Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
14/08/2024, 11:38
General
- Target PaymentAdvice_SWIFT_AUG_13_USD37700.exe
- Size 723KB
- Sample240814-nrtbdavcnr
- SHA256 a09899438c089467b58320df779be4ac4b546c24f856f2e12d5be537adaa487d
Malware Config
Extracted
-
remcos
-
RemoteHost
-
198.37.105.226:26000
-
198.37.105.226:27000
-
198.37.105.226:29000
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-MK6KCM
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Detected Nirsoft tools 7 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
- NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Drops file in Program Files directory 3 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: MapViewOfSection 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PaymentAdvice_SWIFT_AUG_13_USD37700.exe"C:\Users\Admin\AppData\Local\Temp\PaymentAdvice_SWIFT_AUG_13_USD37700.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PaymentAdvice_SWIFT_AUG_13_USD37700.exe"C:\Users\Admin\AppData\Local\Temp\PaymentAdvice_SWIFT_AUG_13_USD37700.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PaymentAdvice_SWIFT_AUG_13_USD37700.exeC:\Users\Admin\AppData\Local\Temp\PaymentAdvice_SWIFT_AUG_13_USD37700.exe /stext "C:\Users\Admin\AppData\Local\Temp\qxrclxnhtlchcynzcttgwrny"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\PaymentAdvice_SWIFT_AUG_13_USD37700.exeC:\Users\Admin\AppData\Local\Temp\PaymentAdvice_SWIFT_AUG_13_USD37700.exe /stext "C:\Users\Admin\AppData\Local\Temp\aswndqyjhtummmcdleoazeipnaiw"3⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\PaymentAdvice_SWIFT_AUG_13_USD37700.exeC:\Users\Admin\AppData\Local\Temp\PaymentAdvice_SWIFT_AUG_13_USD37700.exe /stext "C:\Users\Admin\AppData\Local\Temp\cujfeiidvcmzpsyhchbbkjuyvhrflpj"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Funditores239.lnk
nsb9722.tmp
nsb9722.tmp
nsb9722.tmp
nsb9722.tmp
nsd9B1C.tmp
nsd9B1C.tmp
nsd9B1C.tmp
nsd9B1C.tmp
nsd9B1C.tmp
nsd9B1C.tmp
nsd9B1C.tmp
nsd9B1C.tmp
nsd9B1C.tmp
nsd9B1C.tmp
nsd9B1C.tmp
nsl94A1.tmp
nsl94A1.tmp
nsm989A.tmp
nsm989A.tmp
nso9CE2.tmp
nso9CE2.tmp
nso9CE2.tmp
System.dll
qxrclxnhtlchcynzcttgwrny
memory/1764-1157-0x0000000000400000-0x0000000000478000-memory.dmp
memory/1764-1134-0x0000000000400000-0x0000000000478000-memory.dmp
memory/1764-1135-0x0000000000400000-0x0000000000478000-memory.dmp
memory/1764-1136-0x0000000000400000-0x0000000000478000-memory.dmp
memory/3136-1143-0x0000000000400000-0x0000000000424000-memory.dmp
memory/3136-1147-0x0000000000400000-0x0000000000424000-memory.dmp
memory/3136-1151-0x0000000000400000-0x0000000000424000-memory.dmp
memory/3136-1148-0x0000000000400000-0x0000000000424000-memory.dmp
memory/4416-1138-0x0000000000400000-0x0000000000462000-memory.dmp
memory/4416-1137-0x0000000000400000-0x0000000000462000-memory.dmp
memory/4416-1139-0x0000000000400000-0x0000000000462000-memory.dmp
memory/4416-1142-0x0000000000400000-0x0000000000462000-memory.dmp
memory/4556-1170-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1194-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1131-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1124-0x00000000016F0000-0x0000000004B8E000-memory.dmp
memory/4556-1130-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1127-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1126-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1173-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1123-0x00000000775B1000-0x00000000776D1000-memory.dmp
memory/4556-1122-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1129-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1121-0x0000000077655000-0x0000000077656000-memory.dmp
memory/4556-1120-0x0000000077638000-0x0000000077639000-memory.dmp
memory/4556-1152-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1202-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1155-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1163-0x0000000035CB0000-0x0000000035CC9000-memory.dmp
memory/4556-1162-0x0000000035CB0000-0x0000000035CC9000-memory.dmp
memory/4556-1159-0x0000000035CB0000-0x0000000035CC9000-memory.dmp
memory/4556-1201-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1164-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1165-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1166-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1167-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1168-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1128-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1132-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1171-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1125-0x00000000004C4000-0x00000000004C5000-memory.dmp
memory/4556-1174-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1175-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1176-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1177-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1179-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1180-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1181-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1182-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1183-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1184-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1185-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1186-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1187-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1188-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1190-0x00000000775B1000-0x00000000776D1000-memory.dmp
memory/4556-1192-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1193-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1172-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1195-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1196-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1197-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1198-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1199-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4556-1200-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4876-1118-0x00000000775B1000-0x00000000776D1000-memory.dmp
memory/4876-1119-0x0000000074415000-0x0000000074416000-memory.dmp