Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-09-2024 00:30

General

  • Target

    2024-09-04_29f1032b17157ed6c32afe5941c03ddf_avoslocker_poet-rat_rhadamanthys.exe

  • Size

    9.9MB

  • MD5

    29f1032b17157ed6c32afe5941c03ddf

  • SHA1

    5c041e94c20cce7d987b1ba523c4a53b718a75e4

  • SHA256

    a5a68d1970badfb04025a60c445bc1cdfd8bae3ba5e9d582f9fee45634bf7419

  • SHA512

    e19fd153ae2fbf4b0cdc823696502fd49527ca454ab1e6cdc2189464ca0843bcd9d3e2e4770099c7e2e92473dfafaaf8e70fadfb6dcc081fa5b772d75ac3761d

  • SSDEEP

    196608:aZpzYZVdl3/sGFKIWN3O8VuYJ/VFWPeEGM:aePRFKIW5NMa/VAjr

Malware Config

Extracted

Family

remcos

Botnet

ROSALINDA

C2

wedrfidsvijdvbikbdfv.con-ip.com:1661

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-U25YPG

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-04_29f1032b17157ed6c32afe5941c03ddf_avoslocker_poet-rat_rhadamanthys.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-04_29f1032b17157ed6c32afe5941c03ddf_avoslocker_poet-rat_rhadamanthys.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4148
    • C:\Users\Admin\AppData\Local\Temp\2024-09-04_29f1032b17157ed6c32afe5941c03ddf_avoslocker_poet-rat_rhadamanthys.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-09-04_29f1032b17157ed6c32afe5941c03ddf_avoslocker_poet-rat_rhadamanthys.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4604

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    154.239.44.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    154.239.44.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    37.56.20.217.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    37.56.20.217.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    68.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    68.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    wedrfidsvijdvbikbdfv.con-ip.com
    2024-09-04_29f1032b17157ed6c32afe5941c03ddf_avoslocker_poet-rat_rhadamanthys.exe
    Remote address:
    8.8.8.8:53
    Request
    wedrfidsvijdvbikbdfv.con-ip.com
    IN A
    Response
    wedrfidsvijdvbikbdfv.con-ip.com
    IN A
    179.15.149.222
  • flag-us
    DNS
    133.211.185.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.211.185.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    222.149.15.179.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    222.149.15.179.in-addr.arpa
    IN PTR
    Response
    222.149.15.179.in-addr.arpa
    IN PTR
    Dinamic-Tigo-179-15-149-222tigocomco
  • flag-us
    DNS
    geoplugin.net
    2024-09-04_29f1032b17157ed6c32afe5941c03ddf_avoslocker_poet-rat_rhadamanthys.exe
    Remote address:
    8.8.8.8:53
    Request
    geoplugin.net
    IN A
    Response
    geoplugin.net
    IN A
    178.237.33.50
  • flag-nl
    GET
    http://geoplugin.net/json.gp
    2024-09-04_29f1032b17157ed6c32afe5941c03ddf_avoslocker_poet-rat_rhadamanthys.exe
    Remote address:
    178.237.33.50:80
    Request
    GET /json.gp HTTP/1.1
    Host: geoplugin.net
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    date: Wed, 04 Sep 2024 00:30:29 GMT
    server: Apache
    content-length: 954
    content-type: application/json; charset=utf-8
    cache-control: public, max-age=300
    access-control-allow-origin: *
  • flag-us
    DNS
    50.33.237.178.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.33.237.178.in-addr.arpa
    IN PTR
    Response
    50.33.237.178.in-addr.arpa
    IN CNAME
    50.32/27.178.237.178.in-addr.arpa
  • flag-us
    DNS
    86.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    130.118.77.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    130.118.77.104.in-addr.arpa
    IN PTR
    Response
    130.118.77.104.in-addr.arpa
    IN PTR
    a104-77-118-130deploystaticakamaitechnologiescom
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    43.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.173.189.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.173.189.20.in-addr.arpa
    IN PTR
    Response
  • 179.15.149.222:1661
    wedrfidsvijdvbikbdfv.con-ip.com
    tls
    2024-09-04_29f1032b17157ed6c32afe5941c03ddf_avoslocker_poet-rat_rhadamanthys.exe
    5.7kB
    2.2kB
    16
    16
  • 178.237.33.50:80
    http://geoplugin.net/json.gp
    http
    2024-09-04_29f1032b17157ed6c32afe5941c03ddf_avoslocker_poet-rat_rhadamanthys.exe
    623 B
    1.3kB
    12
    3

    HTTP Request

    GET http://geoplugin.net/json.gp

    HTTP Response

    200
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
    90 B
    1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    154.239.44.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    154.239.44.20.in-addr.arpa

  • 8.8.8.8:53
    37.56.20.217.in-addr.arpa
    dns
    71 B
    131 B
    1
    1

    DNS Request

    37.56.20.217.in-addr.arpa

  • 8.8.8.8:53
    68.159.190.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    68.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    wedrfidsvijdvbikbdfv.con-ip.com
    dns
    2024-09-04_29f1032b17157ed6c32afe5941c03ddf_avoslocker_poet-rat_rhadamanthys.exe
    77 B
    93 B
    1
    1

    DNS Request

    wedrfidsvijdvbikbdfv.con-ip.com

    DNS Response

    179.15.149.222

  • 8.8.8.8:53
    133.211.185.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    133.211.185.52.in-addr.arpa

  • 8.8.8.8:53
    222.149.15.179.in-addr.arpa
    dns
    73 B
    126 B
    1
    1

    DNS Request

    222.149.15.179.in-addr.arpa

  • 8.8.8.8:53
    geoplugin.net
    dns
    2024-09-04_29f1032b17157ed6c32afe5941c03ddf_avoslocker_poet-rat_rhadamanthys.exe
    59 B
    75 B
    1
    1

    DNS Request

    geoplugin.net

    DNS Response

    178.237.33.50

  • 8.8.8.8:53
    50.33.237.178.in-addr.arpa
    dns
    72 B
    155 B
    1
    1

    DNS Request

    50.33.237.178.in-addr.arpa

  • 8.8.8.8:53
    86.23.85.13.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    86.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    130.118.77.104.in-addr.arpa
    dns
    73 B
    139 B
    1
    1

    DNS Request

    130.118.77.104.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    43.229.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    43.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    18.173.189.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    18.173.189.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\remcos\logs.dat

    Filesize

    144B

    MD5

    0ef1c280fb80fcadf68bb2c5229408e0

    SHA1

    5b0fd2b89350c5cdb3c51f4ec85d7892beac6a90

    SHA256

    8936651e80af662dbd2fd7cd50ca0041da37fcb41730de54a6a61ac65b3ddb7d

    SHA512

    e2f1b71eacd1f72635719c96a94a793c98622efe8ef207987bddba5e0b0fa1a8f90eb841e002fd5d1b3c4db9d9c9d7bdd9fd13fa0b1c95fdd8d01c951c0de5db

  • memory/4148-8-0x0000000000400000-0x0000000000E2B000-memory.dmp

    Filesize

    10.2MB

  • memory/4148-3-0x0000000000400000-0x0000000000E2B000-memory.dmp

    Filesize

    10.2MB

  • memory/4148-1-0x0000000000D28000-0x0000000000D37000-memory.dmp

    Filesize

    60KB

  • memory/4148-5-0x0000000000400000-0x0000000000E2B000-memory.dmp

    Filesize

    10.2MB

  • memory/4148-0-0x0000000000400000-0x0000000000E2B000-memory.dmp

    Filesize

    10.2MB

  • memory/4148-2-0x0000000000400000-0x0000000000E2B000-memory.dmp

    Filesize

    10.2MB

  • memory/4148-7-0x0000000000400000-0x0000000000E2B000-memory.dmp

    Filesize

    10.2MB

  • memory/4604-14-0x0000000000E30000-0x0000000000EB2000-memory.dmp

    Filesize

    520KB

  • memory/4604-21-0x0000000000E30000-0x0000000000EB2000-memory.dmp

    Filesize

    520KB

  • memory/4604-10-0x0000000000E30000-0x0000000000EB2000-memory.dmp

    Filesize

    520KB

  • memory/4604-9-0x0000000000E30000-0x0000000000EB2000-memory.dmp

    Filesize

    520KB

  • memory/4604-15-0x0000000000E30000-0x0000000000EB2000-memory.dmp

    Filesize

    520KB

  • memory/4604-19-0x0000000000E30000-0x0000000000EB2000-memory.dmp

    Filesize

    520KB

  • memory/4604-17-0x0000000000E30000-0x0000000000EB2000-memory.dmp

    Filesize

    520KB

  • memory/4604-6-0x0000000000E30000-0x0000000000EB2000-memory.dmp

    Filesize

    520KB

  • memory/4604-18-0x0000000000E30000-0x0000000000EB2000-memory.dmp

    Filesize

    520KB

  • memory/4604-11-0x0000000000E30000-0x0000000000EB2000-memory.dmp

    Filesize

    520KB

  • memory/4604-16-0x0000000000400000-0x0000000000E2B000-memory.dmp

    Filesize

    10.2MB

  • memory/4604-27-0x0000000000E30000-0x0000000000EB2000-memory.dmp

    Filesize

    520KB

  • memory/4604-28-0x0000000000E30000-0x0000000000EB2000-memory.dmp

    Filesize

    520KB

  • memory/4604-35-0x0000000000E30000-0x0000000000EB2000-memory.dmp

    Filesize

    520KB

  • memory/4604-43-0x0000000000E30000-0x0000000000EB2000-memory.dmp

    Filesize

    520KB

  • memory/4604-44-0x0000000000E30000-0x0000000000EB2000-memory.dmp

    Filesize

    520KB

  • memory/4604-51-0x0000000000E30000-0x0000000000EB2000-memory.dmp

    Filesize

    520KB

  • memory/4604-52-0x0000000000E30000-0x0000000000EB2000-memory.dmp

    Filesize

    520KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.