Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25-09-2024 17:47
General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.9317.exe
-
Size
896KB
-
MD5
64219e1931808919fd05dcfb458dfc25
-
SHA1
6adb1561418be08ccaa2e448166bc36673ec60c5
-
SHA256
ceebb7ca5adbb69127cbf5205e49840c4846cb46e4c5ac568557e7bdf9fe315c
-
SHA512
9ce694eaf780a4d255e328f527df78c949a5c54b5ab0ba46c9800fd326e9ab0c29eec331a1bc8a8592c159c99fcd69d165baf4ab0d09b2d5ca6540f0e5bd527c
-
SSDEEP
24576:12n4ze7gcvBx2mYa7sJw3+NHNQA6zqvkiINLYnTI:14gcvL2mT7sJw386pqvkiINc
Malware Config
Extracted
remcos
RemoteHost
127.0.0.1:52121
officerem.duckdns.org:52121
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-6GPUH1
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9317.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9317.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9317.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZRuVeAoBoxootS.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZRuVeAoBoxootS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA256.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9317.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9317.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9317.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.9317.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4148,i,3387628439405076340,17957358341235678872,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD57d5d5f8f7dd7b1f0a20adf9d81403d71
SHA130c2923c94bfbd48d013ed8c05564e8cfa2ac4a1
SHA25686dce2031ed01014c5f06de3e82a4284ea86f3663f357dd4f7bac0800a7ffbe7
SHA5124d5b29af6a6c5e97946d1fb60e06e5cd85ebc5864ff644301b29e8fc854efa52ab88562f30d200dad489e8003456dbbd5c2d761a1e084d9c74f81dc3bce86b61
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD553a4f35ec6cd203c7edacaa621abf198
SHA12c970f5974a77d7f3c32c1915e24926e0f81d272
SHA25679ba915aa9e46f1b7ed798beaf18622b06bbaac8d3549ad24d048000082cca62
SHA5128297e3f6c786fcf671fb7f50e0e7f34504c9c41265364f372384d784170f886d9a8df020c5c91c8cf39b9af835c2c09b9a380db8af0d5379ece4a00b7dd4e5dc
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
72KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
760KB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
4KB
-
Filesize
5.6MB
-
Filesize
920KB
-
Filesize
408KB
-
Filesize
32KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
104KB
-
Filesize
80KB
-
Filesize
56KB
-
Filesize
7.7MB
-
Filesize
68KB
-
Filesize
7.7MB
-
Filesize
600KB
-
Filesize
40KB
-
Filesize
6.5MB
-
Filesize
104KB
-
Filesize
652KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
216KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
200KB
-
Filesize
6.2MB
-
Filesize
136KB
-
Filesize
120KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
7.7MB