Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-09-2024 01:33

General

  • Target

    929167f47e1116759145eb457f86474a311374373b05b11438ea1222a9e2a8f0.exe

  • Size

    915KB

  • MD5

    0b18de9b2b7f17fc93796eabee8d26dd

  • SHA1

    0c0f08a2df8262960e6290900bff0684847cc0c8

  • SHA256

    929167f47e1116759145eb457f86474a311374373b05b11438ea1222a9e2a8f0

  • SHA512

    07a146051648b7bf1a7024bf1375b27b3ee6ea07c9c455ede24d3edce26d79e2f227a9b1a9ba0eb4f5e05c75e458169e48c3a8a1acaf731781a0f105ace37860

  • SSDEEP

    12288:OdK2wPfKaoFsNyjcFg/Q5P4Uf1fTX5muSPflsEXywds31GHvMb7d+fLnnjnU+DL:FPfKaKsNEesQ5PxL5mjHiwOFEvMOPn3

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

www.projectusf.com:2404

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    gfh

  • mouse_option

    false

  • mutex

    Rmc-J91LMC

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\929167f47e1116759145eb457f86474a311374373b05b11438ea1222a9e2a8f0.exe
    "C:\Users\Admin\AppData\Local\Temp\929167f47e1116759145eb457f86474a311374373b05b11438ea1222a9e2a8f0.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OlhQyptevOgDP.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2336
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OlhQyptevOgDP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDEC7.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:4172
    • C:\Users\Admin\AppData\Local\Temp\929167f47e1116759145eb457f86474a311374373b05b11438ea1222a9e2a8f0.exe
      "C:\Users\Admin\AppData\Local\Temp\929167f47e1116759145eb457f86474a311374373b05b11438ea1222a9e2a8f0.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4416

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\gfh\logs.dat

    Filesize

    144B

    MD5

    5606e0a0e0f7ccb0fa126e96dba6112d

    SHA1

    a60282bc89b49c3d2e3053065c816e0cd6bd1efe

    SHA256

    aabf3c6c95d36ef4122d354b3cacf9b3ac4f573a2d916cd0ba7afe78e15ca26d

    SHA512

    179dc5a825f43c262826f33e341272e21a5d30f577a1e1e630d706aa0ab8e9284aa50a689f24a311b58f11185b63c8bf1121369ac1eb248a6c930525e4dca316

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hpair3wd.w2y.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\tmpDEC7.tmp

    Filesize

    1KB

    MD5

    9b26c6a11ed40beb6e4b82c27658b86a

    SHA1

    b5f886fdf3ca8e2cb32ea5c001bf8e19b1303a92

    SHA256

    844c68de365951a562e69e4c80bc9b810335b9f50aa1ed7100c73723fda415ec

    SHA512

    4ebfc7aba08e453b1fc41f6c106fe1b0a1fcd03f3df31904b53308f6a8d1448c06b533bedce384f8d405cee7d34c8fecc5025bdc3cdc5439f66c6225a88e957f

  • memory/1268-6-0x0000000005960000-0x0000000005972000-memory.dmp

    Filesize

    72KB

  • memory/1268-4-0x0000000074FF0000-0x00000000757A0000-memory.dmp

    Filesize

    7.7MB

  • memory/1268-5-0x0000000005590000-0x000000000559A000-memory.dmp

    Filesize

    40KB

  • memory/1268-3-0x0000000005610000-0x00000000056A2000-memory.dmp

    Filesize

    584KB

  • memory/1268-7-0x0000000074FFE000-0x0000000074FFF000-memory.dmp

    Filesize

    4KB

  • memory/1268-8-0x0000000074FF0000-0x00000000757A0000-memory.dmp

    Filesize

    7.7MB

  • memory/1268-9-0x0000000007340000-0x0000000007400000-memory.dmp

    Filesize

    768KB

  • memory/1268-10-0x0000000009A80000-0x0000000009B1C000-memory.dmp

    Filesize

    624KB

  • memory/1268-2-0x0000000005BC0000-0x0000000006164000-memory.dmp

    Filesize

    5.6MB

  • memory/1268-45-0x0000000074FF0000-0x00000000757A0000-memory.dmp

    Filesize

    7.7MB

  • memory/1268-0-0x0000000074FFE000-0x0000000074FFF000-memory.dmp

    Filesize

    4KB

  • memory/1268-1-0x0000000000AC0000-0x0000000000BAC000-memory.dmp

    Filesize

    944KB

  • memory/2336-44-0x0000000006570000-0x000000000658E000-memory.dmp

    Filesize

    120KB

  • memory/2336-62-0x0000000007540000-0x00000000075E3000-memory.dmp

    Filesize

    652KB

  • memory/2336-15-0x0000000002C40000-0x0000000002C76000-memory.dmp

    Filesize

    216KB

  • memory/2336-20-0x0000000074FF0000-0x00000000757A0000-memory.dmp

    Filesize

    7.7MB

  • memory/2336-74-0x0000000074FF0000-0x00000000757A0000-memory.dmp

    Filesize

    7.7MB

  • memory/2336-31-0x00000000057A0000-0x0000000005806000-memory.dmp

    Filesize

    408KB

  • memory/2336-71-0x0000000007BB0000-0x0000000007BB8000-memory.dmp

    Filesize

    32KB

  • memory/2336-70-0x0000000007BD0000-0x0000000007BEA000-memory.dmp

    Filesize

    104KB

  • memory/2336-19-0x0000000074FF0000-0x00000000757A0000-memory.dmp

    Filesize

    7.7MB

  • memory/2336-30-0x0000000005730000-0x0000000005796000-memory.dmp

    Filesize

    408KB

  • memory/2336-43-0x0000000005F70000-0x00000000062C4000-memory.dmp

    Filesize

    3.3MB

  • memory/2336-69-0x0000000007AD0000-0x0000000007AE4000-memory.dmp

    Filesize

    80KB

  • memory/2336-25-0x0000000005590000-0x00000000055B2000-memory.dmp

    Filesize

    136KB

  • memory/2336-68-0x0000000007AC0000-0x0000000007ACE000-memory.dmp

    Filesize

    56KB

  • memory/2336-18-0x0000000005940000-0x0000000005F68000-memory.dmp

    Filesize

    6.2MB

  • memory/2336-16-0x0000000074FF0000-0x00000000757A0000-memory.dmp

    Filesize

    7.7MB

  • memory/2336-46-0x0000000006630000-0x000000000667C000-memory.dmp

    Filesize

    304KB

  • memory/2336-67-0x0000000007A90000-0x0000000007AA1000-memory.dmp

    Filesize

    68KB

  • memory/2336-66-0x0000000007B10000-0x0000000007BA6000-memory.dmp

    Filesize

    600KB

  • memory/2336-65-0x0000000007900000-0x000000000790A000-memory.dmp

    Filesize

    40KB

  • memory/2336-50-0x0000000006B40000-0x0000000006B72000-memory.dmp

    Filesize

    200KB

  • memory/2336-61-0x0000000006B20000-0x0000000006B3E000-memory.dmp

    Filesize

    120KB

  • memory/2336-51-0x000000006F920000-0x000000006F96C000-memory.dmp

    Filesize

    304KB

  • memory/2336-63-0x0000000007ED0000-0x000000000854A000-memory.dmp

    Filesize

    6.5MB

  • memory/2336-64-0x0000000007890000-0x00000000078AA000-memory.dmp

    Filesize

    104KB

  • memory/4416-78-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4416-47-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4416-77-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4416-48-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4416-23-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4416-29-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4416-33-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4416-32-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4416-80-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4416-76-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4416-110-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4416-49-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4416-26-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4416-21-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4416-86-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4416-87-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4416-94-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4416-95-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4416-102-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4416-103-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4416-111-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/4416-22-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB