Analysis

  • max time kernel
    148s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12-09-2024 10:01

General

  • Target

    New Order.exe

  • Size

    899KB

  • MD5

    8d1627dd83de9ad6ea38b9b3d7e232fc

  • SHA1

    6108d6e669d30d0586335dfd2f7126c138cf3ab1

  • SHA256

    699ab96ab77fb83fb6468bfc51531a91899fe94048e526ae232fb6fe9ac52290

  • SHA512

    f9a30622d1b643e954375ef6a81f9273cfa1bd1dd93a18b97aaf24fcd1f489950fe54d7516129efb7418445beee029663306e65f78d3adda30eb4fdbb3f43ac9

  • SSDEEP

    24576:ISaWiW60OWtDBDtOBXT7GN+QXvADJz2sGamXP+Pr:ISf605tm7GQQNL

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

192.3.64.152:2559

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-TS121V

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Order.exe
    "C:\Users\Admin\AppData\Local\Temp\New Order.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1448
    • C:\Users\Admin\AppData\Local\Temp\New Order.exe
      "C:\Users\Admin\AppData\Local\Temp\New Order.exe"
      2⤵
        PID:2688
      • C:\Users\Admin\AppData\Local\Temp\New Order.exe
        "C:\Users\Admin\AppData\Local\Temp\New Order.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2568

    Network

    • flag-us
      DNS
      geoplugin.net
      New Order.exe
      Remote address:
      8.8.8.8:53
      Request
      geoplugin.net
      IN A
      Response
      geoplugin.net
      IN A
      178.237.33.50
    • flag-nl
      GET
      http://geoplugin.net/json.gp
      New Order.exe
      Remote address:
      178.237.33.50:80
      Request
      GET /json.gp HTTP/1.1
      Host: geoplugin.net
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      date: Thu, 12 Sep 2024 10:01:21 GMT
      server: Apache
      content-length: 954
      content-type: application/json; charset=utf-8
      cache-control: public, max-age=300
      access-control-allow-origin: *
    • 192.3.64.152:2559
      tls
      New Order.exe
      3.2kB
      1.5kB
      12
      16
    • 178.237.33.50:80
      http://geoplugin.net/json.gp
      http
      New Order.exe
      623 B
      2.5kB
      12
      4

      HTTP Request

      GET http://geoplugin.net/json.gp

      HTTP Response

      200
    • 8.8.8.8:53
      geoplugin.net
      dns
      New Order.exe
      59 B
      75 B
      1
      1

      DNS Request

      geoplugin.net

      DNS Response

      178.237.33.50

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1448-0-0x000000007431E000-0x000000007431F000-memory.dmp

      Filesize

      4KB

    • memory/1448-1-0x0000000000840000-0x0000000000928000-memory.dmp

      Filesize

      928KB

    • memory/1448-2-0x0000000074310000-0x00000000749FE000-memory.dmp

      Filesize

      6.9MB

    • memory/1448-3-0x0000000000430000-0x0000000000440000-memory.dmp

      Filesize

      64KB

    • memory/1448-4-0x000000007431E000-0x000000007431F000-memory.dmp

      Filesize

      4KB

    • memory/1448-5-0x0000000074310000-0x00000000749FE000-memory.dmp

      Filesize

      6.9MB

    • memory/1448-6-0x0000000004FE0000-0x00000000050A0000-memory.dmp

      Filesize

      768KB

    • memory/1448-29-0x0000000074310000-0x00000000749FE000-memory.dmp

      Filesize

      6.9MB

    • memory/2568-9-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2568-27-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2568-20-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2568-18-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2568-16-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2568-14-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2568-12-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2568-10-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2568-24-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2568-28-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2568-26-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2568-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2568-7-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2568-31-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2568-30-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2568-32-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2568-35-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2568-36-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2568-37-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2568-38-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2568-39-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2568-40-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2568-41-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2568-42-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.