Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-09-2024 06:27

General

  • Target

    UsoOuMVYCv8QrxG.exe

  • Size

    908KB

  • MD5

    fce19affe7db15edd2b851ea84cd37ad

  • SHA1

    143e9f5102833d028aca51437854e4a56f1dde11

  • SHA256

    26ed62c404f08cb73c5f52cf8df52546a0c69bef2c50a577afa65a515da0cb22

  • SHA512

    6046d7e2848132ee293a5b507dd76f84d506d4ed2e3673fb9a8bb5fa2d5645c6920de81f1c84f5fa3ee0b493b2c1941be7f37d650de27cec2b3b9113d820ab7d

  • SSDEEP

    24576:pIK++j3zMXN4nH3o4Tps96bSKVZgbI0Nrs4kWAh:7jDkN4nH3/pw6bSKVebI0wT

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

192.3.64.152:2559

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-TS121V

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\UsoOuMVYCv8QrxG.exe
    "C:\Users\Admin\AppData\Local\Temp\UsoOuMVYCv8QrxG.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4280
    • C:\Users\Admin\AppData\Local\Temp\UsoOuMVYCv8QrxG.exe
      "C:\Users\Admin\AppData\Local\Temp\UsoOuMVYCv8QrxG.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4400

Network

  • flag-us
    DNS
    228.249.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    228.249.119.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    136.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    136.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    152.64.3.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    152.64.3.192.in-addr.arpa
    IN PTR
    Response
    152.64.3.192.in-addr.arpa
    IN PTR
    192-3-64-152-host colocrossingcom
  • flag-us
    DNS
    geoplugin.net
    UsoOuMVYCv8QrxG.exe
    Remote address:
    8.8.8.8:53
    Request
    geoplugin.net
    IN A
    Response
    geoplugin.net
    IN A
    178.237.33.50
  • flag-nl
    GET
    http://geoplugin.net/json.gp
    UsoOuMVYCv8QrxG.exe
    Remote address:
    178.237.33.50:80
    Request
    GET /json.gp HTTP/1.1
    Host: geoplugin.net
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    date: Wed, 25 Sep 2024 06:27:23 GMT
    server: Apache
    content-length: 955
    content-type: application/json; charset=utf-8
    cache-control: public, max-age=300
    access-control-allow-origin: *
  • flag-us
    DNS
    50.33.237.178.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.33.237.178.in-addr.arpa
    IN PTR
    Response
    50.33.237.178.in-addr.arpa
    IN CNAME
    50.32/27.178.237.178.in-addr.arpa
  • flag-us
    DNS
    183.59.114.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    183.59.114.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    24.58.20.217.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    24.58.20.217.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    11.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    11.227.111.52.in-addr.arpa
    IN PTR
    Response
  • 192.3.64.152:2559
    tls
    UsoOuMVYCv8QrxG.exe
    3.3kB
    1.5kB
    13
    16
  • 178.237.33.50:80
    http://geoplugin.net/json.gp
    http
    UsoOuMVYCv8QrxG.exe
    623 B
    1.3kB
    12
    3

    HTTP Request

    GET http://geoplugin.net/json.gp

    HTTP Response

    200
  • 8.8.8.8:53
    228.249.119.40.in-addr.arpa
    dns
    73 B
    159 B
    1
    1

    DNS Request

    228.249.119.40.in-addr.arpa

  • 8.8.8.8:53
    136.32.126.40.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    136.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    152.64.3.192.in-addr.arpa
    dns
    71 B
    119 B
    1
    1

    DNS Request

    152.64.3.192.in-addr.arpa

  • 8.8.8.8:53
    geoplugin.net
    dns
    UsoOuMVYCv8QrxG.exe
    59 B
    75 B
    1
    1

    DNS Request

    geoplugin.net

    DNS Response

    178.237.33.50

  • 8.8.8.8:53
    50.33.237.178.in-addr.arpa
    dns
    72 B
    155 B
    1
    1

    DNS Request

    50.33.237.178.in-addr.arpa

  • 8.8.8.8:53
    183.59.114.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    183.59.114.20.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
    145 B
    1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    24.58.20.217.in-addr.arpa
    dns
    71 B
    131 B
    1
    1

    DNS Request

    24.58.20.217.in-addr.arpa

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    11.227.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    11.227.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4280-0-0x00000000753BE000-0x00000000753BF000-memory.dmp

    Filesize

    4KB

  • memory/4280-1-0x0000000000D40000-0x0000000000E2A000-memory.dmp

    Filesize

    936KB

  • memory/4280-2-0x0000000005DD0000-0x0000000006374000-memory.dmp

    Filesize

    5.6MB

  • memory/4280-3-0x0000000005820000-0x00000000058B2000-memory.dmp

    Filesize

    584KB

  • memory/4280-4-0x00000000753B0000-0x0000000075B60000-memory.dmp

    Filesize

    7.7MB

  • memory/4280-5-0x00000000058D0000-0x00000000058DA000-memory.dmp

    Filesize

    40KB

  • memory/4280-6-0x0000000005BF0000-0x0000000005C02000-memory.dmp

    Filesize

    72KB

  • memory/4280-7-0x00000000753BE000-0x00000000753BF000-memory.dmp

    Filesize

    4KB

  • memory/4280-8-0x00000000753B0000-0x0000000075B60000-memory.dmp

    Filesize

    7.7MB

  • memory/4280-9-0x0000000007AB0000-0x0000000007B70000-memory.dmp

    Filesize

    768KB

  • memory/4280-10-0x000000000A1E0000-0x000000000A27C000-memory.dmp

    Filesize

    624KB

  • memory/4280-18-0x00000000753B0000-0x0000000075B60000-memory.dmp

    Filesize

    7.7MB

  • memory/4400-16-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4400-24-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4400-12-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4400-15-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4400-17-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4400-11-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4400-19-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4400-20-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4400-21-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4400-14-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4400-25-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4400-26-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4400-27-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4400-28-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4400-29-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4400-30-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4400-31-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4400-32-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.