Analysis

  • max time kernel
    149s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/09/2024, 07:57 UTC

General

  • Target

    5868bd786a53297dfb2265f5f00d55cdc21ab25aa803acd288a39d59507d25ef.exe

  • Size

    1017KB

  • MD5

    b61864f46e2dd1aa7a629eb85f08be33

  • SHA1

    99048df6b97319f0d6293309b71d1ffafc8bf269

  • SHA256

    5868bd786a53297dfb2265f5f00d55cdc21ab25aa803acd288a39d59507d25ef

  • SHA512

    5a6607351724208aed4bbcd38d0114723131e331c1d50c4b43cb749628e836634d9c7d4b5e82d1261e6518723236d6bf91ddf32ab49af606b2d43878e55b4e8e

  • SSDEEP

    24576:U4OR7Cs7VTj7e9pb1icG+hiNT4TrAgPdiRFcpFUQ:471yb1IxsA4d0yFp

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

127.0.0.1:2404

67.207.161.204:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-ZA03K9

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Detected Nirsoft tools 6 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView 3 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 3 IoCs

    Password recovery tool for various web browsers

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5868bd786a53297dfb2265f5f00d55cdc21ab25aa803acd288a39d59507d25ef.exe
    "C:\Users\Admin\AppData\Local\Temp\5868bd786a53297dfb2265f5f00d55cdc21ab25aa803acd288a39d59507d25ef.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\Users\Admin\AppData\Local\Temp\5868bd786a53297dfb2265f5f00d55cdc21ab25aa803acd288a39d59507d25ef.exe
      "C:\Users\Admin\AppData\Local\Temp\5868bd786a53297dfb2265f5f00d55cdc21ab25aa803acd288a39d59507d25ef.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:5108
      • C:\Users\Admin\AppData\Local\Temp\5868bd786a53297dfb2265f5f00d55cdc21ab25aa803acd288a39d59507d25ef.exe
        C:\Users\Admin\AppData\Local\Temp\5868bd786a53297dfb2265f5f00d55cdc21ab25aa803acd288a39d59507d25ef.exe /stext "C:\Users\Admin\AppData\Local\Temp\tufvyxfxq"
        3⤵
          PID:4292
        • C:\Users\Admin\AppData\Local\Temp\5868bd786a53297dfb2265f5f00d55cdc21ab25aa803acd288a39d59507d25ef.exe
          C:\Users\Admin\AppData\Local\Temp\5868bd786a53297dfb2265f5f00d55cdc21ab25aa803acd288a39d59507d25ef.exe /stext "C:\Users\Admin\AppData\Local\Temp\tufvyxfxq"
          3⤵
            PID:5016
          • C:\Users\Admin\AppData\Local\Temp\5868bd786a53297dfb2265f5f00d55cdc21ab25aa803acd288a39d59507d25ef.exe
            C:\Users\Admin\AppData\Local\Temp\5868bd786a53297dfb2265f5f00d55cdc21ab25aa803acd288a39d59507d25ef.exe /stext "C:\Users\Admin\AppData\Local\Temp\tufvyxfxq"
            3⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:3144
          • C:\Users\Admin\AppData\Local\Temp\5868bd786a53297dfb2265f5f00d55cdc21ab25aa803acd288a39d59507d25ef.exe
            C:\Users\Admin\AppData\Local\Temp\5868bd786a53297dfb2265f5f00d55cdc21ab25aa803acd288a39d59507d25ef.exe /stext "C:\Users\Admin\AppData\Local\Temp\wplnyqqrmpel"
            3⤵
            • Accesses Microsoft Outlook accounts
            • System Location Discovery: System Language Discovery
            PID:4980
          • C:\Users\Admin\AppData\Local\Temp\5868bd786a53297dfb2265f5f00d55cdc21ab25aa803acd288a39d59507d25ef.exe
            C:\Users\Admin\AppData\Local\Temp\5868bd786a53297dfb2265f5f00d55cdc21ab25aa803acd288a39d59507d25ef.exe /stext "C:\Users\Admin\AppData\Local\Temp\gjygzibsaxwyitj"
            3⤵
            • Suspicious use of UnmapMainImage
            PID:840
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 840 -s 12
              4⤵
              • Program crash
              PID:2848
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=2820,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
        1⤵
          PID:2732
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 840 -ip 840
          1⤵
            PID:1136

          Network

          • flag-us
            DNS
            8.8.8.8.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            8.8.8.8.in-addr.arpa
            IN PTR
            Response
            8.8.8.8.in-addr.arpa
            IN PTR
            dnsgoogle
          • flag-us
            DNS
            97.17.167.52.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            97.17.167.52.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            96.136.73.23.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            96.136.73.23.in-addr.arpa
            IN PTR
            Response
            96.136.73.23.in-addr.arpa
            IN PTR
            a23-73-136-96deploystaticakamaitechnologiescom
          • flag-us
            DNS
            95.221.229.192.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            95.221.229.192.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            73.159.190.20.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            73.159.190.20.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            232.168.11.51.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            232.168.11.51.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            geoplugin.net
            5868bd786a53297dfb2265f5f00d55cdc21ab25aa803acd288a39d59507d25ef.exe
            Remote address:
            8.8.8.8:53
            Request
            geoplugin.net
            IN A
            Response
            geoplugin.net
            IN A
            178.237.33.50
          • flag-nl
            GET
            http://geoplugin.net/json.gp
            5868bd786a53297dfb2265f5f00d55cdc21ab25aa803acd288a39d59507d25ef.exe
            Remote address:
            178.237.33.50:80
            Request
            GET /json.gp HTTP/1.1
            Host: geoplugin.net
            Cache-Control: no-cache
            Response
            HTTP/1.1 200 OK
            date: Mon, 02 Sep 2024 07:57:53 GMT
            server: Apache
            content-length: 955
            content-type: application/json; charset=utf-8
            cache-control: public, max-age=300
            access-control-allow-origin: *
          • flag-us
            DNS
            204.161.207.67.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            204.161.207.67.in-addr.arpa
            IN PTR
            Response
            204.161.207.67.in-addr.arpa
            IN PTR
            67207161204rdnsColocationAmericacom
          • flag-us
            DNS
            204.161.207.67.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            204.161.207.67.in-addr.arpa
            IN PTR
          • flag-us
            DNS
            204.161.207.67.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            204.161.207.67.in-addr.arpa
            IN PTR
          • flag-us
            DNS
            50.33.237.178.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            50.33.237.178.in-addr.arpa
            IN PTR
            Response
            50.33.237.178.in-addr.arpa
            IN CNAME
            50.32/27.178.237.178.in-addr.arpa
          • flag-us
            DNS
            50.33.237.178.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            50.33.237.178.in-addr.arpa
            IN PTR
          • flag-us
            DNS
            183.59.114.20.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            183.59.114.20.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            206.23.85.13.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            206.23.85.13.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            172.214.232.199.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            172.214.232.199.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            23.236.111.52.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            23.236.111.52.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            240.221.184.93.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            240.221.184.93.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            209.143.182.52.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            209.143.182.52.in-addr.arpa
            IN PTR
            Response
          • 127.0.0.1:2404
            5868bd786a53297dfb2265f5f00d55cdc21ab25aa803acd288a39d59507d25ef.exe
          • 67.207.161.204:2404
            tls
            5868bd786a53297dfb2265f5f00d55cdc21ab25aa803acd288a39d59507d25ef.exe
            4.5kB
            1.7kB
            15
            17
          • 67.207.161.204:2404
            tls
            5868bd786a53297dfb2265f5f00d55cdc21ab25aa803acd288a39d59507d25ef.exe
            36.0kB
            519.2kB
            235
            386
          • 178.237.33.50:80
            http://geoplugin.net/json.gp
            http
            5868bd786a53297dfb2265f5f00d55cdc21ab25aa803acd288a39d59507d25ef.exe
            439 B
            1.4kB
            8
            6

            HTTP Request

            GET http://geoplugin.net/json.gp

            HTTP Response

            200
          • 8.8.8.8:53
            8.8.8.8.in-addr.arpa
            dns
            66 B
            90 B
            1
            1

            DNS Request

            8.8.8.8.in-addr.arpa

          • 8.8.8.8:53
            97.17.167.52.in-addr.arpa
            dns
            71 B
            145 B
            1
            1

            DNS Request

            97.17.167.52.in-addr.arpa

          • 8.8.8.8:53
            96.136.73.23.in-addr.arpa
            dns
            71 B
            135 B
            1
            1

            DNS Request

            96.136.73.23.in-addr.arpa

          • 8.8.8.8:53
            73.159.190.20.in-addr.arpa
            dns
            72 B
            158 B
            1
            1

            DNS Request

            73.159.190.20.in-addr.arpa

          • 8.8.8.8:53
            95.221.229.192.in-addr.arpa
            dns
            73 B
            144 B
            1
            1

            DNS Request

            95.221.229.192.in-addr.arpa

          • 8.8.8.8:53
            232.168.11.51.in-addr.arpa
            dns
            72 B
            158 B
            1
            1

            DNS Request

            232.168.11.51.in-addr.arpa

          • 8.8.8.8:53
            geoplugin.net
            dns
            5868bd786a53297dfb2265f5f00d55cdc21ab25aa803acd288a39d59507d25ef.exe
            59 B
            75 B
            1
            1

            DNS Request

            geoplugin.net

            DNS Response

            178.237.33.50

          • 8.8.8.8:53
            204.161.207.67.in-addr.arpa
            dns
            219 B
            128 B
            3
            1

            DNS Request

            204.161.207.67.in-addr.arpa

            DNS Request

            204.161.207.67.in-addr.arpa

            DNS Request

            204.161.207.67.in-addr.arpa

          • 8.8.8.8:53
            50.33.237.178.in-addr.arpa
            dns
            144 B
            155 B
            2
            1

            DNS Request

            50.33.237.178.in-addr.arpa

            DNS Request

            50.33.237.178.in-addr.arpa

          • 8.8.8.8:53
            183.59.114.20.in-addr.arpa
            dns
            72 B
            158 B
            1
            1

            DNS Request

            183.59.114.20.in-addr.arpa

          • 8.8.8.8:53
            206.23.85.13.in-addr.arpa
            dns
            71 B
            145 B
            1
            1

            DNS Request

            206.23.85.13.in-addr.arpa

          • 8.8.8.8:53
            172.214.232.199.in-addr.arpa
            dns
            74 B
            128 B
            1
            1

            DNS Request

            172.214.232.199.in-addr.arpa

          • 8.8.8.8:53
            23.236.111.52.in-addr.arpa
            dns
            72 B
            158 B
            1
            1

            DNS Request

            23.236.111.52.in-addr.arpa

          • 8.8.8.8:53
            240.221.184.93.in-addr.arpa
            dns
            73 B
            144 B
            1
            1

            DNS Request

            240.221.184.93.in-addr.arpa

          • 8.8.8.8:53
            209.143.182.52.in-addr.arpa
            dns
            73 B
            147 B
            1
            1

            DNS Request

            209.143.182.52.in-addr.arpa

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\tufvyxfxq

            Filesize

            4KB

            MD5

            cda83eba5a004554ccdc061fd3df499c

            SHA1

            58ff2ecb9d47be10335e104896c87c62dc328523

            SHA256

            e384f4d46587646c6e0f9d2ee90b7bc57b49cea936b37cf8ab81ef3c4ce468ac

            SHA512

            f55ce20f0cf8b603fad765b889607f967c22d377fa4ac417ba1309d0aced9231e197bb4107d1c92bb99f51c04cc68ce26148727a8b694886710100c01f3de597

          • memory/840-31-0x0000000000400000-0x0000000000424000-memory.dmp

            Filesize

            144KB

          • memory/2440-0-0x000000007493E000-0x000000007493F000-memory.dmp

            Filesize

            4KB

          • memory/2440-2-0x0000000005BB0000-0x0000000006154000-memory.dmp

            Filesize

            5.6MB

          • memory/2440-4-0x0000000074930000-0x00000000750E0000-memory.dmp

            Filesize

            7.7MB

          • memory/2440-5-0x0000000005590000-0x000000000559A000-memory.dmp

            Filesize

            40KB

          • memory/2440-6-0x0000000008240000-0x0000000008258000-memory.dmp

            Filesize

            96KB

          • memory/2440-7-0x000000007493E000-0x000000007493F000-memory.dmp

            Filesize

            4KB

          • memory/2440-8-0x0000000074930000-0x00000000750E0000-memory.dmp

            Filesize

            7.7MB

          • memory/2440-9-0x0000000006660000-0x0000000006720000-memory.dmp

            Filesize

            768KB

          • memory/2440-10-0x0000000006930000-0x00000000069CC000-memory.dmp

            Filesize

            624KB

          • memory/2440-1-0x00000000009F0000-0x0000000000AF4000-memory.dmp

            Filesize

            1.0MB

          • memory/2440-3-0x00000000054E0000-0x0000000005572000-memory.dmp

            Filesize

            584KB

          • memory/2440-18-0x0000000074930000-0x00000000750E0000-memory.dmp

            Filesize

            7.7MB

          • memory/3144-50-0x0000000000400000-0x0000000000478000-memory.dmp

            Filesize

            480KB

          • memory/3144-33-0x0000000000400000-0x0000000000478000-memory.dmp

            Filesize

            480KB

          • memory/3144-35-0x0000000000400000-0x0000000000478000-memory.dmp

            Filesize

            480KB

          • memory/3144-37-0x0000000000400000-0x0000000000478000-memory.dmp

            Filesize

            480KB

          • memory/3144-28-0x0000000000400000-0x0000000000478000-memory.dmp

            Filesize

            480KB

          • memory/4980-38-0x0000000000400000-0x0000000000462000-memory.dmp

            Filesize

            392KB

          • memory/4980-30-0x0000000000400000-0x0000000000462000-memory.dmp

            Filesize

            392KB

          • memory/4980-42-0x0000000000400000-0x0000000000462000-memory.dmp

            Filesize

            392KB

          • memory/4980-36-0x0000000000400000-0x0000000000462000-memory.dmp

            Filesize

            392KB

          • memory/4980-34-0x0000000000400000-0x0000000000462000-memory.dmp

            Filesize

            392KB

          • memory/5108-12-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/5108-53-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/5108-26-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/5108-23-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/5108-24-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/5108-22-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/5108-21-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/5108-19-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/5108-16-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/5108-17-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/5108-15-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/5108-14-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/5108-11-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/5108-27-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/5108-52-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/5108-54-0x0000000010000000-0x0000000010019000-memory.dmp

            Filesize

            100KB

          • memory/5108-57-0x0000000010000000-0x0000000010019000-memory.dmp

            Filesize

            100KB

          • memory/5108-58-0x0000000010000000-0x0000000010019000-memory.dmp

            Filesize

            100KB

          • memory/5108-59-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/5108-60-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/5108-61-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/5108-62-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/5108-63-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/5108-64-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          • memory/5108-65-0x0000000000400000-0x0000000000482000-memory.dmp

            Filesize

            520KB

          We care about your privacy.

          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.