Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-09-2024 01:15

General

  • Target

    1c251b2a58b7c9c19bca9f5eb75fa7cd93a73fe07e34c1759a2381dda79ffda4.exe

  • Size

    897KB

  • MD5

    00cb16ec61346dc7a4410acbb683a6f2

  • SHA1

    d4c2741a51aef320c23e66221741bdbfbda9ddea

  • SHA256

    1c251b2a58b7c9c19bca9f5eb75fa7cd93a73fe07e34c1759a2381dda79ffda4

  • SHA512

    e33736dcb7e553bfdfc708c948413630496befdc9fc4bf5a83e42cea93ea400624379aeca984636b066c7d2377a524ce00112215c68a9dd6b4bdd9aba845ed9d

  • SSDEEP

    24576:qgEceydzP4Nj+x/SZ/Jk9R9Hq9AfQaz/smsNqGxDeI:qVkjmK9R9K9Af7sN3

Malware Config

Extracted

Family

remcos

Botnet

mekus

C2

dpm-sael.com:2017

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    meckus-ODY51K

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c251b2a58b7c9c19bca9f5eb75fa7cd93a73fe07e34c1759a2381dda79ffda4.exe
    "C:\Users\Admin\AppData\Local\Temp\1c251b2a58b7c9c19bca9f5eb75fa7cd93a73fe07e34c1759a2381dda79ffda4.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3684
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1c251b2a58b7c9c19bca9f5eb75fa7cd93a73fe07e34c1759a2381dda79ffda4.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1844
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jcXOqLBJLRu.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3236
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jcXOqLBJLRu" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD63C.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:4196
    • C:\Users\Admin\AppData\Local\Temp\1c251b2a58b7c9c19bca9f5eb75fa7cd93a73fe07e34c1759a2381dda79ffda4.exe
      "C:\Users\Admin\AppData\Local\Temp\1c251b2a58b7c9c19bca9f5eb75fa7cd93a73fe07e34c1759a2381dda79ffda4.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4684

Network

  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    67.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    67.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    dpm-sael.com
    1c251b2a58b7c9c19bca9f5eb75fa7cd93a73fe07e34c1759a2381dda79ffda4.exe
    Remote address:
    8.8.8.8:53
    Request
    dpm-sael.com
    IN A
    Response
    dpm-sael.com
    IN A
    64.176.178.205
  • flag-us
    DNS
    geoplugin.net
    1c251b2a58b7c9c19bca9f5eb75fa7cd93a73fe07e34c1759a2381dda79ffda4.exe
    Remote address:
    8.8.8.8:53
    Request
    geoplugin.net
    IN A
    Response
    geoplugin.net
    IN A
    178.237.33.50
  • flag-nl
    GET
    http://geoplugin.net/json.gp
    1c251b2a58b7c9c19bca9f5eb75fa7cd93a73fe07e34c1759a2381dda79ffda4.exe
    Remote address:
    178.237.33.50:80
    Request
    GET /json.gp HTTP/1.1
    Host: geoplugin.net
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    date: Wed, 25 Sep 2024 01:15:30 GMT
    server: Apache
    content-length: 955
    content-type: application/json; charset=utf-8
    cache-control: public, max-age=300
    access-control-allow-origin: *
  • flag-us
    DNS
    205.178.176.64.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    205.178.176.64.in-addr.arpa
    IN PTR
    Response
    205.178.176.64.in-addr.arpa
    IN PTR
    64176178205vultrusercontentcom
  • flag-us
    DNS
    50.33.237.178.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.33.237.178.in-addr.arpa
    IN PTR
    Response
    50.33.237.178.in-addr.arpa
    IN CNAME
    50.32/27.178.237.178.in-addr.arpa
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    26.165.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.165.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    92.12.20.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    92.12.20.2.in-addr.arpa
    IN PTR
    Response
    92.12.20.2.in-addr.arpa
    IN PTR
    a2-20-12-92deploystaticakamaitechnologiescom
  • 64.176.178.205:2017
    dpm-sael.com
    1c251b2a58b7c9c19bca9f5eb75fa7cd93a73fe07e34c1759a2381dda79ffda4.exe
    2.7kB
    744 B
    12
    15
  • 178.237.33.50:80
    http://geoplugin.net/json.gp
    http
    1c251b2a58b7c9c19bca9f5eb75fa7cd93a73fe07e34c1759a2381dda79ffda4.exe
    623 B
    1.3kB
    12
    3

    HTTP Request

    GET http://geoplugin.net/json.gp

    HTTP Response

    200
  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    67.31.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    67.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    dpm-sael.com
    dns
    1c251b2a58b7c9c19bca9f5eb75fa7cd93a73fe07e34c1759a2381dda79ffda4.exe
    58 B
    74 B
    1
    1

    DNS Request

    dpm-sael.com

    DNS Response

    64.176.178.205

  • 8.8.8.8:53
    geoplugin.net
    dns
    1c251b2a58b7c9c19bca9f5eb75fa7cd93a73fe07e34c1759a2381dda79ffda4.exe
    59 B
    75 B
    1
    1

    DNS Request

    geoplugin.net

    DNS Response

    178.237.33.50

  • 8.8.8.8:53
    205.178.176.64.in-addr.arpa
    dns
    73 B
    122 B
    1
    1

    DNS Request

    205.178.176.64.in-addr.arpa

  • 8.8.8.8:53
    50.33.237.178.in-addr.arpa
    dns
    72 B
    155 B
    1
    1

    DNS Request

    50.33.237.178.in-addr.arpa

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    26.165.165.52.in-addr.arpa
    dns
    72 B
    146 B
    1
    1

    DNS Request

    26.165.165.52.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    92.12.20.2.in-addr.arpa
    dns
    69 B
    131 B
    1
    1

    DNS Request

    92.12.20.2.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\remcos\logs.dat

    Filesize

    144B

    MD5

    b3aa640bb4eb3722235462f29811300b

    SHA1

    ac004cc609ee41872117616b35f6412f4aa02b0d

    SHA256

    91798c12da8ece5a400030a571827af6b7b8698b16c369fd01a76a69165c08e7

    SHA512

    e3eb0f416ec1bca8658920c6c05e3400fd75449ac6afb5dcd856e3457a8d1f3df2c4b42a08488b77c5bed16b1caa312cf5bb349091465eb56f10b90c208cfa95

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    3d086a433708053f9bf9523e1d87a4e8

    SHA1

    b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

    SHA256

    6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

    SHA512

    931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    d9a357293906b12e610490399acf5cd2

    SHA1

    6b850db5ad3d1615cfe2230b1857de2ee4feaf3d

    SHA256

    d7e94c8fe4a9c36b9b1559b0f0ab7aacc8451af4224b9d1751b1164c02a19050

    SHA512

    d9b547bca39a9d786e541cb59e5f093b2e5843e70f626fb02bec960302f11df33837d29ed7438227021ac46cd6f5baf94e9d4badc4f4b2dbc5894977728c40fa

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eauqxezl.g0p.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\tmpD63C.tmp

    Filesize

    1KB

    MD5

    6cf576dabe3d04d0aeda9958f09f4cf2

    SHA1

    9c5a62bd22cc5bb224a31cba9f3546310a4782b5

    SHA256

    2504b1722448e3bbbadd6e58bf362b49836052608e28ce5c95797e23ab65dd4a

    SHA512

    8224f7cc7beafac561a64ad9c4721bae41374415023a6365465be3ed66446e9aa4f186164e9c19ca2cc2635d43d5a4092888ffee1d1650ae4f8eb9dff64f2b38

  • memory/1844-91-0x00000000072F0000-0x000000000730A000-memory.dmp

    Filesize

    104KB

  • memory/1844-73-0x00000000757B0000-0x00000000757FC000-memory.dmp

    Filesize

    304KB

  • memory/1844-99-0x0000000074F20000-0x00000000756D0000-memory.dmp

    Filesize

    7.7MB

  • memory/1844-92-0x00000000072D0000-0x00000000072D8000-memory.dmp

    Filesize

    32KB

  • memory/1844-90-0x00000000071F0000-0x0000000007204000-memory.dmp

    Filesize

    80KB

  • memory/1844-89-0x00000000071E0000-0x00000000071EE000-memory.dmp

    Filesize

    56KB

  • memory/1844-15-0x0000000074F20000-0x00000000756D0000-memory.dmp

    Filesize

    7.7MB

  • memory/1844-16-0x0000000002390000-0x00000000023C6000-memory.dmp

    Filesize

    216KB

  • memory/1844-17-0x0000000074F20000-0x00000000756D0000-memory.dmp

    Filesize

    7.7MB

  • memory/1844-18-0x0000000005030000-0x0000000005658000-memory.dmp

    Filesize

    6.2MB

  • memory/1844-19-0x0000000004CE0000-0x0000000004D02000-memory.dmp

    Filesize

    136KB

  • memory/1844-88-0x00000000071B0000-0x00000000071C1000-memory.dmp

    Filesize

    68KB

  • memory/1844-21-0x0000000004DF0000-0x0000000004E56000-memory.dmp

    Filesize

    408KB

  • memory/1844-20-0x0000000004D80000-0x0000000004DE6000-memory.dmp

    Filesize

    408KB

  • memory/1844-28-0x0000000005660000-0x00000000059B4000-memory.dmp

    Filesize

    3.3MB

  • memory/1844-87-0x0000000007230000-0x00000000072C6000-memory.dmp

    Filesize

    600KB

  • memory/1844-85-0x0000000006FB0000-0x0000000006FCA000-memory.dmp

    Filesize

    104KB

  • memory/1844-84-0x0000000007600000-0x0000000007C7A000-memory.dmp

    Filesize

    6.5MB

  • memory/3236-32-0x0000000074F20000-0x00000000756D0000-memory.dmp

    Filesize

    7.7MB

  • memory/3236-62-0x00000000757B0000-0x00000000757FC000-memory.dmp

    Filesize

    304KB

  • memory/3236-98-0x0000000074F20000-0x00000000756D0000-memory.dmp

    Filesize

    7.7MB

  • memory/3236-86-0x00000000075B0000-0x00000000075BA000-memory.dmp

    Filesize

    40KB

  • memory/3236-39-0x0000000074F20000-0x00000000756D0000-memory.dmp

    Filesize

    7.7MB

  • memory/3236-83-0x00000000073E0000-0x0000000007483000-memory.dmp

    Filesize

    652KB

  • memory/3236-53-0x0000000006230000-0x000000000624E000-memory.dmp

    Filesize

    120KB

  • memory/3236-54-0x0000000006250000-0x000000000629C000-memory.dmp

    Filesize

    304KB

  • memory/3236-61-0x00000000071A0000-0x00000000071D2000-memory.dmp

    Filesize

    200KB

  • memory/3236-44-0x0000000074F20000-0x00000000756D0000-memory.dmp

    Filesize

    7.7MB

  • memory/3236-72-0x0000000007180000-0x000000000719E000-memory.dmp

    Filesize

    120KB

  • memory/3684-6-0x0000000005870000-0x0000000005882000-memory.dmp

    Filesize

    72KB

  • memory/3684-8-0x0000000074F20000-0x00000000756D0000-memory.dmp

    Filesize

    7.7MB

  • memory/3684-9-0x0000000009470000-0x0000000009530000-memory.dmp

    Filesize

    768KB

  • memory/3684-1-0x0000000000B90000-0x0000000000C76000-memory.dmp

    Filesize

    920KB

  • memory/3684-7-0x0000000074F2E000-0x0000000074F2F000-memory.dmp

    Filesize

    4KB

  • memory/3684-2-0x0000000005BA0000-0x0000000006144000-memory.dmp

    Filesize

    5.6MB

  • memory/3684-52-0x0000000074F20000-0x00000000756D0000-memory.dmp

    Filesize

    7.7MB

  • memory/3684-3-0x0000000005690000-0x0000000005722000-memory.dmp

    Filesize

    584KB

  • memory/3684-4-0x0000000074F20000-0x00000000756D0000-memory.dmp

    Filesize

    7.7MB

  • memory/3684-0-0x0000000074F2E000-0x0000000074F2F000-memory.dmp

    Filesize

    4KB

  • memory/3684-10-0x000000000BD20000-0x000000000BDBC000-memory.dmp

    Filesize

    624KB

  • memory/3684-5-0x0000000005670000-0x000000000567A000-memory.dmp

    Filesize

    40KB

  • memory/4684-102-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4684-135-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4684-45-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4684-60-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4684-48-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4684-55-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4684-47-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4684-57-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4684-51-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4684-56-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4684-111-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4684-127-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4684-110-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4684-118-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4684-119-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4684-126-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4684-58-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4684-134-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4684-103-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.