Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    23/10/2024, 12:55

General

  • Target

    New Purchase Order-030220- SMART SOURCING INC.exe

  • Size

    678KB

  • MD5

    3207acb14184189a3800a8e20a82b023

  • SHA1

    65d2ad175339e0dc644b301c85e7f02f098bbb63

  • SHA256

    1f3358783cef07f7a60b0530c0de90be8a1131715faaf9d841ce830d9116434b

  • SHA512

    71ccfda46c9c98944153398afebe09708d9c071da3e821f238b865fb77551734e94fbf6e39445c45da926efac9a7b6f9fcc6fe0d93ba8a2274d0fdc25c569bd0

  • SSDEEP

    12288:qMu7vJgCfeUA94QAyS3ewHXsnn38zVzMfpNemioprHlJ:q5mZ2emcnn38pzE4In

Malware Config

Extracted

Family

remcos

Botnet

SOLOMON

C2

grantadistciaret.com:3212

grantadistciaret.com:3223

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • install_path

    %Temp%

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    RmcxeJ-GSQVVR

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Purchase Order-030220- SMART SOURCING INC.exe
    "C:\Users\Admin\AppData\Local\Temp\New Purchase Order-030220- SMART SOURCING INC.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2472

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\remcos\logs.dat

    Filesize

    144B

    MD5

    f61943a7a316492e9e27ef1aa4cd96ba

    SHA1

    c91418ef0b9410485ebccaccb28d5f706f92c9ce

    SHA256

    60cc45ed046f1bd99c133d303fdf0c6b42c1f33e0b9d75f95dc41cb4ad3174f8

    SHA512

    be4a50d818c39dc622481b74918c363bc1f43f8c725aa1dbfa8f58bb0d0ea0dee8f8d103fb23b4b43a34dcf5e2c541d4e721fdbc52f958b85dd5d1a80e590747

  • memory/2440-0-0x000007FEF5C83000-0x000007FEF5C84000-memory.dmp

    Filesize

    4KB

  • memory/2440-1-0x000000013F0C0000-0x000000013F16E000-memory.dmp

    Filesize

    696KB

  • memory/2440-2-0x00000000008A0000-0x0000000000926000-memory.dmp

    Filesize

    536KB

  • memory/2440-3-0x0000000000930000-0x0000000000936000-memory.dmp

    Filesize

    24KB

  • memory/2440-4-0x0000000000940000-0x000000000094A000-memory.dmp

    Filesize

    40KB

  • memory/2440-5-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

    Filesize

    9.9MB

  • memory/2440-18-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

    Filesize

    9.9MB

  • memory/2472-12-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2472-19-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2472-15-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2472-11-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2472-10-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2472-9-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2472-17-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2472-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2472-13-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2472-8-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2472-7-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2472-20-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2472-23-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2472-25-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB

  • memory/2472-6-0x0000000000400000-0x0000000000482000-memory.dmp

    Filesize

    520KB