Overview

overview

10

Static

static

10

Godaddy Ch...er.exe

windows7-x64

10

Godaddy Ch...er.exe

windows10-2004-x64

10

Godaddy Ch...ed.exe

windows7-x64

3

Godaddy Ch...ed.exe

windows10-2004-x64

3

Godaddy Ch...gn.dll

windows7-x64

1

Godaddy Ch...gn.dll

windows10-2004-x64

1

Godaddy Ch...ts.dll

windows7-x64

1

Godaddy Ch...ts.dll

windows10-2004-x64

1

Godaddy Ch...rk.dll

windows7-x64

1

Godaddy Ch...rk.dll

windows10-2004-x64

1

Godaddy Ch...ed.exe

windows7-x64

3

Godaddy Ch...ed.exe

windows10-2004-x64

3

Godaddy Ch...ip.dll

windows7-x64

1

Godaddy Ch...ip.dll

windows10-2004-x64

1

Godaddy Ch...er.exe

windows7-x64

8

Godaddy Ch...er.exe

windows10-2004-x64

8

Godaddy Ch...gn.dll

windows7-x64

1

Godaddy Ch...gn.dll

windows10-2004-x64

1

Godaddy Ch...ts.dll

windows7-x64

1

Godaddy Ch...ts.dll

windows10-2004-x64

1

Godaddy Ch...rk.dll

windows7-x64

1

Godaddy Ch...rk.dll

windows10-2004-x64

1

Godaddy Ch...og.exe

windows7-x64

10

Godaddy Ch...og.exe

windows10-2004-x64

10

Godaddy Ch...et.dll

windows7-x64

1

Godaddy Ch...et.dll

windows10-2004-x64

1

Godaddy Ch...et.dll

windows7-x64

1

Godaddy Ch...et.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    144s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09-09-2024 12:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Godaddy Checker Cracked/Godaddy Checker.exe

  • Size

    237KB

  • MD5

    e98be45445b8d748c2b1b21b6ac03199

  • SHA1

    45607a6a5a9da9558b8062dc922091227e4bdc22

  • SHA256

    faa7b3f064a999888aa49bc2d47aa73b64206fc94e24b6695a7ef17e13c9bfaa

  • SHA512

    55ca1c3e67fcdbe54522ace0aa349bd4011df13bc493575695722fcab83ad67eb7b024812b10d3ec11877ddcb19b5d544c08ce9f018b1201194243e0128f744f

  • SSDEEP

    3072:q4lbikV6jW+tKFh36Lv+GSBADfBZRBadxlv:q6bjMrETGmALon

Score
10/10
remcoshostdiscoveryevasionexecutionpersistencerat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

vshield.publicvm.com:5151

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    chrome.exe

  • copy_folder

    Google Chrome

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    true

  • install_path

    %AppData%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    Google Chrome

  • keylog_path

    %AppData%

  • mouse_option

    true

  • mutex

    remcos_ykhychcufk

  • screenshot_crypt

    true

  • screenshot_flag

    true

  • screenshot_folder

    Screens

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    chrome

  • take_screenshot_option

    true

  • take_screenshot_time

    5

  • take_screenshot_title

    paypal;amazon;nulled.to;cracked.to;ebay;blockchain;coinbase

Signatures

  • Modifies WinLogon for persistence 2 TTPs 4 IoCs
    persistence
  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    evasion
  • Adds policy Run key to start application 2 TTPs 4 IoCs
    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops startup file 1 IoCs
  • Executes dropped EXE 27 IoCs
  • Loads dropped DLL 53 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 53 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 25 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Godaddy Checker Cracked\Godaddy Checker.exe
    "C:\Users\Admin\AppData\Local\Temp\Godaddy Checker Cracked\Godaddy Checker.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2712
    • C:\Users\Admin\AppData\Local\Temp\Godaddy Checker Cracked\data\Launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\Godaddy Checker Cracked\data\Launcher.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2704
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Windows\IMF\
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2112
      • C:\Windows\IMF\Windows Services.exe
        "C:\Windows\IMF\Windows Services.exe" {Arguments If Needed}
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2200
        • C:\Windows\IMF\Secure System Shell.exe
          "C:\Windows\IMF\Secure System Shell.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2952
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2988
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1120
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1464
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2008
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1288
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3044
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2420
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2428
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1356
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1728
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:540
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2076
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1696
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2672
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1676
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1384
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2572
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1500
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1524
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2400
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2640
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2964
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2944
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2852
    • C:\Users\Admin\AppData\Local\Temp\Godaddy Checker Cracked\data\log.exe
      "C:\Users\Admin\AppData\Local\Temp\Godaddy Checker Cracked\data\log.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Adds policy Run key to start application
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2596
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2640
        • C:\Windows\SysWOW64\PING.EXE
          PING 127.0.0.1 -n 2
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2400
        • C:\Users\Admin\AppData\Roaming\Google Chrome\chrome.exe
          "C:\Users\Admin\AppData\Roaming\Google Chrome\chrome.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Adds policy Run key to start application
          • Executes dropped EXE
          • Adds Run key to start application
          • Modifies WinLogon
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          PID:1812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

4
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

2
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

4
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

2
T1547.004

Defense Evasion

Modify Registry

4
T1112

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

1
T1012

Remote System Discovery

1
T1018

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Virtualization/Sandbox Evasion

1
T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\install.bat
    Filesize

    106B

    MD5

    e4f4700738e33258cdbee476f5675217

    SHA1

    23644b39aa13334e1edab2632a0b78d41dcc42a4

    SHA256

    9636ee8e98fd8636f12714bfb323f3d1010d18dae6dbbba86766e1711348243c

    SHA512

    02c424ab221a85fc1ddcfc5137c10b6317b732cab63e993cd70d9f28b3e6df9dd9a3493f2ce146bf672be002b627b1c1a57cfd5ba9162db68c8f6f219adab5f6

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Screens\2.png
    Filesize

    371KB

    MD5

    78fa33244a1cdccdc0c3e3858d80d3e1

    SHA1

    75b10bdbd5ae57b711aae6d302afc1e7ae46aa9c

    SHA256

    dccac154f59276240a62d591c0e2f38eeb30c05ef9b567a34b78b7041cebf7ad

    SHA512

    05ac4eea1a9a60dc875e71db0e089c8a85f20135c2a06e9a7a543c5fbb5fda2df65e28b50c701ccab291814bc03031dbaffc475939a7c519477aacdfab6b21c6

    Download Submit

  • C:\Windows\IMF\Runtime Explorer.exe
    Filesize

    152KB

    MD5

    ebb29837eb4419d1b078a4ddad7cdf81

    SHA1

    eb9fd4478ccfbc7581ebccb6c447903fb3e679c1

    SHA256

    3f5867f3733dfef0f7df97e30baf4f28d03edb7e64efb4bd3a081efbe884327e

    SHA512

    8e293fbe49e8e482e6b801e4a92cc0f90de0ead080d3e60da92bf444eb5449e3bd407a3d27100d976447101011392368c90aa711f421cc37b434f1cbdda6ae20

    Download Submit

  • C:\Windows\IMF\Secure System Shell.exe
    Filesize

    45KB

    MD5

    7d0c7359e5b2daa5665d01afdc98cc00

    SHA1

    c3cc830c8ffd0f53f28d89dcd9f3426be87085cb

    SHA256

    f1abd5ab03189e82971513e6ca04bd372fcf234d670079888f01cf4addd49809

    SHA512

    a8f82b11b045d8dd744506f4f56f3382b33a03684a6aebc91a02ea901c101b91cb43b7d0213f72f39cbb22f616ecd5de8b9e6c99fb5669f26a3ea6bcb63c8407

    Download Submit

  • C:\Windows\IMF\Windows Services.exe
    Filesize

    46KB

    MD5

    ad0ce1302147fbdfecaec58480eb9cf9

    SHA1

    874efbc76e5f91bc1425a43ea19400340f98d42b

    SHA256

    2c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3

    SHA512

    adccd5520e01b673c2fc5c451305fe31b1a3e74891aece558f75fefc50218adf1fb81bb8c7f19969929d3fecb0fdb2cb5b564400d51e0a5a1ad8d5bc2d4eed53

    Download Submit

  • \Users\Admin\AppData\Roaming\Google Chrome\chrome.exe
    Filesize

    92KB

    MD5

    4daae6c7d8deeb9c398da69c722d5dfa

    SHA1

    fe3c3cdbc61ec00584f7d6ebdf0cae27e013c6b0

    SHA256

    690e5292cdbff69ed08e971ebb61261a4f0a9e2483aacb93b675f5ac3826ac06

    SHA512

    00ef31e6161741e427bda90457e9c6e192886637087278eac6b59872e3327a919b3a197ab40f9d367ca1651d10130ec9a267c772abf4d1e0b9c3e111b818148a

    Download Submit

  • memory/2200-58-0x00000000011E0000-0x00000000011F2000-memory.dmp

    Filesize

    72KB

    Download

  • memory/2704-6-0x0000000000800000-0x000000000087E000-memory.dmp

    Filesize

    504KB

    Download

  • memory/2704-3-0x0000000000BE0000-0x0000000000BF4000-memory.dmp

    Filesize

    80KB

    Download

  • memory/2704-5-0x0000000074510000-0x0000000074BFE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2704-4-0x0000000074510000-0x0000000074BFE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2704-60-0x0000000074510000-0x0000000074BFE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2712-2-0x0000000074510000-0x0000000074BFE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2712-8-0x0000000074510000-0x0000000074BFE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2712-0-0x000000007451E000-0x000000007451F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2712-1-0x0000000001200000-0x0000000001242000-memory.dmp

    Filesize

    264KB

    Download

  • memory/2952-68-0x0000000000D30000-0x0000000000D42000-memory.dmp

    Filesize

    72KB

    Download