Analysis

  • max time kernel
    147s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    14-08-2024 01:20

General

  • Target

    b778e6e8c6b8265fff7a08768f5f1364ad81c68184902032589eb1e4b67df244.exe

  • Size

    1.1MB

  • MD5

    feefffb2f85e6449769501809c3da84c

  • SHA1

    e8841eb6afd72c1487ec5323a5bc4f37bfae0dcf

  • SHA256

    b778e6e8c6b8265fff7a08768f5f1364ad81c68184902032589eb1e4b67df244

  • SHA512

    83a4c56f10148660c5c528f1b637dc40ffd1337a87be2f50161813c9d36641a48cf7babf8d0dfea2414f38da43a95529c8fe00e8c135243b380ea518496e9457

  • SSDEEP

    24576:hNDsYdZxwZQSkazcndb4MeFCu5+eADOWWiKDZbD0E+ou3x9+rreMoB:7teZExndpegSgLk/0E+h3L+rW

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

65.21.66.222:9821

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-LDQ8V0

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b778e6e8c6b8265fff7a08768f5f1364ad81c68184902032589eb1e4b67df244.exe
    "C:\Users\Admin\AppData\Local\Temp\b778e6e8c6b8265fff7a08768f5f1364ad81c68184902032589eb1e4b67df244.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2372
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b778e6e8c6b8265fff7a08768f5f1364ad81c68184902032589eb1e4b67df244.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:320
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\NUKXaCFNwRYYxi.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2852
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NUKXaCFNwRYYxi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2BF.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2808
    • C:\Users\Admin\AppData\Local\Temp\b778e6e8c6b8265fff7a08768f5f1364ad81c68184902032589eb1e4b67df244.exe
      "C:\Users\Admin\AppData\Local\Temp\b778e6e8c6b8265fff7a08768f5f1364ad81c68184902032589eb1e4b67df244.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2744

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp2BF.tmp

    Filesize

    1KB

    MD5

    f22679befb91e8e30dbd8de8aadc8aa9

    SHA1

    bcc110ba794748fbb09f2d497786b282db8979ba

    SHA256

    634a9bc8902d4a8a2d4558f7825657663eee5bcc027be036368938f60cbfa4d5

    SHA512

    04e34281584b114dc7eca1d6a53097d574cf5910b345bb63f422a7b25145287d7a8fcf75dc498ad9b573e0677d8cd975f3a28c8f5ee8c938c55c2d09a9c3d521

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JY3G4NVWFESMFH9ISI9J.temp

    Filesize

    7KB

    MD5

    b2423057e07e591b8c01c73a600fbee5

    SHA1

    c2afc93a14cb3ec18bf28d44b8b567ec73c374d8

    SHA256

    6a7ba64c602f7129743ef6f7d7c8db7edc02d52757411d0aefa2e383ef49f1ec

    SHA512

    5deaaa3ef51ebd19f1e49c3e8fb56b3f34e68b7fc423e8729e7fbc481708fc9331e4840f2cc1bb29ba072e0d97bc4e6bb99a2852410497a98b71d67db92dee5b

  • memory/2372-0-0x000000007416E000-0x000000007416F000-memory.dmp

    Filesize

    4KB

  • memory/2372-1-0x0000000000980000-0x0000000000A90000-memory.dmp

    Filesize

    1.1MB

  • memory/2372-2-0x0000000074160000-0x000000007484E000-memory.dmp

    Filesize

    6.9MB

  • memory/2372-3-0x0000000002170000-0x000000000218E000-memory.dmp

    Filesize

    120KB

  • memory/2372-4-0x0000000001FE0000-0x0000000001FF6000-memory.dmp

    Filesize

    88KB

  • memory/2372-5-0x0000000005BD0000-0x0000000005C8E000-memory.dmp

    Filesize

    760KB

  • memory/2372-37-0x0000000074160000-0x000000007484E000-memory.dmp

    Filesize

    6.9MB

  • memory/2744-38-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2744-26-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2744-30-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2744-36-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2744-35-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2744-34-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2744-32-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2744-20-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2744-39-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2744-18-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2744-28-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2744-22-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2744-24-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2744-40-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2744-41-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2744-42-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2744-45-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2744-46-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2744-47-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2744-48-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2744-49-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2744-50-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2744-52-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2744-51-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB