Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-07-2024 01:42

General

  • Target

    1bfbe3e1ad1988b74e65a9675a05c796d71fa728440afbcccc7afd12c92104ef.exe

  • Size

    15.4MB

  • MD5

    14729cf354a2bcd9a764ea35732b2ebc

  • SHA1

    de5ab85e0531ffc7dcbde2dfa37111e90e212396

  • SHA256

    1bfbe3e1ad1988b74e65a9675a05c796d71fa728440afbcccc7afd12c92104ef

  • SHA512

    9c7754e704a5b594e1d48e69b08c489342c64e9ae34616661c04d376651308b60ccb38c48f474191ff897e96019873d078a422d312b92e9dac4b9312b7ae82fb

  • SSDEEP

    393216:84uckLcEl+yYTUKIKF4rBQQeOwR9Erj9vjNiDkN9UPZHw9C:DEcEsyHfbAvCRvBiD2fC

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

5.253.86.233:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-TNTD7F

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • UAC bypass 3 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • System policy modification 1 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1bfbe3e1ad1988b74e65a9675a05c796d71fa728440afbcccc7afd12c92104ef.exe
    "C:\Users\Admin\AppData\Local\Temp\1bfbe3e1ad1988b74e65a9675a05c796d71fa728440afbcccc7afd12c92104ef.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2560
    • C:\Users\Admin\AppData\Local\Temp\651\651.exe
      "C:\Users\Admin\AppData\Local\Temp\651\651.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2856
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\oks.exe
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\oks.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3024
        • C:\Windows\SysWOW64\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\1040.INF
          4⤵
          • System Location Discovery: System Language Discovery
          • Opens file in notepad (likely ransom note)
          PID:4344
        • C:\Users\Admin\AppData\Roaming\START.EXE
          "C:\Users\Admin\AppData\Roaming\START.EXE"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of NtCreateThreadExHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2696
          • C:\Users\Admin\AppData\Roaming\START.EXE
            "C:\Users\Admin\AppData\Roaming\START.EXE"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2464
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*madrePuta" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\ChromeUpdater.dll",EntryPoint /f & exit
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4056
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*madrePuta" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\ChromeUpdater.dll",EntryPoint /f
              6⤵
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              PID:3212

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\651\651.exe

    Filesize

    7.7MB

    MD5

    186b6bf2fd5d1f3608f8c568a33aba2b

    SHA1

    03ac334f463e4125f0498cbe3a017c4e0dc9eec3

    SHA256

    82155ffb1e678544d90c4d3e7973029fa44936edc52e41bd99f22a51846e7755

    SHA512

    1bede595abf9ba44b0160f07a5a5b4de26b4dce9b5590c45af071d3d11565a92781356d12e127f732d1814f3b64feb8fc8e9e5d7366eee954cd450a919e9e9d3

  • C:\Users\Admin\AppData\Roaming\START.EXE

    Filesize

    1.6MB

    MD5

    8fefb5372a86943f8468f348df360a3e

    SHA1

    df18d766996b41e5fd678cdbb319b97fd1ca58b4

    SHA256

    a75db91dc62805ba25ce77ada06a10c6e202e698141f0673936342b3956ad734

    SHA512

    e9747d64401828db590093550f05c7014ae417025959925d29983fbd8b219cb733febb83926fcd90f07213fb2e69d582f3837e5321e809c08760710e950510cf

  • C:\Users\Admin\AppData\Roaming\borlndmm.dll

    Filesize

    2.8MB

    MD5

    0a59ba1ec5a791c0891678f3ac02852a

    SHA1

    fa03a911a3bd61ecd1b0ddd002ba12b629481eab

    SHA256

    334965e87da4a0cc19e62a7a773fdc7a23013162196e242690377ecb315549c0

    SHA512

    c8d366c32dd54ea7abe37332fa00dba3e94851ffedc295b828717e66e4cf0a2e012cf17a72c4a2d66d56cd2d0e0a3efc47fef36f4232a95a2095986fc40ba6f2

  • memory/2464-53-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-51-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-47-0x00000000005F0000-0x00000000005F1000-memory.dmp

    Filesize

    4KB

  • memory/2464-56-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-55-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-58-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-59-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-60-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-61-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-62-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-63-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-64-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-65-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-66-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-67-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-68-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-69-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-70-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-71-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-72-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-73-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-74-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-75-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-76-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-77-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-78-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-79-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-80-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-81-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-82-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-83-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-84-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-85-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-86-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-87-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-88-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-89-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-90-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-91-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-92-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-93-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-94-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-95-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-96-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-97-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-98-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-99-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-100-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-101-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-102-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-103-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-104-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-105-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-106-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-107-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-108-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-109-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-110-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2464-111-0x0000000000560000-0x00000000005E2000-memory.dmp

    Filesize

    520KB

  • memory/2696-46-0x0000000010000000-0x00000000102D7000-memory.dmp

    Filesize

    2.8MB

  • memory/2696-49-0x0000000010000000-0x00000000102D7000-memory.dmp

    Filesize

    2.8MB

  • memory/2696-57-0x0000000000010000-0x00000000001A0000-memory.dmp

    Filesize

    1.6MB