Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    05/10/2024, 19:39 UTC

General

  • Target

    Confirmation Order.exe

  • Size

    892KB

  • MD5

    3b13b07b05ea3f2084ee3c38080fffe3

  • SHA1

    dde112544004281ad7d02b36c607bc4a258f22a6

  • SHA256

    b93408af1dfa127e3b11d16cd92dab65f448d77fa933259c139bb0f0e6d33a75

  • SHA512

    c09987d78d52fc94bc991b40380b6f5752f1b15139850d24ed93e9ea8ce74add4b4b477493fb8c0a6980de9e14fb511123e2571622c3c5a46f4402f09d037fe0

  • SSDEEP

    12288:5Eqv8RratEshTEMAiqoWpVvfS4D36FUOJT02id9IV/SxjTWAY+acgp8bQbQk:J8OZTEMAifWTvfuL42id94cgGIQ

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

127.0.0.1:59321

nnamoo.duckdns.org:59321

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-41EVS0

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Confirmation Order.exe
    "C:\Users\Admin\AppData\Local\Temp\Confirmation Order.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Confirmation Order.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1104
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bDXSeyoVzkpA.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2968
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bDXSeyoVzkpA" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD144.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2552
    • C:\Users\Admin\AppData\Local\Temp\Confirmation Order.exe
      "C:\Users\Admin\AppData\Local\Temp\Confirmation Order.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2612
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:908

    Network

    • flag-us
      DNS
      nnamoo.duckdns.org
      Confirmation Order.exe
      Remote address:
      8.8.8.8:53
      Request
      nnamoo.duckdns.org
      IN A
      Response
      nnamoo.duckdns.org
      IN A
      103.186.117.126
    • flag-us
      DNS
      nnamoo.duckdns.org
      Confirmation Order.exe
      Remote address:
      8.8.8.8:53
      Request
      nnamoo.duckdns.org
      IN A
      Response
      nnamoo.duckdns.org
      IN A
      103.186.117.126
    • flag-us
      DNS
      nnamoo.duckdns.org
      Confirmation Order.exe
      Remote address:
      8.8.8.8:53
      Request
      nnamoo.duckdns.org
      IN A
      Response
      nnamoo.duckdns.org
      IN A
      103.186.117.126
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      152 B
      120 B
      3
      3
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      152 B
      120 B
      3
      3
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      152 B
      120 B
      3
      3
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      152 B
      120 B
      3
      3
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      152 B
      120 B
      3
      3
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      152 B
      120 B
      3
      3
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      152 B
      120 B
      3
      3
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      152 B
      120 B
      3
      3
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      152 B
      120 B
      3
      3
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      152 B
      120 B
      3
      3
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      152 B
      80 B
      3
      2
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      152 B
      120 B
      3
      3
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      152 B
      120 B
      3
      3
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      152 B
      120 B
      3
      3
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      152 B
      120 B
      3
      3
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      152 B
      120 B
      3
      3
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      152 B
      120 B
      3
      3
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      152 B
      120 B
      3
      3
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      152 B
      120 B
      3
      3
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      152 B
      120 B
      3
      3
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      152 B
      80 B
      3
      2
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      152 B
      120 B
      3
      3
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      152 B
      120 B
      3
      3
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      152 B
      120 B
      3
      3
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      152 B
      120 B
      3
      3
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      152 B
      40 B
      3
      1
    • 127.0.0.1:59321
      Confirmation Order.exe
    • 103.186.117.126:59321
      nnamoo.duckdns.org
      Confirmation Order.exe
      104 B
      2
    • 8.8.8.8:53
      nnamoo.duckdns.org
      dns
      Confirmation Order.exe
      64 B
      80 B
      1
      1

      DNS Request

      nnamoo.duckdns.org

      DNS Response

      103.186.117.126

    • 8.8.8.8:53
      nnamoo.duckdns.org
      dns
      Confirmation Order.exe
      64 B
      80 B
      1
      1

      DNS Request

      nnamoo.duckdns.org

      DNS Response

      103.186.117.126

    • 8.8.8.8:53
      nnamoo.duckdns.org
      dns
      Confirmation Order.exe
      64 B
      80 B
      1
      1

      DNS Request

      nnamoo.duckdns.org

      DNS Response

      103.186.117.126

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpD144.tmp

      Filesize

      1KB

      MD5

      e42588a1880ed05c4e523618d1e075d3

      SHA1

      9690d29796255b5f970542195b82c0d053ecf904

      SHA256

      7aad57a698c934ffd0d95e1b4f7cbb43a26292af506dd247c70630aad9acaad8

      SHA512

      4cae60e10628ba522079bfa827915baed11f426fcfa529bde83c70dd5bfbc6a3a34d54e5089a0842826b270b732c4b6b6c54e355dbc2726770b5f52791afaefd

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

      Filesize

      7KB

      MD5

      e2e21df7abb06ac4e33ed18185c319c1

      SHA1

      329656f524618018067a9b03630468543d7fb626

      SHA256

      fc7b6d03a0783ba0b8dd7972cb932833d07207f4c68ae9504713b70187fe0e88

      SHA512

      6ec205a2b03a62a4a42aaec39b76a14aaf61a09519296bb41cdd5ba2800d642bb892cfdba9293b7828d97769ea4259c9e978a551059b33be0576e337a7f8f018

    • memory/1048-0-0x000000007495E000-0x000000007495F000-memory.dmp

      Filesize

      4KB

    • memory/1048-1-0x0000000000260000-0x0000000000346000-memory.dmp

      Filesize

      920KB

    • memory/1048-2-0x0000000074950000-0x000000007503E000-memory.dmp

      Filesize

      6.9MB

    • memory/1048-3-0x0000000000430000-0x0000000000442000-memory.dmp

      Filesize

      72KB

    • memory/1048-4-0x000000007495E000-0x000000007495F000-memory.dmp

      Filesize

      4KB

    • memory/1048-5-0x0000000074950000-0x000000007503E000-memory.dmp

      Filesize

      6.9MB

    • memory/1048-6-0x0000000005820000-0x00000000058DE000-memory.dmp

      Filesize

      760KB

    • memory/1048-40-0x0000000074950000-0x000000007503E000-memory.dmp

      Filesize

      6.9MB

    • memory/2612-20-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2612-33-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-38-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-39-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-37-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-31-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-29-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-36-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-25-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-23-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-21-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-27-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-41-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-42-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-43-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-44-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-45-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-46-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-47-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-48-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-50-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-51-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-52-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-54-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-55-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-56-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-58-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-59-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-60-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-62-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-63-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-64-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-66-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-67-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-68-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-70-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-71-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-72-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-74-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-75-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-76-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-78-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-79-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-80-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-82-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2612-83-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.