Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    17-08-2024 15:16

General

  • Target

    4eaacedcb5c204340fb5b45bbf5b625f8951efdb4a4035b9b621d07880bd0002.exe

  • Size

    1007KB

  • MD5

    652d8c7b13a8e36e9537e8786b96f4a4

  • SHA1

    2d456a829fb9b9ce560baa1f3b00efbdc85ec6ac

  • SHA256

    4eaacedcb5c204340fb5b45bbf5b625f8951efdb4a4035b9b621d07880bd0002

  • SHA512

    1257d1e0e691cbcc275abe7fee301bf0b4ecdb70e68c52323ea00174f7e23baf3b1c6397a4be04af1cb9b6d796d8bae0d28460afbbbd6c77d51002783d1c1947

  • SSDEEP

    24576:OYImtwJX3fFnw2burtrxID+1Mwpkjcu2KRZtxEYZcZkIZ:OYImtm3tHbuhlIDWZkEKBxEYu

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

magaji.duckdns.org:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-ORKMG9

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4eaacedcb5c204340fb5b45bbf5b625f8951efdb4a4035b9b621d07880bd0002.exe
    "C:\Users\Admin\AppData\Local\Temp\4eaacedcb5c204340fb5b45bbf5b625f8951efdb4a4035b9b621d07880bd0002.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2876
    • C:\Users\Admin\AppData\Local\Temp\4eaacedcb5c204340fb5b45bbf5b625f8951efdb4a4035b9b621d07880bd0002.exe
      "C:\Users\Admin\AppData\Local\Temp\4eaacedcb5c204340fb5b45bbf5b625f8951efdb4a4035b9b621d07880bd0002.exe"
      2⤵
        PID:2356
      • C:\Users\Admin\AppData\Local\Temp\4eaacedcb5c204340fb5b45bbf5b625f8951efdb4a4035b9b621d07880bd0002.exe
        "C:\Users\Admin\AppData\Local\Temp\4eaacedcb5c204340fb5b45bbf5b625f8951efdb4a4035b9b621d07880bd0002.exe"
        2⤵
          PID:3028
        • C:\Users\Admin\AppData\Local\Temp\4eaacedcb5c204340fb5b45bbf5b625f8951efdb4a4035b9b621d07880bd0002.exe
          "C:\Users\Admin\AppData\Local\Temp\4eaacedcb5c204340fb5b45bbf5b625f8951efdb4a4035b9b621d07880bd0002.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2780

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\remcos\logs.dat

        Filesize

        144B

        MD5

        8e77fa463cdedc4e05373fb2ee39ea19

        SHA1

        a64db98bff407e25852a1f554a2b0ea2851900b5

        SHA256

        bbf883f6e1eb70ead57d8fc8db9c04a599b889369cf1159104f3100d80e09453

        SHA512

        d500558690e4c54ca077db1d4519e70bfc61a43b4a012a5c55e7d53a9a02493dd8fcd02a8f6ef862868b3ec6dc07fc8801d4d96b42bdd953adb838812a86d4f5

      • memory/2780-15-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2780-63-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2780-64-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2780-14-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2780-13-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2780-56-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2780-55-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2780-47-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2780-10-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2780-9-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2780-19-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2780-21-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2780-22-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2780-39-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2780-16-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2780-27-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2780-24-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2780-40-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2780-36-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2780-33-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2780-11-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2780-12-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2780-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2780-28-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2780-29-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2780-30-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2780-31-0x0000000000400000-0x0000000000482000-memory.dmp

        Filesize

        520KB

      • memory/2876-2-0x0000000074A10000-0x00000000750FE000-memory.dmp

        Filesize

        6.9MB

      • memory/2876-4-0x0000000000950000-0x000000000096E000-memory.dmp

        Filesize

        120KB

      • memory/2876-0-0x0000000074A1E000-0x0000000074A1F000-memory.dmp

        Filesize

        4KB

      • memory/2876-23-0x0000000074A10000-0x00000000750FE000-memory.dmp

        Filesize

        6.9MB

      • memory/2876-1-0x0000000000B70000-0x0000000000C72000-memory.dmp

        Filesize

        1.0MB

      • memory/2876-8-0x0000000005C40000-0x0000000005D00000-memory.dmp

        Filesize

        768KB

      • memory/2876-7-0x0000000000310000-0x0000000000326000-memory.dmp

        Filesize

        88KB

      • memory/2876-6-0x0000000074A10000-0x00000000750FE000-memory.dmp

        Filesize

        6.9MB

      • memory/2876-5-0x0000000074A1E000-0x0000000074A1F000-memory.dmp

        Filesize

        4KB

      • memory/2876-3-0x00000000051A0000-0x0000000005292000-memory.dmp

        Filesize

        968KB