Analysis

  • max time kernel
    178s
  • max time network
    181s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-09-2024 22:14

General

  • Target

    ad94d38043653bb4972cc2bc198aa10e.exe

  • Size

    137KB

  • MD5

    ad94d38043653bb4972cc2bc198aa10e

  • SHA1

    f0ee00b32cf03a1375272025bb46e7d72f43f5fe

  • SHA256

    62cb3eef7360045ad839007ee3a28e7dfaba23607b875a0ac6543020b06f4a8b

  • SHA512

    a1c06fa0ee2467d9dabfc04d4e4488f891fa1228b344c1a08756121b56f895199f02cf8edcb461737c1e178b9bebdb504e5cd6dfa833d4f89054ce9a03b0498a

  • SSDEEP

    1536:I/UaoG+jAmd/FMz4+hxI+XmVegnTFmk7zp5K7/axJ2:I/tajAy/60VogZmkx5Kj5

Malware Config

Extracted

Family

remcos

Botnet

NUEVOS2

C2

comino83.con-ip.com:1835

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    registros.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    BBNNSNNDHJDJS-LPAR7G

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Capturas de pantalla

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3496
      • C:\Users\Admin\AppData\Local\Temp\ad94d38043653bb4972cc2bc198aa10e.exe
        "C:\Users\Admin\AppData\Local\Temp\ad94d38043653bb4972cc2bc198aa10e.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3652
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2200

    Network

    • flag-us
      DNS
      files.catbox.moe
      ad94d38043653bb4972cc2bc198aa10e.exe
      Remote address:
      8.8.8.8:53
      Request
      files.catbox.moe
      IN A
      Response
      files.catbox.moe
      IN A
      108.181.20.37
    • flag-us
      GET
      https://files.catbox.moe/dyyl2g.vdf
      ad94d38043653bb4972cc2bc198aa10e.exe
      Remote address:
      108.181.20.37:443
      Request
      GET /dyyl2g.vdf HTTP/1.1
      Host: files.catbox.moe
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Tue, 24 Sep 2024 22:15:03 GMT
      Content-Type: application/octet-stream
      Content-Length: 1145864
      Last-Modified: Thu, 12 Sep 2024 13:32:28 GMT
      Connection: keep-alive
      ETag: "66e2ed6c-117c08"
      X-Content-Type-Options: nosniff
      Content-Security-Policy: default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';
      Access-Control-Allow-Origin: *
      Access-Control-Allow-Methods: GET, HEAD
      Accept-Ranges: bytes
    • flag-us
      DNS
      209.205.72.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      209.205.72.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      37.20.181.108.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      37.20.181.108.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      81.144.22.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      81.144.22.2.in-addr.arpa
      IN PTR
      Response
      81.144.22.2.in-addr.arpa
      IN PTR
      a2-22-144-81deploystaticakamaitechnologiescom
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      comino83.con-ip.com
      InstallUtil.exe
      Remote address:
      8.8.8.8:53
      Request
      comino83.con-ip.com
      IN A
      Response
      comino83.con-ip.com
      IN A
      179.14.10.124
    • flag-us
      DNS
      86.23.85.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      86.23.85.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      15.164.165.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      15.164.165.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.214.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.214.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      13.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.227.111.52.in-addr.arpa
      IN PTR
      Response
    • 108.181.20.37:443
      https://files.catbox.moe/dyyl2g.vdf
      tls, http
      ad94d38043653bb4972cc2bc198aa10e.exe
      20.9kB
      1.2MB
      443
      857

      HTTP Request

      GET https://files.catbox.moe/dyyl2g.vdf

      HTTP Response

      200
    • 179.14.10.124:1835
      comino83.con-ip.com
      InstallUtil.exe
      260 B
      5
    • 179.14.10.124:1835
      comino83.con-ip.com
      InstallUtil.exe
      260 B
      5
    • 179.14.10.124:1835
      comino83.con-ip.com
      InstallUtil.exe
      260 B
      5
    • 179.14.10.124:1835
      comino83.con-ip.com
      InstallUtil.exe
      260 B
      5
    • 179.14.10.124:1835
      comino83.con-ip.com
      InstallUtil.exe
      260 B
      5
    • 179.14.10.124:1835
      comino83.con-ip.com
      InstallUtil.exe
      260 B
      5
    • 179.14.10.124:1835
      comino83.con-ip.com
      InstallUtil.exe
      260 B
      5
    • 179.14.10.124:1835
      comino83.con-ip.com
      InstallUtil.exe
      104 B
      2
    • 8.8.8.8:53
      files.catbox.moe
      dns
      ad94d38043653bb4972cc2bc198aa10e.exe
      62 B
      78 B
      1
      1

      DNS Request

      files.catbox.moe

      DNS Response

      108.181.20.37

    • 8.8.8.8:53
      209.205.72.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      209.205.72.20.in-addr.arpa

    • 8.8.8.8:53
      37.20.181.108.in-addr.arpa
      dns
      72 B
      134 B
      1
      1

      DNS Request

      37.20.181.108.in-addr.arpa

    • 8.8.8.8:53
      81.144.22.2.in-addr.arpa
      dns
      70 B
      133 B
      1
      1

      DNS Request

      81.144.22.2.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
      144 B
      1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      comino83.con-ip.com
      dns
      InstallUtil.exe
      65 B
      81 B
      1
      1

      DNS Request

      comino83.con-ip.com

      DNS Response

      179.14.10.124

    • 8.8.8.8:53
      86.23.85.13.in-addr.arpa
      dns
      70 B
      144 B
      1
      1

      DNS Request

      86.23.85.13.in-addr.arpa

    • 8.8.8.8:53
      15.164.165.52.in-addr.arpa
      dns
      72 B
      146 B
      1
      1

      DNS Request

      15.164.165.52.in-addr.arpa

    • 8.8.8.8:53
      172.214.232.199.in-addr.arpa
      dns
      74 B
      128 B
      1
      1

      DNS Request

      172.214.232.199.in-addr.arpa

    • 8.8.8.8:53
      13.227.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      13.227.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\remcos\registros.dat

      Filesize

      184B

      MD5

      5ec841db787eb9bedd7dcf8bab7517b6

      SHA1

      fea3b593e6f022a3c4f4028df2d6c7badaaa2689

      SHA256

      78b5291463c5462ac921e5d1753bac79a5fa6d76deb34381f00a13d9d3937729

      SHA512

      05fa7e4e707f85e6a069925870fb0ad5989fd8da934ab418cd7f50cd94d6b11ac3a973c8aa1c11aa4b2db6ae70357eae385d64e659820628760d072bd064a53d

    • memory/2200-1101-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/2200-1107-0x0000000000400000-0x0000000000482000-memory.dmp

      Filesize

      520KB

    • memory/3652-0-0x0000000074D9E000-0x0000000074D9F000-memory.dmp

      Filesize

      4KB

    • memory/3652-1-0x0000000000980000-0x00000000009A6000-memory.dmp

      Filesize

      152KB

    • memory/3652-2-0x0000000074D90000-0x0000000075540000-memory.dmp

      Filesize

      7.7MB

    • memory/3652-3-0x00000000052C0000-0x00000000052C6000-memory.dmp

      Filesize

      24KB

    • memory/3652-4-0x0000000005CE0000-0x0000000005DFE000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-22-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-20-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-68-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-66-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-64-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-62-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-58-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-56-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-54-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-52-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-48-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-46-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-44-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-42-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-40-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-38-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-36-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-34-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-32-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-31-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-28-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-26-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-24-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-18-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-16-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-12-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-10-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-8-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-60-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-50-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-14-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-6-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-5-0x0000000005CE0000-0x0000000005DF8000-memory.dmp

      Filesize

      1.1MB

    • memory/3652-1079-0x0000000074D90000-0x0000000075540000-memory.dmp

      Filesize

      7.7MB

    • memory/3652-1080-0x00000000061E0000-0x0000000006278000-memory.dmp

      Filesize

      608KB

    • memory/3652-1081-0x0000000006050000-0x000000000609C000-memory.dmp

      Filesize

      304KB

    • memory/3652-1085-0x0000000074D90000-0x0000000075540000-memory.dmp

      Filesize

      7.7MB

    • memory/3652-1088-0x0000000074D90000-0x0000000075540000-memory.dmp

      Filesize

      7.7MB

    • memory/3652-1087-0x0000000074D9E000-0x0000000074D9F000-memory.dmp

      Filesize

      4KB

    • memory/3652-1086-0x0000000074D90000-0x0000000075540000-memory.dmp

      Filesize

      7.7MB

    • memory/3652-1090-0x0000000074D90000-0x0000000075540000-memory.dmp

      Filesize

      7.7MB

    • memory/3652-1091-0x0000000074D90000-0x0000000075540000-memory.dmp

      Filesize

      7.7MB

    • memory/3652-1092-0x0000000006A50000-0x0000000006FF4000-memory.dmp

      Filesize

      5.6MB

    • memory/3652-1093-0x0000000006340000-0x0000000006394000-memory.dmp

      Filesize

      336KB

    • memory/3652-1103-0x0000000074D90000-0x0000000075540000-memory.dmp

      Filesize

      7.7MB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.