Analysis

  • max time kernel
    147s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-08-2024 15:46

General

  • Target

    DN TK 7239 (()DHL#3272524765pdf.exe

  • Size

    853KB

  • MD5

    72fa44e3e13d946e188485a4115c67f4

  • SHA1

    36571ccce2ae7f092c8bff4fe80b7b4cd37eee66

  • SHA256

    2c98d193201137a3e33b34934fa866c2c66f346ed6878562e8191f4314bc5dc9

  • SHA512

    c1a97252b5b0048e861f2c2409b517ce86db911bae64606bbdfb482abb7d94877826265f7ef47c59c134c734054edbcb55b6e0a7317f43ddd35eabcc67717d7c

  • SSDEEP

    24576:mBXu9HGaVHoB42WGiRjocxGJo3ToETGMCjm:mw9VHM4YSjoaw8oEqMC

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

194.169.175.190:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-LBZ2BK

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Detected Nirsoft tools 3 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView 1 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • AutoIT Executable 3 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: MapViewOfSection 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DN TK 7239 (()DHL#3272524765pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\DN TK 7239 (()DHL#3272524765pdf.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\DN TK 7239 (()DHL#3272524765pdf.exe"
      2⤵
        PID:3548
      • C:\Users\Admin\AppData\Local\Temp\DN TK 7239 (()DHL#3272524765pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\DN TK 7239 (()DHL#3272524765pdf.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:4296
        • C:\Windows\SysWOW64\svchost.exe
          "C:\Users\Admin\AppData\Local\Temp\DN TK 7239 (()DHL#3272524765pdf.exe"
          3⤵
            PID:5008
          • C:\Users\Admin\AppData\Local\Temp\DN TK 7239 (()DHL#3272524765pdf.exe
            "C:\Users\Admin\AppData\Local\Temp\DN TK 7239 (()DHL#3272524765pdf.exe"
            3⤵
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:3044
            • C:\Windows\SysWOW64\svchost.exe
              "C:\Users\Admin\AppData\Local\Temp\DN TK 7239 (()DHL#3272524765pdf.exe"
              4⤵
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:2908
              • C:\Windows\SysWOW64\svchost.exe
                C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\Admin\AppData\Local\Temp\tzrgncqgophmknlhmwmkyaziazn"
                5⤵
                  PID:4332
                • C:\Windows\SysWOW64\svchost.exe
                  C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\Admin\AppData\Local\Temp\tzrgncqgophmknlhmwmkyaziazn"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4896
                • C:\Windows\SysWOW64\svchost.exe
                  C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\Admin\AppData\Local\Temp\vbxronahkyzznbhtwgylbemzbfwjwu"
                  5⤵
                    PID:4860
                  • C:\Windows\SysWOW64\svchost.exe
                    C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\Admin\AppData\Local\Temp\vbxronahkyzznbhtwgylbemzbfwjwu"
                    5⤵
                      PID:916
                    • C:\Windows\SysWOW64\svchost.exe
                      C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\Admin\AppData\Local\Temp\vbxronahkyzznbhtwgylbemzbfwjwu"
                      5⤵
                      • Accesses Microsoft Outlook accounts
                      • System Location Discovery: System Language Discovery
                      PID:3384
                    • C:\Windows\SysWOW64\svchost.exe
                      C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\Admin\AppData\Local\Temp\gvcjoflbygsexhwxnrtfmrgpjmosxfmhm"
                      5⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3092

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\aut8A9C.tmp

              Filesize

              400KB

              MD5

              2d70bfd1c9ec172c998df713249aa082

              SHA1

              776b7f2acd1878719e590a4536b512eef2ba413f

              SHA256

              01ea48aef9caf96211f378b35d5cee12e898c5337f07101588e567809e3034ff

              SHA512

              b46815b83f8df40ce560aba3e5e500081dd719184f92050cb3bbb2cf199c3540d1baa2d2fcb5ad62b35c130ad0d382b29d0a806fad45a8e840049f570a121a02

            • C:\Users\Admin\AppData\Local\Temp\aut8AAD.tmp

              Filesize

              9KB

              MD5

              929f6966ac8cca0cfe2a0afd9c63d33e

              SHA1

              85ed454c656cd4b4c1c1780e1d4fcd1c18d0c26e

              SHA256

              b5819d69322a25044dcce4d8ab0c70f8d091847188db7c19db4c6b10e6360293

              SHA512

              59034aa4e932d9789d08446a29df6e116422007e61d918772868288183b9a0776dcfc68729c6d1638168ef01d50ab33b1f9ee6a852364727458fb2f660896c5f

            • C:\Users\Admin\AppData\Local\Temp\avenses

              Filesize

              28KB

              MD5

              0a2635be16a8198ce853e4903f314c39

              SHA1

              8d0d9b0554ac1a1a0476e3bf4fb91fc32293f5bd

              SHA256

              d3ce45201555b0954ced374ea84306e5b74a3ee6384f541725346ddf9a927dea

              SHA512

              7db087df47628d79c5c5b11ae24e3dce7f498fc93398170d31b030f1e1a2f1a5d2f4ee4f9a45e657311c4ceb9f5e399e14c31d4990dc7c3b730e8fae7762eed4

            • C:\Users\Admin\AppData\Local\Temp\phytographical

              Filesize

              483KB

              MD5

              0525d45a79ebb31866ce270c9789d639

              SHA1

              0cca3162c9fe026aaf6fd0023c095c2e94381978

              SHA256

              09a1985d77a84c7b11e79bf18055d15a321a1def9fc7dab1938ac6c33816e3f5

              SHA512

              e5b2ec4ee75867274407c0c53982192e2824e918ce93e0bc46d1c9e8393ffc5fd7e331ab37e66507398ddc9fd3875541258af8b65a4d145284db7e27a18be031

            • C:\Users\Admin\AppData\Local\Temp\tzrgncqgophmknlhmwmkyaziazn

              Filesize

              4KB

              MD5

              18db1829b27eaeed163c211f5d179d72

              SHA1

              4442332494cba1e012f8876ecac42126ba995bc6

              SHA256

              610c5ee3f0e63441521d26bc477c9618a4c5f86e93d31b31890680c69e3ecc3d

              SHA512

              123d68b2c84f7a52d15faa212c06f33b04a55585e2aeb16bb14df95b18c0bcf31933e5bf0c736c90bc054b9527fccb046540d3302a0f149ebeed7c6bcca0b986

            • memory/2908-75-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2908-54-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2908-86-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2908-43-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2908-44-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2908-85-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2908-47-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2908-48-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2908-49-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2908-50-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2908-51-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2908-52-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2908-53-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2908-74-0x0000000010000000-0x0000000010019000-memory.dmp

              Filesize

              100KB

            • memory/2908-55-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2908-84-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2908-83-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2908-82-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2908-81-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2908-80-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2908-79-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2908-78-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2908-77-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2908-76-0x0000000000400000-0x0000000000482000-memory.dmp

              Filesize

              520KB

            • memory/2908-73-0x0000000010000000-0x0000000010019000-memory.dmp

              Filesize

              100KB

            • memory/2908-70-0x0000000010000000-0x0000000010019000-memory.dmp

              Filesize

              100KB

            • memory/2976-0-0x0000000000CC0000-0x0000000000E97000-memory.dmp

              Filesize

              1.8MB

            • memory/2976-12-0x00000000018C0000-0x00000000018C4000-memory.dmp

              Filesize

              16KB

            • memory/2976-14-0x0000000000CC0000-0x0000000000E97000-memory.dmp

              Filesize

              1.8MB

            • memory/3044-46-0x0000000000CC0000-0x0000000000E97000-memory.dmp

              Filesize

              1.8MB

            • memory/3092-64-0x0000000000400000-0x0000000000424000-memory.dmp

              Filesize

              144KB

            • memory/3092-63-0x0000000000400000-0x0000000000424000-memory.dmp

              Filesize

              144KB

            • memory/3092-61-0x0000000000400000-0x0000000000424000-memory.dmp

              Filesize

              144KB

            • memory/3384-62-0x0000000000400000-0x0000000000462000-memory.dmp

              Filesize

              392KB

            • memory/3384-59-0x0000000000400000-0x0000000000462000-memory.dmp

              Filesize

              392KB

            • memory/3384-58-0x0000000000400000-0x0000000000462000-memory.dmp

              Filesize

              392KB

            • memory/4296-29-0x0000000000CC0000-0x0000000000E97000-memory.dmp

              Filesize

              1.8MB

            • memory/4896-60-0x0000000000400000-0x0000000000478000-memory.dmp

              Filesize

              480KB

            • memory/4896-56-0x0000000000400000-0x0000000000478000-memory.dmp

              Filesize

              480KB

            • memory/4896-57-0x0000000000400000-0x0000000000478000-memory.dmp

              Filesize

              480KB