Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    16-08-2024 09:54

General

  • Target

    9ac1813552dfe8f0ffa0197e74c453e4cca936ff667066628a03fe7bcfc69030.exe

  • Size

    944KB

  • MD5

    6161c04bf6f739915c469c9718b30ea8

  • SHA1

    1f8e7670f89ee78fd393e609c5f5a5af8bdb2d26

  • SHA256

    9ac1813552dfe8f0ffa0197e74c453e4cca936ff667066628a03fe7bcfc69030

  • SHA512

    4925ebbf86b419681bc538a8a63a8bf893b656a8ba9efb7a4763c0be1e1e34e233aea91fc6b9823f4a439ccbf9e374b4fbb04309452ab8a6dbc9af45372a1902

  • SSDEEP

    24576:fY/TkthhqbBuQBIK5wUwfhOMX+GZDnsYKVjACuMwd:YBughwUPHGVAjAO8

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

212.162.149.42:7118

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-WYBPPO

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9ac1813552dfe8f0ffa0197e74c453e4cca936ff667066628a03fe7bcfc69030.exe
    "C:\Users\Admin\AppData\Local\Temp\9ac1813552dfe8f0ffa0197e74c453e4cca936ff667066628a03fe7bcfc69030.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2532
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\9ac1813552dfe8f0ffa0197e74c453e4cca936ff667066628a03fe7bcfc69030.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2844
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\CqcHNIR.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1504
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CqcHNIR" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD6CF.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2748
    • C:\Users\Admin\AppData\Local\Temp\9ac1813552dfe8f0ffa0197e74c453e4cca936ff667066628a03fe7bcfc69030.exe
      "C:\Users\Admin\AppData\Local\Temp\9ac1813552dfe8f0ffa0197e74c453e4cca936ff667066628a03fe7bcfc69030.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2608

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpD6CF.tmp

    Filesize

    1KB

    MD5

    f40ebb4d42836131a7b681e5367068a8

    SHA1

    5be84618bc647e038056d4edeabc487481cb64c9

    SHA256

    a9dd4abd59f463ffdd5ade8f609ecf16716d1d5a5adfabd3a7e7816c712f452b

    SHA512

    23979c354e84939e9d589d028ee0244dcf4ad72121ffee92c613fccd8110730e4aeec542f07c74a0877ef8cceb84cb74418999b4e898a6051d4e2f7cf0493bd7

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    b34439579ddf22dd62999bb9f36b9f6f

    SHA1

    ec0899576ea776772a792eee4fe49585354e5075

    SHA256

    794ec91939287d4126175b199a03c1c3f52649c0ca70e838ccc85e40ec1ba9fb

    SHA512

    7bf1458ae57d2cd0a80de083d71c04a84048f1b7a00d66a882f003c3c0f0e5565b629940cf421a874fba8b53fa2441369fc7f0fe8d05bd2f03f4ed206897caf2

  • memory/2532-0-0x00000000747AE000-0x00000000747AF000-memory.dmp

    Filesize

    4KB

  • memory/2532-1-0x0000000000E00000-0x0000000000EF0000-memory.dmp

    Filesize

    960KB

  • memory/2532-2-0x00000000747A0000-0x0000000074E8E000-memory.dmp

    Filesize

    6.9MB

  • memory/2532-3-0x0000000004C20000-0x0000000004CF0000-memory.dmp

    Filesize

    832KB

  • memory/2532-4-0x0000000000930000-0x000000000093E000-memory.dmp

    Filesize

    56KB

  • memory/2532-5-0x00000000747AE000-0x00000000747AF000-memory.dmp

    Filesize

    4KB

  • memory/2532-6-0x00000000747A0000-0x0000000074E8E000-memory.dmp

    Filesize

    6.9MB

  • memory/2532-7-0x0000000000980000-0x000000000098E000-memory.dmp

    Filesize

    56KB

  • memory/2532-8-0x0000000004CF0000-0x0000000004DAE000-memory.dmp

    Filesize

    760KB

  • memory/2532-42-0x00000000747A0000-0x0000000074E8E000-memory.dmp

    Filesize

    6.9MB

  • memory/2608-31-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2608-21-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2608-40-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2608-39-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2608-38-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2608-37-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2608-35-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2608-29-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2608-27-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2608-25-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2608-23-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2608-41-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2608-33-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2608-44-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2608-43-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2608-45-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2608-48-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2608-49-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2608-50-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2608-51-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2608-53-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2608-52-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2608-54-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2608-55-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB