Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    26-07-2024 22:05

General

  • Target

    5e6b147668a2daabdd48ab5a50fe6c00N.exe

  • Size

    951KB

  • MD5

    5e6b147668a2daabdd48ab5a50fe6c00

  • SHA1

    a774fbecb16314b81d396cfac947f5be4f095a2b

  • SHA256

    f621ac8874113a6d73876f515e423ca6828c2a7c369e3d87de7e27aeaca926a6

  • SHA512

    bc1b385e00420382c12b6261193535bf9b2932c0c48faba1edc6a4b571a33bf15793908e5cea9ad09222606c9cd662828ddfb702a6c33948bcd93d607f79a5d1

  • SSDEEP

    12288:vIQIr1yi6GQd9HZ5UtcHRhBsLFw3uKeNwv1gfUduAK5eMfT5y3px3I6z7wjx:vOrwl59HZWOxhBsTjNxfUSXAo

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

103.77.243.244:3729

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-GJBYIR

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5e6b147668a2daabdd48ab5a50fe6c00N.exe
    "C:\Users\Admin\AppData\Local\Temp\5e6b147668a2daabdd48ab5a50fe6c00N.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2012
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5e6b147668a2daabdd48ab5a50fe6c00N.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:876
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nvwqfCzFzLNjg.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2828
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nvwqfCzFzLNjg" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF73A.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2852
    • C:\Users\Admin\AppData\Local\Temp\5e6b147668a2daabdd48ab5a50fe6c00N.exe
      "C:\Users\Admin\AppData\Local\Temp\5e6b147668a2daabdd48ab5a50fe6c00N.exe"
      2⤵
        PID:2640
      • C:\Users\Admin\AppData\Local\Temp\5e6b147668a2daabdd48ab5a50fe6c00N.exe
        "C:\Users\Admin\AppData\Local\Temp\5e6b147668a2daabdd48ab5a50fe6c00N.exe"
        2⤵
          PID:2668
        • C:\Users\Admin\AppData\Local\Temp\5e6b147668a2daabdd48ab5a50fe6c00N.exe
          "C:\Users\Admin\AppData\Local\Temp\5e6b147668a2daabdd48ab5a50fe6c00N.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2696

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\tmpF73A.tmp

        Filesize

        1KB

        MD5

        1b0a6147bcb481c2e00747e6f3eadc0e

        SHA1

        f5dc07d3f025589e8f72789a6ee7ca4f24ed225b

        SHA256

        a04e3a209fbe553e08c5f4d06afe0d7ddbcb92c05dbe9e319c5d0578d2a49e8e

        SHA512

        23f6a62a39513f49bd6d8fa7e8c68086a0789fcb518dcf37db9296b72f191c6e185f03273268137df550b29f86047ad205df63a95db370fd81393d1ee5a9aa7e

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\I6PXFOU9Z9OF4WFYOJLD.temp

        Filesize

        7KB

        MD5

        ada4702242251a22cf5239e41dfc4067

        SHA1

        fc4a1735c18e8c206f287f12d28877812303da9e

        SHA256

        2b1c3a624f91b3541fdd963d85dab2f49d2ded3a630d3061edace19706e3e2d2

        SHA512

        c728f6d9c80b0a3f9aff642d4a534da134ba491181f7f8414a4363f6623a441785b75d213295902aeed295d823516bbec92c93d5f5833a87cd5338020f151674

      • memory/2012-0-0x000000007495E000-0x000000007495F000-memory.dmp

        Filesize

        4KB

      • memory/2012-1-0x0000000000E70000-0x0000000000F64000-memory.dmp

        Filesize

        976KB

      • memory/2012-2-0x0000000074950000-0x000000007503E000-memory.dmp

        Filesize

        6.9MB

      • memory/2012-3-0x0000000004FD0000-0x00000000050B0000-memory.dmp

        Filesize

        896KB

      • memory/2012-4-0x0000000000610000-0x0000000000624000-memory.dmp

        Filesize

        80KB

      • memory/2012-5-0x0000000000A00000-0x0000000000A0A000-memory.dmp

        Filesize

        40KB

      • memory/2012-6-0x0000000000A20000-0x0000000000A2E000-memory.dmp

        Filesize

        56KB

      • memory/2012-7-0x00000000050B0000-0x0000000005170000-memory.dmp

        Filesize

        768KB

      • memory/2012-41-0x0000000074950000-0x000000007503E000-memory.dmp

        Filesize

        6.9MB

      • memory/2696-32-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2696-22-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2696-37-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2696-36-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2696-34-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2696-38-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2696-30-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2696-20-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2696-28-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2696-26-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2696-24-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2696-39-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2696-40-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2696-42-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2696-43-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2696-44-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2696-48-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2696-47-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2696-49-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2696-50-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2696-51-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2696-52-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2696-53-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2696-54-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB