckLcEl+yYTUKIKF4rBQQeOwR9Erj9vjNiDkN9UPZHw9C:DEcEsyHfbAvCRvBiD2fC

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

5.253.86.233:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-TNTD7F

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • UAC bypass 3 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • System policy modification 1 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14729cf354a2bcd9a764ea35732b2ebc.exe
    "C:\Users\Admin\AppData\Local\Temp\14729cf354a2bcd9a764ea35732b2ebc.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1104
    • C:\Users\Admin\AppData\Local\Temp\651\651.exe
      "C:\Users\Admin\AppData\Local\Temp\651\651.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4772
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\oks.exe
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\oks.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1768
        • C:\Windows\SysWOW64\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\1040.INF
          4⤵
          • System Location Discovery: System Language Discovery
          • Opens file in notepad (likely ransom note)
          PID:4296
        • C:\Users\Admin\AppData\Roaming\START.EXE
          "C:\Users\Admin\AppData\Roaming\START.EXE"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of NtCreateThreadExHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:456
          • C:\Users\Admin\AppData\Roaming\START.EXE
            "C:\Users\Admin\AppData\Roaming\START.EXE"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4292
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*madrePuta" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\ChromeUpdater.dll",EntryPoint /f & exit
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4056
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*madrePuta" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\ChromeUpdater.dll",EntryPoint /f
              6⤵
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              PID:4364

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\651\651.exe

    Filesize

    7.7MB

    MD5

    186b6bf2fd5d1f3608f8c568a33aba2b

    SHA1

    03ac334f463e4125f0498cbe3a017c4e0dc9eec3

    SHA256

    82155ffb1e678544d90c4d3e7973029fa44936edc52e41bd99f22a51846e7755

    SHA512

    1bede595abf9ba44b0160f07a5a5b4de26b4dce9b5590c45af071d3d11565a92781356d12e127f732d1814f3b64feb8fc8e9e5d7366eee954cd450a919e9e9d3

  • C:\Users\Admin\AppData\Roaming\START.EXE

    Filesize

    1.6MB

    MD5

    8fefb5372a86943f8468f348df360a3e

    SHA1

    df18d766996b41e5fd678cdbb319b97fd1ca58b4

    SHA256

    a75db91dc62805ba25ce77ada06a10c6e202e698141f0673936342b3956ad734

    SHA512

    e9747d64401828db590093550f05c7014ae417025959925d29983fbd8b219cb733febb83926fcd90f07213fb2e69d582f3837e5321e809c08760710e950510cf

  • C:\Users\Admin\AppData\Roaming\borlndmm.dll

    Filesize

    2.8MB

    MD5

    0a59ba1ec5a791c0891678f3ac02852a

    SHA1

    fa03a911a3bd61ecd1b0ddd002ba12b629481eab

    SHA256

    334965e87da4a0cc19e62a7a773fdc7a23013162196e242690377ecb315549c0

    SHA512

    c8d366c32dd54ea7abe37332fa00dba3e94851ffedc295b828717e66e4cf0a2e012cf17a72c4a2d66d56cd2d0e0a3efc47fef36f4232a95a2095986fc40ba6f2

  • memory/456-46-0x0000000010000000-0x00000000102D7000-memory.dmp

    Filesize

    2.8MB

  • memory/456-50-0x0000000010000000-0x00000000102D7000-memory.dmp

    Filesize

    2.8MB

  • memory/456-58-0x0000000000010000-0x00000000001A0000-memory.dmp

    Filesize

    1.6MB

  • memory/4292-47-0x00000000005F0000-0x00000000005F1000-memory.dmp

    Filesize

    4KB

  • memory/4292-53-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-56-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-51-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-54-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-57-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-59-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-60-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-61-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-62-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-63-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-64-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-65-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-66-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-67-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-68-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-69-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-70-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-71-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-72-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-73-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-74-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-75-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-76-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-77-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-78-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-79-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-80-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-81-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-82-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-83-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-84-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-85-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-86-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-87-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-88-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-89-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-90-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-91-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-92-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-93-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-94-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-95-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-96-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-97-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-98-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-99-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-100-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-101-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-102-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-103-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-104-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-105-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-106-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-107-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-108-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-109-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-110-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/4292-111-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB