Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-09-2024 16:05

General

  • Target

    CompanyDetails.exe

  • Size

    988KB

  • MD5

    dc6296c1f5ec3b6e4dcbc33d0fcf3616

  • SHA1

    64c81ccb99415efe3aaffcfeea93d15fc08b735b

  • SHA256

    d776f6152105609e96a665bf681b71c945da8341b326410ee20e6a31b234d4c9

  • SHA512

    e28695c316d1b5d2d35726ed3f68ebccc1d07083d3b533b90ac9a1cf697ebbee8794278625107f305e22b55c68a1a820a73103f208f6f6a0f40ecf24f4b5db98

  • SSDEEP

    24576:72R1pA1DLK3qSmuyhBaNV8DDCANtsMFSzraULSgk:OPA1DLKagy4V8DftsgSzraR

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

127.0.0.1:59321

nnamoo.duckdns.org:59321

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-41EVS0

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CompanyDetails.exe
    "C:\Users\Admin\AppData\Local\Temp\CompanyDetails.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\CompanyDetails.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3120
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\YHWyXapflg.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4928
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YHWyXapflg" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF24F.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:1840
    • C:\Users\Admin\AppData\Local\Temp\CompanyDetails.exe
      "C:\Users\Admin\AppData\Local\Temp\CompanyDetails.exe"
      2⤵
        PID:5024
      • C:\Users\Admin\AppData\Local\Temp\CompanyDetails.exe
        "C:\Users\Admin\AppData\Local\Temp\CompanyDetails.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:3736

    Network

    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      97.17.167.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      97.17.167.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      240.143.123.92.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      240.143.123.92.in-addr.arpa
      IN PTR
      Response
      240.143.123.92.in-addr.arpa
      IN PTR
      a92-123-143-240deploystaticakamaitechnologiescom
    • flag-us
      DNS
      146.177.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      146.177.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      217.106.137.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      217.106.137.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      nnamoo.duckdns.org
      CompanyDetails.exe
      Remote address:
      8.8.8.8:53
      Request
      nnamoo.duckdns.org
      IN A
      Response
      nnamoo.duckdns.org
      IN A
      103.186.117.126
    • flag-us
      DNS
      126.117.186.103.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      126.117.186.103.in-addr.arpa
      IN PTR
      Response
      126.117.186.103.in-addr.arpa
      IN PTR
      wixcom
    • flag-us
      DNS
      geoplugin.net
      CompanyDetails.exe
      Remote address:
      8.8.8.8:53
      Request
      geoplugin.net
      IN A
      Response
      geoplugin.net
      IN A
      178.237.33.50
    • flag-nl
      GET
      http://geoplugin.net/json.gp
      CompanyDetails.exe
      Remote address:
      178.237.33.50:80
      Request
      GET /json.gp HTTP/1.1
      Host: geoplugin.net
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      date: Thu, 19 Sep 2024 16:05:35 GMT
      server: Apache
      content-length: 955
      content-type: application/json; charset=utf-8
      cache-control: public, max-age=300
      access-control-allow-origin: *
    • flag-us
      DNS
      50.33.237.178.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      50.33.237.178.in-addr.arpa
      IN PTR
      Response
      50.33.237.178.in-addr.arpa
      IN CNAME
      50.32/27.178.237.178.in-addr.arpa
    • flag-us
      DNS
      50.23.12.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      50.23.12.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      171.39.242.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      171.39.242.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      217.135.221.88.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      217.135.221.88.in-addr.arpa
      IN PTR
      Response
      217.135.221.88.in-addr.arpa
      IN PTR
      a88-221-135-217deploystaticakamaitechnologiescom
    • flag-us
      DNS
      43.56.20.217.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      43.56.20.217.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      23.236.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      23.236.111.52.in-addr.arpa
      IN PTR
      Response
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      tls
      CompanyDetails.exe
      3.2kB
      1.5kB
      13
      16
    • 178.237.33.50:80
      http://geoplugin.net/json.gp
      http
      CompanyDetails.exe
      623 B
      1.3kB
      12
      3

      HTTP Request

      GET http://geoplugin.net/json.gp

      HTTP Response

      200
    • 127.0.0.1:59321
      CompanyDetails.exe
    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      66 B
      90 B
      1
      1

      DNS Request

      8.8.8.8.in-addr.arpa

    • 8.8.8.8:53
      97.17.167.52.in-addr.arpa
      dns
      71 B
      145 B
      1
      1

      DNS Request

      97.17.167.52.in-addr.arpa

    • 8.8.8.8:53
      240.143.123.92.in-addr.arpa
      dns
      73 B
      139 B
      1
      1

      DNS Request

      240.143.123.92.in-addr.arpa

    • 8.8.8.8:53
      146.177.190.20.in-addr.arpa
      dns
      73 B
      159 B
      1
      1

      DNS Request

      146.177.190.20.in-addr.arpa

    • 8.8.8.8:53
      217.106.137.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      217.106.137.52.in-addr.arpa

    • 8.8.8.8:53
      nnamoo.duckdns.org
      dns
      CompanyDetails.exe
      64 B
      80 B
      1
      1

      DNS Request

      nnamoo.duckdns.org

      DNS Response

      103.186.117.126

    • 8.8.8.8:53
      126.117.186.103.in-addr.arpa
      dns
      74 B
      95 B
      1
      1

      DNS Request

      126.117.186.103.in-addr.arpa

    • 8.8.8.8:53
      geoplugin.net
      dns
      CompanyDetails.exe
      59 B
      75 B
      1
      1

      DNS Request

      geoplugin.net

      DNS Response

      178.237.33.50

    • 8.8.8.8:53
      50.33.237.178.in-addr.arpa
      dns
      72 B
      155 B
      1
      1

      DNS Request

      50.33.237.178.in-addr.arpa

    • 8.8.8.8:53
      50.23.12.20.in-addr.arpa
      dns
      70 B
      156 B
      1
      1

      DNS Request

      50.23.12.20.in-addr.arpa

    • 8.8.8.8:53
      171.39.242.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      171.39.242.20.in-addr.arpa

    • 8.8.8.8:53
      217.135.221.88.in-addr.arpa
      dns
      73 B
      139 B
      1
      1

      DNS Request

      217.135.221.88.in-addr.arpa

    • 8.8.8.8:53
      43.56.20.217.in-addr.arpa
      dns
      71 B
      131 B
      1
      1

      DNS Request

      43.56.20.217.in-addr.arpa

    • 8.8.8.8:53
      23.236.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      23.236.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      968cb9309758126772781b83adb8a28f

      SHA1

      8da30e71accf186b2ba11da1797cf67f8f78b47c

      SHA256

      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

      SHA512

      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      fa3a8042102018bc1cab27b24d7444f1

      SHA1

      b84b676e36402c24b23420d29a681bf3db77be33

      SHA256

      970efd3c37c4f7be37783c2980f5ee5676e76c88c00eeb35cdb055256db94551

      SHA512

      3da4aac2bcc744b122947ef37b64b3e0e6cd25a0ad1ce10434a26718e781665ea0a7fff3ee964284fc1f776769a3a9f439f4035d0fd03ac47489b3619674d646

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ebcrtao.wnw.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\tmpF24F.tmp

      Filesize

      1KB

      MD5

      3a09d69a5c674e8f5632b6ea19364693

      SHA1

      cacd767900b654475d620527130847f236ff31ae

      SHA256

      35a0336dae5942ae2343701ddd4b2cb25b8961527a8056b644f1bec4ffdd371c

      SHA512

      d2a8bbfca5f1192add8c7c5d4dd18416727e4426359a65cf4d133f6f5d58d65cccaaa97bef8ec857ce8ce803d3c6b054439893cbebfe376c5c7799deb132d40c

    • memory/3020-4-0x0000000005090000-0x000000000509A000-memory.dmp

      Filesize

      40KB

    • memory/3020-5-0x0000000074500000-0x0000000074CB0000-memory.dmp

      Filesize

      7.7MB

    • memory/3020-6-0x00000000055E0000-0x00000000055F0000-memory.dmp

      Filesize

      64KB

    • memory/3020-7-0x000000007450E000-0x000000007450F000-memory.dmp

      Filesize

      4KB

    • memory/3020-8-0x0000000074500000-0x0000000074CB0000-memory.dmp

      Filesize

      7.7MB

    • memory/3020-9-0x0000000006E80000-0x0000000006F3E000-memory.dmp

      Filesize

      760KB

    • memory/3020-10-0x00000000094C0000-0x000000000955C000-memory.dmp

      Filesize

      624KB

    • memory/3020-3-0x00000000050F0000-0x0000000005182000-memory.dmp

      Filesize

      584KB

    • memory/3020-2-0x0000000005600000-0x0000000005BA4000-memory.dmp

      Filesize

      5.6MB

    • memory/3020-0-0x000000007450E000-0x000000007450F000-memory.dmp

      Filesize

      4KB

    • memory/3020-53-0x0000000074500000-0x0000000074CB0000-memory.dmp

      Filesize

      7.7MB

    • memory/3020-1-0x00000000005A0000-0x000000000069C000-memory.dmp

      Filesize

      1008KB

    • memory/3120-55-0x000000006F010000-0x000000006F05C000-memory.dmp

      Filesize

      304KB

    • memory/3120-93-0x0000000074500000-0x0000000074CB0000-memory.dmp

      Filesize

      7.7MB

    • memory/3120-23-0x0000000005480000-0x00000000054E6000-memory.dmp

      Filesize

      408KB

    • memory/3120-22-0x0000000005410000-0x0000000005476000-memory.dmp

      Filesize

      408KB

    • memory/3120-21-0x0000000004D20000-0x0000000004D42000-memory.dmp

      Filesize

      136KB

    • memory/3120-25-0x0000000074500000-0x0000000074CB0000-memory.dmp

      Filesize

      7.7MB

    • memory/3120-26-0x00000000054F0000-0x0000000005844000-memory.dmp

      Filesize

      3.3MB

    • memory/3120-15-0x00000000021F0000-0x0000000002226000-memory.dmp

      Filesize

      216KB

    • memory/3120-16-0x0000000074500000-0x0000000074CB0000-memory.dmp

      Filesize

      7.7MB

    • memory/3120-87-0x0000000007090000-0x0000000007098000-memory.dmp

      Filesize

      32KB

    • memory/3120-85-0x0000000007050000-0x0000000007064000-memory.dmp

      Filesize

      80KB

    • memory/3120-84-0x0000000007040000-0x000000000704E000-memory.dmp

      Filesize

      56KB

    • memory/3120-83-0x0000000007010000-0x0000000007021000-memory.dmp

      Filesize

      68KB

    • memory/3120-51-0x0000000005AF0000-0x0000000005B0E000-memory.dmp

      Filesize

      120KB

    • memory/3120-18-0x0000000074500000-0x0000000074CB0000-memory.dmp

      Filesize

      7.7MB

    • memory/3120-52-0x0000000006000000-0x000000000604C000-memory.dmp

      Filesize

      304KB

    • memory/3120-17-0x0000000004DE0000-0x0000000005408000-memory.dmp

      Filesize

      6.2MB

    • memory/3120-54-0x00000000060E0000-0x0000000006112000-memory.dmp

      Filesize

      200KB

    • memory/3120-66-0x0000000006AD0000-0x0000000006B73000-memory.dmp

      Filesize

      652KB

    • memory/3120-65-0x00000000060A0000-0x00000000060BE000-memory.dmp

      Filesize

      120KB

    • memory/3120-79-0x0000000006C70000-0x0000000006C7A000-memory.dmp

      Filesize

      40KB

    • memory/3120-77-0x0000000007550000-0x0000000007BCA000-memory.dmp

      Filesize

      6.5MB

    • memory/3736-100-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3736-80-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3736-106-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3736-95-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3736-105-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3736-82-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3736-50-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3736-48-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3736-104-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3736-47-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3736-46-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3736-103-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3736-107-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3736-102-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3736-101-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3736-96-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3736-97-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/3736-99-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/4928-78-0x0000000007980000-0x000000000799A000-memory.dmp

      Filesize

      104KB

    • memory/4928-81-0x0000000007C00000-0x0000000007C96000-memory.dmp

      Filesize

      600KB

    • memory/4928-67-0x000000006F010000-0x000000006F05C000-memory.dmp

      Filesize

      304KB

    • memory/4928-36-0x0000000074500000-0x0000000074CB0000-memory.dmp

      Filesize

      7.7MB

    • memory/4928-86-0x0000000007CC0000-0x0000000007CDA000-memory.dmp

      Filesize

      104KB

    • memory/4928-19-0x0000000074500000-0x0000000074CB0000-memory.dmp

      Filesize

      7.7MB

    • memory/4928-94-0x0000000074500000-0x0000000074CB0000-memory.dmp

      Filesize

      7.7MB

    • memory/4928-24-0x0000000074500000-0x0000000074CB0000-memory.dmp

      Filesize

      7.7MB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.