Analysis
- max time kernel
147s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240730-en - resource tags
- submitted
31/07/2024, 01:53
General
- Target d09e5aa4e74c009e6ec6b80ff7fe4da43eeb4640104c54036f40755f55767118.exe
- Size 534KB
- Sample240731-ca7lwsvdrf
- SHA256 d09e5aa4e74c009e6ec6b80ff7fe4da43eeb4640104c54036f40755f55767118
Malware Config
Extracted
-
remcos
-
RemoteHost
-
172.93.222.225:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-MX8NLB
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Detected Nirsoft tools 3 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
- NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Drops file in Program Files directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 15 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d09e5aa4e74c009e6ec6b80ff7fe4da43eeb4640104c54036f40755f55767118.exe"C:\Users\Admin\AppData\Local\Temp\d09e5aa4e74c009e6ec6b80ff7fe4da43eeb4640104c54036f40755f55767118.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Opildnende=Get-Content 'C:\Users\Admin\AppData\Local\Temp\Tilkendegivelses\dekanesses\Avanceringernes39\pocherende.Wis';$Omstaendighed=$Opildnende.SubString(6239,3);.$Omstaendighed($Opildnende)2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"3⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\stbdbldodwwzbgqopputfhvc"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\dnhvcdopreoelmnsyaguitqtcxzr"4⤵
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\dnhvcdopreoelmnsyaguitqtcxzr"4⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\fqmouwyjfmgrosbwplbwtycclljabfu"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
logs.dat
Occludes.Val
pocherende.Wis
__PSScriptPolicyTest_b4jl4jat.xmg.ps1
stbdbldodwwzbgqopputfhvc
memory/1396-57-0x0000000000400000-0x0000000000462000-memory.dmp
memory/1396-59-0x0000000000400000-0x0000000000462000-memory.dmp
memory/1396-56-0x0000000000400000-0x0000000000462000-memory.dmp
memory/1916-55-0x0000000000400000-0x0000000000478000-memory.dmp
memory/1916-54-0x0000000000400000-0x0000000000478000-memory.dmp
memory/1916-58-0x0000000000400000-0x0000000000478000-memory.dmp
memory/2020-47-0x0000000000800000-0x0000000001A54000-memory.dmp
memory/2020-72-0x000000001F910000-0x000000001F929000-memory.dmp
memory/2020-71-0x000000001F910000-0x000000001F929000-memory.dmp
memory/2020-78-0x0000000000800000-0x0000000001A54000-memory.dmp
memory/2020-75-0x0000000000800000-0x0000000001A54000-memory.dmp
memory/2020-81-0x0000000000800000-0x0000000001A54000-memory.dmp
memory/2020-68-0x000000001F910000-0x000000001F929000-memory.dmp
memory/2020-84-0x0000000000800000-0x0000000001A54000-memory.dmp
memory/2020-96-0x0000000000800000-0x0000000001A54000-memory.dmp
memory/2020-52-0x0000000000800000-0x0000000001A54000-memory.dmp
memory/2020-105-0x0000000000800000-0x0000000001A54000-memory.dmp
memory/2920-29-0x0000000006BB0000-0x0000000006BCA000-memory.dmp
memory/2920-33-0x0000000008940000-0x0000000008FBA000-memory.dmp
memory/2920-40-0x0000000008FC0000-0x000000000B477000-memory.dmp
memory/2920-42-0x000000007378E000-0x000000007378F000-memory.dmp
memory/2920-43-0x0000000073780000-0x0000000073F30000-memory.dmp
memory/2920-44-0x0000000073780000-0x0000000073F30000-memory.dmp
memory/2920-46-0x0000000073780000-0x0000000073F30000-memory.dmp
memory/2920-39-0x0000000073780000-0x0000000073F30000-memory.dmp
memory/2920-51-0x0000000073780000-0x0000000073F30000-memory.dmp
memory/2920-37-0x0000000073780000-0x0000000073F30000-memory.dmp
memory/2920-36-0x0000000073780000-0x0000000073F30000-memory.dmp
memory/2920-9-0x0000000001720000-0x0000000001756000-memory.dmp
memory/2920-10-0x0000000073780000-0x0000000073F30000-memory.dmp
memory/2920-11-0x00000000059A0000-0x0000000005FC8000-memory.dmp
memory/2920-35-0x0000000073780000-0x0000000073F30000-memory.dmp
memory/2920-41-0x0000000073780000-0x0000000073F30000-memory.dmp
memory/2920-31-0x0000000007D10000-0x00000000082B4000-memory.dmp
memory/2920-30-0x0000000006C00000-0x0000000006C22000-memory.dmp
memory/2920-8-0x000000007378E000-0x000000007378F000-memory.dmp
memory/2920-28-0x00000000076C0000-0x0000000007756000-memory.dmp
memory/2920-27-0x0000000006C40000-0x0000000006C8C000-memory.dmp
memory/2920-26-0x0000000006720000-0x000000000673E000-memory.dmp
memory/2920-16-0x00000000060B0000-0x0000000006404000-memory.dmp
memory/2920-15-0x0000000006040000-0x00000000060A6000-memory.dmp
memory/2920-14-0x0000000005FD0000-0x0000000006036000-memory.dmp
memory/2920-13-0x0000000073780000-0x0000000073F30000-memory.dmp
memory/2920-12-0x00000000056B0000-0x00000000056D2000-memory.dmp
memory/3232-60-0x0000000000400000-0x0000000000424000-memory.dmp
memory/3232-65-0x0000000000400000-0x0000000000424000-memory.dmp
memory/3232-61-0x0000000000400000-0x0000000000424000-memory.dmp