Analysis

  • max time kernel
    180s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    13-11-2024 14:46

General

  • Target

    REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe

  • Size

    4.2MB

  • MD5

    92d332649b2988f19343cc654634813a

  • SHA1

    35633a70e00bb9ddad433276c0d4c85ecd6e3974

  • SHA256

    1cb11f58b364c6049d87ce1064472d9e0f6c47455e0b42454cfc9d48c24493dd

  • SHA512

    9e59623193253b212af34fa84b69f237d8de84221706ebcab0a6af195c2ec2b7bc4ee4a2f287fdb67e1d51bbbe7ce813cdb1f36d93216ca875b1b5c2081c4e51

  • SSDEEP

    49152:LR28UtN5sFpdJE2dNzk6YUiKYCuOpHoG4HLL0ibq59dXuzLvo4wA83W7JSfaTIF6:3o0A2fDl2hOpHoxrYibq9I

Malware Config

Extracted

Family

remcos

Botnet

DNS

C2

LUNAPETRO.chickenkiller.com:1991

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-QPU8J1

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe
    "C:\Users\Admin\AppData\Local\Temp\REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1064
    • C:\Users\Admin\AppData\Local\Temp\REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe
      "C:\Users\Admin\AppData\Local\Temp\REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2816

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\remcos\logs.dat

    Filesize

    144B

    MD5

    40b1b29de336fe0a192630bc66251643

    SHA1

    ce03185295528d9bce50fb492ce9f7f7e0670cce

    SHA256

    3973a5322a39670db59724aa4975cbb678dc4cdcedb0a505b3ba0128b98303d0

    SHA512

    f5d43bcf4021a2dab0cccf1140a439cf62aedebc1084a882688b7c498ea41ca9e0a814595e298b1441b576a2e690584b5781930f0bcf29e04678bb24d1b0556b

  • memory/1064-1-0x000000000046D000-0x0000000000485000-memory.dmp

    Filesize

    96KB

  • memory/1064-0-0x0000000000400000-0x000000000083F000-memory.dmp

    Filesize

    4.2MB

  • memory/1064-5-0x0000000000400000-0x000000000083F000-memory.dmp

    Filesize

    4.2MB

  • memory/1064-6-0x0000000000400000-0x000000000083F000-memory.dmp

    Filesize

    4.2MB

  • memory/1064-4-0x0000000000400000-0x000000000083F000-memory.dmp

    Filesize

    4.2MB

  • memory/1064-14-0x0000000000400000-0x000000000083F000-memory.dmp

    Filesize

    4.2MB

  • memory/1064-13-0x0000000000400000-0x000000000083F000-memory.dmp

    Filesize

    4.2MB

  • memory/1064-3-0x0000000000400000-0x000000000083F000-memory.dmp

    Filesize

    4.2MB

  • memory/1064-7-0x0000000000400000-0x000000000083F000-memory.dmp

    Filesize

    4.2MB

  • memory/2816-12-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2816-8-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-16-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-21-0x0000000000400000-0x000000000083F000-memory.dmp

    Filesize

    4.2MB

  • memory/2816-20-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-17-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-22-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-23-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-24-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-25-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-26-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-28-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-29-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-30-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-31-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-32-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-34-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-35-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-36-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-37-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-38-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-40-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-41-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-42-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-43-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-44-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-46-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-47-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-48-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-49-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-50-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-52-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-53-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-54-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-55-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-57-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-58-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-59-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-60-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-61-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-63-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-64-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-65-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-66-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-67-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-69-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-70-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-71-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-72-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-73-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-75-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-76-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB

  • memory/2816-77-0x00000000001C0000-0x000000000023F000-memory.dmp

    Filesize

    508KB