Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
06/08/2024, 14:22
General
- Target Payment Advice-BCS_ECS9522024072517150011_4137_952.PDF.exe
- Size 1.2MB
- Sample240806-rppf7avfld
- SHA256 f67f5bb3bd7ee0cdf4f4420f71bb13852f4f69687e8aba379cf45687fdda0bf7
Malware Config
Extracted
-
remcos
-
RemoteHost
-
127.0.0.1:59089
-
legacyrem.duckdns.org:59089
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-BF03RK
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- UAC bypass 3 TTPs 1 IoCs
- Windows security bypass 2 TTPs 2 IoCs
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Windows security modification 2 TTPs 3 IoCs
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Runs regedit.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522024072517150011_4137_952.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522024072517150011_4137_952.PDF.exe"1⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522024072517150011_4137_952.PDF.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵
-
-
C:\Windows\regedit.exe"C:\Windows\regedit.exe"2⤵
- Runs regedit.exe
-
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\mmnmnasebspzkyugysgttyqgy"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\wgsxotdxpaheumikhdbvellpyway"3⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" /stext "C:\Users\Admin\AppData\Local\Temp\higqglwzdqzqxseoqoowhqfghlkyxfq"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
logs.dat
__PSScriptPolicyTest_1l244cng.2pk.ps1
mmnmnasebspzkyugysgttyqgy
memory/1516-27-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2896-25-0x0000000000400000-0x0000000000478000-memory.dmp
memory/3404-26-0x0000000000400000-0x0000000000462000-memory.dmp
memory/4224-22-0x00007FFD48EB0000-0x00007FFD49971000-memory.dmp
memory/4224-1-0x000002BEF51E0000-0x000002BEF51EA000-memory.dmp
memory/4224-4-0x000002BEF7740000-0x000002BEF7812000-memory.dmp
memory/4224-3-0x00007FFD48EB0000-0x00007FFD49971000-memory.dmp
memory/4224-2-0x000002BEF6D40000-0x000002BEF6D46000-memory.dmp
memory/4224-0-0x00007FFD48EB3000-0x00007FFD48EB5000-memory.dmp
memory/4792-15-0x00007FFD48EB0000-0x00007FFD49971000-memory.dmp
memory/4792-16-0x00007FFD48EB0000-0x00007FFD49971000-memory.dmp
memory/4792-17-0x00007FFD48EB0000-0x00007FFD49971000-memory.dmp
memory/4792-20-0x00007FFD48EB0000-0x00007FFD49971000-memory.dmp
memory/4792-5-0x000001807CDD0000-0x000001807CDF2000-memory.dmp
memory/5032-21-0x0000000000400000-0x0000000000482000-memory.dmp