Analysis

  • max time kernel
    180s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-11-2024 22:46

General

  • Target

    2082-1220- SEGUNDA INSTANCIA No. 7590-2024.exe

  • Size

    5.2MB

  • MD5

    8cb9e46a08c436f772738ad5708a8ec5

  • SHA1

    d7672934e1ec81f3f1d1e59a06556b641e97c69a

  • SHA256

    1f12c1cbc308e400ba5eca71443f8dc41162be0c0a59afd60a04cc6bb7705f5d

  • SHA512

    b001d3a78006b4d45e1041939ac0ea940db3de886e5fb68defe40e2466bd5b94b8da213ac48ead29054de5001ba7cc89bdd3dab85acf4367a14551e158d0e90a

  • SSDEEP

    98304:vLfK1AYizQPQo006Jr2qenjIsQZdZK/++cy5u7rwIGPZr:ri8QIo05gnjIsMu2bdrwIGPZr

Score
10/10

Malware Config

Extracted

Family

remcos

Botnet

ORO

C2

noviembre14.ydns.eu:2708

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-J4BNGW

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Drops startup file 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3464
      • C:\Users\Admin\AppData\Local\Temp\2082-1220- SEGUNDA INSTANCIA No. 7590-2024.exe
        "C:\Users\Admin\AppData\Local\Temp\2082-1220- SEGUNDA INSTANCIA No. 7590-2024.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops startup file
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2056
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2192

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\remcos\logs.dat

      Filesize

      144B

      MD5

      22cb72eaafa214bec41fe9d1190b749a

      SHA1

      a63955e7e29d1646b4b64fd55e21c1a598ad0ea9

      SHA256

      6d69ce8ed9b79ac373374e9890172463f646f914d0f0327ca6851a045af23ef6

      SHA512

      26bc46972a4bf7ef2e2c16defa30823d352c5423a808e4573a81f4b65fa205ea5d5989f1081a971aaabf61c9aa51d5d2e97fd630d5f6975629adf405027a5f4f

    • memory/2056-0-0x000000007531E000-0x000000007531F000-memory.dmp

      Filesize

      4KB

    • memory/2056-1-0x00000000008E0000-0x0000000000E1A000-memory.dmp

      Filesize

      5.2MB

    • memory/2056-2-0x0000000075310000-0x0000000075AC0000-memory.dmp

      Filesize

      7.7MB

    • memory/2056-3-0x0000000007060000-0x0000000007184000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-4-0x0000000007760000-0x0000000007D04000-memory.dmp

      Filesize

      5.6MB

    • memory/2056-5-0x00000000072B0000-0x0000000007342000-memory.dmp

      Filesize

      584KB

    • memory/2056-9-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-13-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-69-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-67-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-65-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-63-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-62-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-59-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-57-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-55-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-51-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-49-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-47-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-45-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-43-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-41-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-37-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-35-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-53-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-39-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-33-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-31-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-27-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-25-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-23-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-21-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-20-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-17-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-15-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-11-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-29-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-7-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-6-0x0000000007060000-0x000000000717F000-memory.dmp

      Filesize

      1.1MB

    • memory/2056-1080-0x000000007531E000-0x000000007531F000-memory.dmp

      Filesize

      4KB

    • memory/2056-1081-0x0000000075310000-0x0000000075AC0000-memory.dmp

      Filesize

      7.7MB

    • memory/2056-1082-0x0000000075310000-0x0000000075AC0000-memory.dmp

      Filesize

      7.7MB

    • memory/2056-1083-0x00000000073C0000-0x0000000007458000-memory.dmp

      Filesize

      608KB

    • memory/2056-1084-0x0000000007470000-0x00000000074BC000-memory.dmp

      Filesize

      304KB

    • memory/2056-1087-0x0000000075310000-0x0000000075AC0000-memory.dmp

      Filesize

      7.7MB

    • memory/2056-1088-0x0000000075310000-0x0000000075AC0000-memory.dmp

      Filesize

      7.7MB

    • memory/2056-1090-0x0000000075310000-0x0000000075AC0000-memory.dmp

      Filesize

      7.7MB

    • memory/2056-1091-0x00000000074C0000-0x0000000007514000-memory.dmp

      Filesize

      336KB

    • memory/2056-1097-0x0000000075310000-0x0000000075AC0000-memory.dmp

      Filesize

      7.7MB

    • memory/2192-1098-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB

    • memory/2192-1111-0x0000000000400000-0x000000000047F000-memory.dmp

      Filesize

      508KB