Analysis

  • max time kernel
    148s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    13-08-2024 08:36

General

  • Target

    Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe

  • Size

    1.2MB

  • MD5

    d70fa5471771d18888f0861ac060a914

  • SHA1

    83ef28ef9e4850629433f497fd0360120449e297

  • SHA256

    31a7e70deb8af07d7b76b5dea8cbf90ec63bea24bffdd5ebac6f223c02f55753

  • SHA512

    af89922e5a24a12522603e4a034b2e1aef911d5cf6399de426aa95b971dcf70513a99f45033895939f0475d7b001054717c9b0d38278ff45ee2b41376f3da31b

  • SSDEEP

    24576:UMa3J1TbjIuI1OHXTXYYPajiFGoI3ajHucOWVQy/vrAFGSi29kQXY1Max2AnE:UMk27eayHaAnE

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

127.0.0.1:59089

legacyrem.duckdns.org:59089

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-BF03RK

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • ModiLoader Second Stage 1 IoCs
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Public\Libraries\jkzjblcW.cmd" "
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2184
      • C:\Windows\SysWOW64\esentutl.exe
        C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
        3⤵
          PID:2568
        • C:\Windows\SysWOW64\esentutl.exe
          C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:2484
        • C:\Users\Public\alpha.pif
          C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1704
        • C:\Users\Public\alpha.pif
          C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3020
        • C:\Users\Public\alpha.pif
          C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1136
          • C:\Users\Public\xpha.pif
            C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1272
        • C:\Windows \SysWOW64\per.exe
          "C:\\Windows \\SysWOW64\\per.exe
          3⤵
          • Executes dropped EXE
          PID:2328
        • C:\Windows \SysWOW64\per.exe
          "C:\Windows \SysWOW64\per.exe"
          3⤵
          • Executes dropped EXE
          PID:2952
        • C:\Users\Public\alpha.pif
          C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:912
        • C:\Users\Public\alpha.pif
          C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1756
        • C:\Users\Public\alpha.pif
          C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1372
      • C:\Windows\SysWOW64\esentutl.exe
        C:\\Windows\\System32\\esentutl.exe /y C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECROWNS9522024072510026_AUG_13_2024_PDF.exe /d C:\\Users\\Public\\Libraries\\Wclbjzkj.PIF /o
        2⤵
          PID:928
        • C:\Windows\SysWOW64\colorcpl.exe
          C:\Windows\System32\colorcpl.exe
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2320

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\remcos\logs.dat

        Filesize

        146B

        MD5

        9cc2a7d06260c188803f47496e088d28

        SHA1

        5e3baf281714f22042a97e6813e253156bfda03d

        SHA256

        69bffd1fd048752908851533539bdbc6b62d230eb4d35fe3e51062d1728fb5b6

        SHA512

        e4a08fbec556afb14c0c48a63c6ba9a3e062a375ae21223e5a3af2a48342bab20f8e232969a9e6c462762b6e34ab1d6032c4c64513df538b29594dafabc2484c

      • C:\Users\Admin\AppData\Local\Temp\CabB80B.tmp

        Filesize

        70KB

        MD5

        49aebf8cbd62d92ac215b2923fb1b9f5

        SHA1

        1723be06719828dda65ad804298d0431f6aff976

        SHA256

        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

        SHA512

        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

      • C:\Users\Admin\AppData\Local\Temp\TarB82D.tmp

        Filesize

        181KB

        MD5

        4ea6026cf93ec6338144661bf1202cd1

        SHA1

        a1dec9044f750ad887935a01430bf49322fbdcb7

        SHA256

        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

        SHA512

        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

      • C:\Users\Public\Libraries\jkzjblcW.cmd

        Filesize

        60KB

        MD5

        b87f096cbc25570329e2bb59fee57580

        SHA1

        d281d1bf37b4fb46f90973afc65eece3908532b2

        SHA256

        d08ccc9b1e3acc205fe754bad8416964e9711815e9ceed5e6af73d8e9035ec9e

        SHA512

        72901adde38f50cf6d74743c0a546c0fea8b1cd4a18449048a0758a7593a176fc33aad1ebfd955775eefc2b30532bcc18e4f2964b3731b668dd87d94405951f7

      • C:\Windows \SysWOW64\per.exe

        Filesize

        94KB

        MD5

        869640d0a3f838694ab4dfea9e2f544d

        SHA1

        bdc42b280446ba53624ff23f314aadb861566832

        SHA256

        0db4d3ffdb96d13cf3b427af8be66d985728c55ae254e4b67d287797e4c0b323

        SHA512

        6e775cfb350415434b18427d5ff79b930ed3b0b3fc3466bc195a796c95661d4696f2d662dd0e020c3a6c3419c2734468b1d7546712ecec868d2bbfd2bc2468a7

      • \Users\Public\alpha.pif

        Filesize

        295KB

        MD5

        ad7b9c14083b52bc532fba5948342b98

        SHA1

        ee8cbf12d87c4d388f09b4f69bed2e91682920b5

        SHA256

        17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae

        SHA512

        e12aad20c824187b39edb3c7943709290b5ddbf1b4032988db46f2e86da3cf7e7783f78c82e4dc5da232f666b8f9799a260a1f8e2694eb4d0cdaf78da710fde1

      • \Users\Public\xpha.pif

        Filesize

        15KB

        MD5

        6242e3d67787ccbf4e06ad2982853144

        SHA1

        6ac7947207d999a65890ab25fe344955da35028e

        SHA256

        4ca10dba7ff487fdb3f1362a3681d7d929f5aa1262cdfd31b04c30826983fb1d

        SHA512

        7d0d457e1537d624119a8023bcc086575696a5739c0460ef11554afac13af5e5d1edc7629a10e62834aba9f1b3ab1442011b15b4c3930399d91dca34b3b1cbaf

      • memory/1620-4-0x0000000000400000-0x0000000000540000-memory.dmp

        Filesize

        1.2MB

      • memory/1620-0-0x0000000000220000-0x0000000000221000-memory.dmp

        Filesize

        4KB

      • memory/1620-3-0x00000000030B0000-0x00000000040B0000-memory.dmp

        Filesize

        16.0MB

      • memory/1620-1-0x00000000030B0000-0x00000000040B0000-memory.dmp

        Filesize

        16.0MB

      • memory/2320-117-0x0000000031ED0000-0x0000000031F52000-memory.dmp

        Filesize

        520KB

      • memory/2320-123-0x0000000031ED0000-0x0000000031F52000-memory.dmp

        Filesize

        520KB

      • memory/2320-109-0x0000000031ED0000-0x0000000031F52000-memory.dmp

        Filesize

        520KB

      • memory/2320-105-0x0000000003020000-0x0000000004020000-memory.dmp

        Filesize

        16.0MB

      • memory/2320-113-0x0000000031ED0000-0x0000000031F52000-memory.dmp

        Filesize

        520KB

      • memory/2320-114-0x0000000031ED0000-0x0000000031F52000-memory.dmp

        Filesize

        520KB

      • memory/2320-116-0x0000000031ED0000-0x0000000031F52000-memory.dmp

        Filesize

        520KB

      • memory/2320-115-0x0000000031ED0000-0x0000000031F52000-memory.dmp

        Filesize

        520KB

      • memory/2320-111-0x0000000031ED0000-0x0000000031F52000-memory.dmp

        Filesize

        520KB

      • memory/2320-118-0x0000000031ED0000-0x0000000031F52000-memory.dmp

        Filesize

        520KB

      • memory/2320-120-0x0000000031ED0000-0x0000000031F52000-memory.dmp

        Filesize

        520KB

      • memory/2320-110-0x0000000031ED0000-0x0000000031F52000-memory.dmp

        Filesize

        520KB

      • memory/2320-124-0x0000000031ED0000-0x0000000031F52000-memory.dmp

        Filesize

        520KB

      • memory/2320-106-0x0000000031ED0000-0x0000000031F52000-memory.dmp

        Filesize

        520KB

      • memory/2320-131-0x0000000031ED0000-0x0000000031F52000-memory.dmp

        Filesize

        520KB

      • memory/2320-132-0x0000000031ED0000-0x0000000031F52000-memory.dmp

        Filesize

        520KB

      • memory/2320-137-0x0000000002330000-0x0000000002349000-memory.dmp

        Filesize

        100KB

      • memory/2320-140-0x0000000002330000-0x0000000002349000-memory.dmp

        Filesize

        100KB

      • memory/2320-141-0x0000000002330000-0x0000000002349000-memory.dmp

        Filesize

        100KB

      • memory/2320-142-0x0000000031ED0000-0x0000000031F52000-memory.dmp

        Filesize

        520KB

      • memory/2320-145-0x0000000031ED0000-0x0000000031F52000-memory.dmp

        Filesize

        520KB

      • memory/2320-146-0x0000000031ED0000-0x0000000031F52000-memory.dmp

        Filesize

        520KB

      • memory/2320-153-0x0000000031ED0000-0x0000000031F52000-memory.dmp

        Filesize

        520KB