Analysis
-
max time kernel
47s -
max time network
45s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
24-08-2024 15:01
General
-
Target
2e6db642fad3918398b520cf655d6ca7fc040bd177e30a30bd7f549adb4e48c0.exe
-
Size
2.5MB
-
MD5
5ba3af74071e58c1f18c22ac35c6cbb7
-
SHA1
7ae9c93f0c69bc86cd7d1abcf34340667a2d791c
-
SHA256
2e6db642fad3918398b520cf655d6ca7fc040bd177e30a30bd7f549adb4e48c0
-
SHA512
198fe5be5cbfb1be083a91b8c07ce00204cb925a7b605ad7f72648888ac5f723349694dcd0472cdc7271b40e2948ccee23c80cde31b23de837cff3945cbd4b8e
-
SSDEEP
49152:XwREDDMAfQRw4z0g3Q1edHeMxWrP+beY7UY714:XwREzfQRDzJQ1edMwZgN
Malware Config
Extracted
remcos
Mentor
hulolawyo199jestie01.duckdns.org:4871
hulolawyo199jestie01.duckdns.org:4872
hulolawyo199jestie02.duckdns.org:4871
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
true
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
nabytrotis.dat
-
keylog_flag
false
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
janoutgurf-P6FGU2
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
- startup_value
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Executes dropped EXE 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 41 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e6db642fad3918398b520cf655d6ca7fc040bd177e30a30bd7f549adb4e48c0.exe"C:\Users\Admin\AppData\Local\Temp\2e6db642fad3918398b520cf655d6ca7fc040bd177e30a30bd7f549adb4e48c0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-PFK1U.tmp\2e6db642fad3918398b520cf655d6ca7fc040bd177e30a30bd7f549adb4e48c0.tmp"C:\Users\Admin\AppData\Local\Temp\is-PFK1U.tmp\2e6db642fad3918398b520cf655d6ca7fc040bd177e30a30bd7f549adb4e48c0.tmp" /SL5="$501C2,1651783,845824,C:\Users\Admin\AppData\Local\Temp\2e6db642fad3918398b520cf655d6ca7fc040bd177e30a30bd7f549adb4e48c0.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-SA654.tmp\fzxujk.exe"C:\Users\Admin\AppData\Local\Temp\is-SA654.tmp\fzxujk.exe" C:\Users\Admin\AppData\Local\Temp\is-SA654.tmp\script.a3x3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe"C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe"4⤵
-
-
C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe"C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5e587511f17c07622f2e88bde6dc2a499
SHA108899e43445db2e0d000b3afd80e028636786eeb
SHA2569fbf0748b5d890c2c28b1ae20aad7fc23a93cc7a57c4a51220d9381af7637c60
SHA5122e59d9c525c5383c4ea66c785584aa69256a47ffe928a6595cc2bf07469d2da4dd56dcd3d3d42496e593c39eec6356fc4c8a9cdeee6770c7e6c3319b8b614c6e
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
Filesize
653KB
MD59ca5723b051b92f691e7a7b429f79bca
SHA17824fc09ac6a7e8e7517e084e4bf28db4e68e991
SHA25667ab963c9d63cf6343277d63bdd7160329d9a13597cc2f59233883d19adb0309
SHA5129fa68bb561c31e9e2a5655b54f10df771777ac8eec76de757bedac0011893a8a547d52f0aca59a6d07624675d34766fa8bbede514a22432d58b1ab3775502638
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
520KB
-
Filesize
880KB
-
Filesize
880KB
-
Filesize
880KB
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
3.3MB
-
Filesize
4KB
-
Filesize
3.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.0MB