Analysis

  • max time kernel
    177s
  • max time network
    174s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02-10-2024 14:26

General

  • Target

    9e5634a01e241113ddc1a5a03265cd3e.exe

  • Size

    2.4MB

  • MD5

    9e5634a01e241113ddc1a5a03265cd3e

  • SHA1

    17f3cba192f573754797b1fb6f644889f9abaaca

  • SHA256

    a8c0001bf62a178870fe526395703f682143078ad37d9b20e50f230dd9059648

  • SHA512

    3cea7ff14f48832b7ca955a5fa2c61115b1f2a5ec9f8df52e32692b07d9d34453fef29ef1d7c62ec666e0f38a4899a89db4a68f615602d267c0103d42fe52156

  • SSDEEP

    49152:7lnKF46FKC9PgROSeQ146cDPM2vCVapdoqwicf1/y36sbwAE1JgZIESTcNYPMI3Y:7ld16SwwgZRbaEIo

Malware Config

Extracted

Family

remcos

Botnet

XIOAMORT

C2

vcvfdjvodsuhvf.con-ip.com:1661

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-ALVZO2

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9e5634a01e241113ddc1a5a03265cd3e.exe
    "C:\Users\Admin\AppData\Local\Temp\9e5634a01e241113ddc1a5a03265cd3e.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1928
    • C:\Users\Admin\AppData\Local\Temp\9e5634a01e241113ddc1a5a03265cd3e.exe
      "C:\Users\Admin\AppData\Local\Temp\9e5634a01e241113ddc1a5a03265cd3e.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2504

Network

  • flag-us
    DNS
    vcvfdjvodsuhvf.con-ip.com
    9e5634a01e241113ddc1a5a03265cd3e.exe
    Remote address:
    8.8.8.8:53
    Request
    vcvfdjvodsuhvf.con-ip.com
    IN A
    Response
    vcvfdjvodsuhvf.con-ip.com
    IN A
    181.131.216.100
  • flag-us
    DNS
    geoplugin.net
    9e5634a01e241113ddc1a5a03265cd3e.exe
    Remote address:
    8.8.8.8:53
    Request
    geoplugin.net
    IN A
    Response
    geoplugin.net
    IN A
    178.237.33.50
  • flag-nl
    GET
    http://geoplugin.net/json.gp
    9e5634a01e241113ddc1a5a03265cd3e.exe
    Remote address:
    178.237.33.50:80
    Request
    GET /json.gp HTTP/1.1
    Host: geoplugin.net
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    date: Wed, 02 Oct 2024 14:26:43 GMT
    server: Apache
    content-length: 955
    content-type: application/json; charset=utf-8
    cache-control: public, max-age=300
    access-control-allow-origin: *
  • 181.131.216.100:1661
    vcvfdjvodsuhvf.con-ip.com
    tls
    9e5634a01e241113ddc1a5a03265cd3e.exe
    4.3kB
    1.7kB
    19
    18
  • 178.237.33.50:80
    http://geoplugin.net/json.gp
    http
    9e5634a01e241113ddc1a5a03265cd3e.exe
    669 B
    2.5kB
    13
    4

    HTTP Request

    GET http://geoplugin.net/json.gp

    HTTP Response

    200
  • 8.8.8.8:53
    vcvfdjvodsuhvf.con-ip.com
    dns
    9e5634a01e241113ddc1a5a03265cd3e.exe
    71 B
    87 B
    1
    1

    DNS Request

    vcvfdjvodsuhvf.con-ip.com

    DNS Response

    181.131.216.100

  • 8.8.8.8:53
    geoplugin.net
    dns
    9e5634a01e241113ddc1a5a03265cd3e.exe
    59 B
    75 B
    1
    1

    DNS Request

    geoplugin.net

    DNS Response

    178.237.33.50

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\remcos\logs.dat

    Filesize

    144B

    MD5

    6569f87fcc23aa286ae822c17cf45fd8

    SHA1

    792f9ffba6ddd0b08eaf71f04fd7cff1728d2f15

    SHA256

    93bd9834e051de52fd77c898c25383449d099849a31a4a27fb9a4f3deb1d5a92

    SHA512

    28329fdd47e9384794704c21313ccbee31e7bb04b41b373c17ad14dfbbe5b4893cadbb7c9cf0990b04c0dc7ce5fcfb9da28fafa6019aa6931a188fd12f02f043

  • memory/1928-0-0x0000000000400000-0x000000000085A000-memory.dmp

    Filesize

    4.4MB

  • memory/1928-1-0x0000000000400000-0x000000000085A000-memory.dmp

    Filesize

    4.4MB

  • memory/1928-3-0x0000000000400000-0x000000000085A000-memory.dmp

    Filesize

    4.4MB

  • memory/1928-2-0x00000000007D3000-0x00000000007E2000-memory.dmp

    Filesize

    60KB

  • memory/1928-6-0x0000000000400000-0x000000000085A000-memory.dmp

    Filesize

    4.4MB

  • memory/1928-7-0x0000000000400000-0x000000000085A000-memory.dmp

    Filesize

    4.4MB

  • memory/1928-8-0x0000000000400000-0x000000000085A000-memory.dmp

    Filesize

    4.4MB

  • memory/1928-14-0x0000000000400000-0x000000000085A000-memory.dmp

    Filesize

    4.4MB

  • memory/1928-16-0x0000000000400000-0x000000000085A000-memory.dmp

    Filesize

    4.4MB

  • memory/1928-28-0x00000000007D3000-0x00000000007E2000-memory.dmp

    Filesize

    60KB

  • memory/2504-24-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/2504-34-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/2504-9-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/2504-21-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/2504-23-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/2504-13-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/2504-25-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/2504-26-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/2504-27-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/2504-18-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/2504-33-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/2504-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2504-19-0x0000000000400000-0x000000000085A000-memory.dmp

    Filesize

    4.4MB

  • memory/2504-41-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/2504-42-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/2504-49-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/2504-50-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/2504-57-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/2504-58-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/2504-65-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/2504-66-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

  • memory/2504-73-0x00000000001C0000-0x0000000000242000-memory.dmp

    Filesize

    520KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.