Analysis

  • max time kernel
    107s
  • max time network
    108s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2024, 01:53

General

  • Target

    81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe

  • Size

    2.1MB

  • MD5

    a09c63aeaef0ae03625de194dcd24580

  • SHA1

    eb35af7b226368b5aa94fd0cef7108b4a4f9cf4f

  • SHA256

    81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0e

  • SHA512

    e9a909fae732e802fd7e1b7f9a3f54ea703234093752ad09cc77368170555807e9fb7da669be8cd8ecc5bb6682053e76e396a4141e6d7b2fddc81334a84fc004

  • SSDEEP

    24576:hD39v74lfGQrFUspugRNJI2DJ53J/J/L5dJPj8/j7otSm/EVjlw3v:hp7E+QrFUBgq2pqw3v

Malware Config

Extracted

Family

remcos

Botnet

Host

C2

213.183.58.19:4000

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    remcos.exe

  • copy_folder

    remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    true

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    true

  • keylog_file

    read.dat

  • keylog_flag

    false

  • keylog_folder

    CastC

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    remcos_sccafsoidz

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screens

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe
    "C:\Users\Admin\AppData\Local\Temp\81f513aa3c6e025bede4da320fd6b62a439b0842f1a3a1d431c5eb8dae6dab0eN.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:468
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2128
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"
        3⤵
        • Executes dropped EXE
        PID:1308

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe

          Filesize

          2.1MB

          MD5

          d179fc499f2a69c56bef590bc7d4cbfd

          SHA1

          c8547d79da66e25ca291e71b8331764931f34083

          SHA256

          93fd6290a6b69d69a9074f596cf2ae553e741e4be51adcec7733f4ca46249c2d

          SHA512

          551ddf99f0e28a9f703a792bf83fa3a6b2c5c8840a75b5e4d85dec0bc8698569c1af5e84eb8d68131feb1bf0f801fb645f59222dbec14f1ae4b2fb03b8546d9d

        • memory/468-18-0x0000000074EF2000-0x0000000074EF3000-memory.dmp

          Filesize

          4KB

        • memory/468-30-0x0000000074EF0000-0x00000000754A1000-memory.dmp

          Filesize

          5.7MB

        • memory/468-5-0x0000000074EF0000-0x00000000754A1000-memory.dmp

          Filesize

          5.7MB

        • memory/468-6-0x0000000074EF0000-0x00000000754A1000-memory.dmp

          Filesize

          5.7MB

        • memory/468-19-0x0000000074EF0000-0x00000000754A1000-memory.dmp

          Filesize

          5.7MB

        • memory/468-0-0x0000000074EF2000-0x0000000074EF3000-memory.dmp

          Filesize

          4KB

        • memory/468-1-0x0000000074EF0000-0x00000000754A1000-memory.dmp

          Filesize

          5.7MB

        • memory/468-2-0x0000000074EF0000-0x00000000754A1000-memory.dmp

          Filesize

          5.7MB

        • memory/1308-37-0x0000000000540000-0x0000000000557000-memory.dmp

          Filesize

          92KB

        • memory/2128-31-0x0000000074EF0000-0x00000000754A1000-memory.dmp

          Filesize

          5.7MB

        • memory/2128-32-0x0000000074EF0000-0x00000000754A1000-memory.dmp

          Filesize

          5.7MB

        • memory/2128-34-0x0000000074EF0000-0x00000000754A1000-memory.dmp

          Filesize

          5.7MB

        • memory/2128-33-0x0000000074EF0000-0x00000000754A1000-memory.dmp

          Filesize

          5.7MB

        • memory/2128-41-0x0000000074EF0000-0x00000000754A1000-memory.dmp

          Filesize

          5.7MB