Analysis

  • max time kernel
    148s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20-09-2024 09:15

General

  • Target

    bb982ea4dad990c5c393a7f1fb85a4daf85be97edcb1e1473cdd0703596ecd6d.exe

  • Size

    912KB

  • MD5

    365de72e3ea8c233861d9a80f7d7c1be

  • SHA1

    ba20d0609fe16e3f9e61a34928853c00184be26b

  • SHA256

    bb982ea4dad990c5c393a7f1fb85a4daf85be97edcb1e1473cdd0703596ecd6d

  • SHA512

    9c856fee64c4179865b9ae968b706fddd5151c3c405fa5b18d699801133dfde28250fdbcd16e31a8cbdcfb98ec8fe2efa6f769a921f54e505e5c5e1bc6822ed4

  • SSDEEP

    24576:u570jYrtQ+mJLt+pQZEPjhrnJtMVR8K85fGYan:u570jYrPwLt+pQSBnT8N85fGX

Malware Config

Extracted

Family

remcos

Botnet

3456789

C2

172.93.220.148:45682

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    765-8M14I5

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bb982ea4dad990c5c393a7f1fb85a4daf85be97edcb1e1473cdd0703596ecd6d.exe
    "C:\Users\Admin\AppData\Local\Temp\bb982ea4dad990c5c393a7f1fb85a4daf85be97edcb1e1473cdd0703596ecd6d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2524
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GwTIUBUaZCliF.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2712
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GwTIUBUaZCliF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBBD0.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2760
    • C:\Users\Admin\AppData\Local\Temp\bb982ea4dad990c5c393a7f1fb85a4daf85be97edcb1e1473cdd0703596ecd6d.exe
      "C:\Users\Admin\AppData\Local\Temp\bb982ea4dad990c5c393a7f1fb85a4daf85be97edcb1e1473cdd0703596ecd6d.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3000

Network

  • flag-us
    DNS
    geoplugin.net
    bb982ea4dad990c5c393a7f1fb85a4daf85be97edcb1e1473cdd0703596ecd6d.exe
    Remote address:
    8.8.8.8:53
    Request
    geoplugin.net
    IN A
    Response
    geoplugin.net
    IN A
    178.237.33.50
  • flag-nl
    GET
    http://geoplugin.net/json.gp
    bb982ea4dad990c5c393a7f1fb85a4daf85be97edcb1e1473cdd0703596ecd6d.exe
    Remote address:
    178.237.33.50:80
    Request
    GET /json.gp HTTP/1.1
    Host: geoplugin.net
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    date: Fri, 20 Sep 2024 09:15:43 GMT
    server: Apache
    content-length: 955
    content-type: application/json; charset=utf-8
    cache-control: public, max-age=300
    access-control-allow-origin: *
  • 172.93.220.148:45682
    bb982ea4dad990c5c393a7f1fb85a4daf85be97edcb1e1473cdd0703596ecd6d.exe
    2.4kB
    604 B
    9
    12
  • 178.237.33.50:80
    http://geoplugin.net/json.gp
    http
    bb982ea4dad990c5c393a7f1fb85a4daf85be97edcb1e1473cdd0703596ecd6d.exe
    577 B
    2.5kB
    11
    4

    HTTP Request

    GET http://geoplugin.net/json.gp

    HTTP Response

    200
  • 8.8.8.8:53
    geoplugin.net
    dns
    bb982ea4dad990c5c393a7f1fb85a4daf85be97edcb1e1473cdd0703596ecd6d.exe
    59 B
    75 B
    1
    1

    DNS Request

    geoplugin.net

    DNS Response

    178.237.33.50

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpBBD0.tmp

    Filesize

    1KB

    MD5

    f6e07c626094ca022e5a090f2c2ca6d2

    SHA1

    7dfbd71b4c1833a4863b81594e759ec7454fc0dd

    SHA256

    d8b006ea01c7d5c2757be97ec10ed42f44abd4a26724d8523d103c26ec52e11a

    SHA512

    704456b7ebced92f0af6eb07719e4af867784b2974ba4fe669c911ba6fac01d386b32a110ee56250e94b94717d7ab4d4098c31fd0abedce2e3e88e109048350c

  • memory/2524-35-0x00000000744F0000-0x0000000074BDE000-memory.dmp

    Filesize

    6.9MB

  • memory/2524-1-0x0000000001240000-0x0000000001328000-memory.dmp

    Filesize

    928KB

  • memory/2524-2-0x00000000744F0000-0x0000000074BDE000-memory.dmp

    Filesize

    6.9MB

  • memory/2524-3-0x00000000003D0000-0x00000000003E0000-memory.dmp

    Filesize

    64KB

  • memory/2524-4-0x00000000744FE000-0x00000000744FF000-memory.dmp

    Filesize

    4KB

  • memory/2524-5-0x00000000744F0000-0x0000000074BDE000-memory.dmp

    Filesize

    6.9MB

  • memory/2524-6-0x00000000057C0000-0x000000000587E000-memory.dmp

    Filesize

    760KB

  • memory/2524-0-0x00000000744FE000-0x00000000744FF000-memory.dmp

    Filesize

    4KB

  • memory/3000-28-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-36-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-34-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-14-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-32-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-31-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/3000-20-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-26-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-24-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-22-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-18-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-16-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-33-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-37-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-38-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-40-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-41-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-42-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-44-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-43-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-45-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-46-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-47-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/3000-48-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.