Analysis

  • max time kernel
    179s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 14:46

General

  • Target

    REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe

  • Size

    4.2MB

  • MD5

    92d332649b2988f19343cc654634813a

  • SHA1

    35633a70e00bb9ddad433276c0d4c85ecd6e3974

  • SHA256

    1cb11f58b364c6049d87ce1064472d9e0f6c47455e0b42454cfc9d48c24493dd

  • SHA512

    9e59623193253b212af34fa84b69f237d8de84221706ebcab0a6af195c2ec2b7bc4ee4a2f287fdb67e1d51bbbe7ce813cdb1f36d93216ca875b1b5c2081c4e51

  • SSDEEP

    49152:LR28UtN5sFpdJE2dNzk6YUiKYCuOpHoG4HLL0ibq59dXuzLvo4wA83W7JSfaTIF6:3o0A2fDl2hOpHoxrYibq9I

Malware Config

Extracted

Family

remcos

Botnet

DNS

C2

LUNAPETRO.chickenkiller.com:1991

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-QPU8J1

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe
    "C:\Users\Admin\AppData\Local\Temp\REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4384
    • C:\Users\Admin\AppData\Local\Temp\REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe
      "C:\Users\Admin\AppData\Local\Temp\REFERENCIA DE PAGO PROGRAMADO 000000000000000000000009637 APROBADO.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:836

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\remcos\logs.dat

    Filesize

    144B

    MD5

    17318de5ccd4fbca70d421cc3d4e5585

    SHA1

    4d89dd2ce8d05930f649dc69f5ef1153e45a4375

    SHA256

    ce3ef7353cc1c9541e026ab8b13f589199b5f0cb9b1841e30ba0460782574cc5

    SHA512

    0ffd6c758501f90c4c17646833c484cfc4634138a5602b45a8c469eeb2870df8c972feca2d1c9c0698be3245f3cfacba2d2ce3c958321cecca8dbd23200d0d44

  • memory/836-38-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-17-0x0000000000400000-0x000000000083F000-memory.dmp

    Filesize

    4.2MB

  • memory/836-83-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-82-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-80-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-15-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-12-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-11-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-10-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-7-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-79-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-78-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-16-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-41-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-18-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-76-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-20-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-22-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-23-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-24-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-25-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-27-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-28-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-29-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-31-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-32-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-33-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-35-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-36-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-37-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-42-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-75-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-46-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-74-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-72-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-44-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-45-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-40-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-48-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-49-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-50-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-51-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-53-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-54-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-55-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-57-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-58-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-59-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-61-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-62-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-63-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-65-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-66-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-67-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-69-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-70-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/836-71-0x0000000000840000-0x00000000008BF000-memory.dmp

    Filesize

    508KB

  • memory/4384-1-0x000000000046D000-0x0000000000485000-memory.dmp

    Filesize

    96KB

  • memory/4384-3-0x0000000000400000-0x000000000083F000-memory.dmp

    Filesize

    4.2MB

  • memory/4384-0-0x0000000000400000-0x000000000083F000-memory.dmp

    Filesize

    4.2MB

  • memory/4384-19-0x000000000046D000-0x0000000000485000-memory.dmp

    Filesize

    96KB

  • memory/4384-2-0x0000000000400000-0x000000000083F000-memory.dmp

    Filesize

    4.2MB

  • memory/4384-5-0x0000000000400000-0x000000000083F000-memory.dmp

    Filesize

    4.2MB

  • memory/4384-8-0x0000000000400000-0x000000000083F000-memory.dmp

    Filesize

    4.2MB

  • memory/4384-9-0x0000000000400000-0x000000000083F000-memory.dmp

    Filesize

    4.2MB

  • memory/4384-6-0x0000000000400000-0x000000000083F000-memory.dmp

    Filesize

    4.2MB