Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17-11-2024 09:53

General

  • Target

    Slf.msi

  • Size

    3.0MB

  • MD5

    da2c2debc2177026f359f4f06db67ea2

  • SHA1

    c9b0cb497058b925ecb430d0e29d16fd0ca273a4

  • SHA256

    e483ca3bc78e49f0ceef3406ea963101fe1d2b08b4bace6945ac9298222b8c37

  • SHA512

    9885d2dbec4e3599862fc76c56773de56944adfa09322b7c401550dcfbaa49e95bdf27daf1515873fdc9a4c56ad6ab8195e6b9556afc8e3488401174a5203f5d

  • SSDEEP

    49152:Ch4L8r6F5mCmR+XuhqZL+H9IyKficUAG595WpZsNAaudSIu:Fo6NZLSIX6cZGZWUNAaud

Malware Config

Extracted

Family

remcos

Botnet

v2

C2

185.157.162.126:1995

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    qsdazeazd-EL00KX

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Detects HijackLoader (aka IDAT Loader) 1 IoCs
  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

  • Hijackloader family
  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 9 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Slf.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2460
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:588
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding F8B2C0D4A0C05E912E8E5487593C1BA7
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1940
    • C:\Users\Admin\AppData\Local\Temp\EHttpSrv.exe
      "C:\Users\Admin\AppData\Local\Temp\EHttpSrv.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2808
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe
        3⤵
        • Suspicious use of SetThreadContext
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2528
        • C:\Users\Admin\AppData\Local\Temp\EHttpSrv.exe
          C:\Users\Admin\AppData\Local\Temp\EHttpSrv.exe
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:848

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Config.Msi\f76f2fa.rbs

    Filesize

    2KB

    MD5

    66a986ce4ecbc2e2595cf18d3edf7bf4

    SHA1

    4d22c06d9d82f8f802b816b08f46fc890737928e

    SHA256

    1c5f19213d9abc69165ac8ce9e58ee52c2075f6fe7f3f9945128ec4913b2bc58

    SHA512

    9fc05a0a7fda8c44bd21e3b3e558f55fc9fc7430eedb6b4563bd1a83f4fb675e76d2fbcde52c06b54a70e4c98e3efc5afe4ca748619ac7bd6ce4f37c5780fd9b

  • C:\Users\Admin\AppData\Local\Temp\EHttpSrv.exe

    Filesize

    20KB

    MD5

    9329ba45c8b97485926a171e34c2abb8

    SHA1

    20118bc0432b4e8b3660a4b038b20ca28f721e5c

    SHA256

    effa6fcb8759375b4089ccf61202a5c63243f4102872e64e3eb0a1bdc2727659

    SHA512

    0af06b5495142ba0632a46be0778a7bd3d507e9848b3159436aa504536919abbcacd8b740ef4b591296e86604b49e0642fee2c273a45e44b41a80f91a1d52acc

  • C:\Users\Admin\AppData\Local\Temp\MFC80U.DLL

    Filesize

    1.0MB

    MD5

    686b224b4987c22b153fbb545fee9657

    SHA1

    684ee9f018fbb0bbf6ffa590f3782ba49d5d096c

    SHA256

    a2ac851f35066c2f13a7452b7a9a3fee05bfb42907ae77a6b85b212a2227fc36

    SHA512

    44d65db91ceea351d2b6217eaa27358dbc2ed27c9a83d226b59aecb336a9252b60aec5ce5e646706a2af5631d5ee0f721231ec751e97e47bbbc32d5f40908875

  • C:\Users\Admin\AppData\Local\Temp\MSI6f1ed.LOG

    Filesize

    19KB

    MD5

    876556d103f8ffa069c0c161b6305c9e

    SHA1

    c623e81343bfbe5f2be178b68076671c17ad011e

    SHA256

    44529a2a517051c5a205b45992c19cfd7b888fbfef9dfc4ffc983359aa53c40c

    SHA512

    c5e437c5f5bcfaf5440b9995b72cc3992b5ee5037a176d1bf803924f48132ca9f3d7515c8f01c378b73167693f423bb1c86e23027cc01df43b94c548682a3c4b

  • C:\Users\Admin\AppData\Local\Temp\audiogram.tif

    Filesize

    877KB

    MD5

    5124236fd955464317fbb1f344a1d2f2

    SHA1

    fe3a91e252f1dc3c3b4980ade7157369ea6f5097

    SHA256

    ed1389002cdf96c9b54de35b6e972166ee3296d628943fd594a383e674c5cba6

    SHA512

    2b2ac23244b16f936ef9a4049586f58c809fcc4391a56390cc5db2e8d96140001e0b977680ed1d8b0ab9c410e865a880209e22add8d42e563dc40bc91236b252

  • C:\Users\Admin\AppData\Local\Temp\f8d650bc

    Filesize

    1.0MB

    MD5

    ca3a7d8a69bd0df8bb627c432fa29001

    SHA1

    6a251dcca10958f7f9e5711a7e1eca6c501320cb

    SHA256

    f2e2b2e788e5c7337afc01430c6d97c32f06114cb06f9185a92049199a3b6ac0

    SHA512

    ce9622cdbae24c3434e17ad8e59526c3ee2a468e91628a3a00bd567248ce042c040007c9050da9c230f13be04f68a84ad637dd01d6886f4263f4ec852c5f1b32

  • C:\Windows\Installer\MSIF354.tmp

    Filesize

    557KB

    MD5

    2c9c51ac508570303c6d46c0571ea3a1

    SHA1

    e3e0fe08fa11a43c8bca533f212bdf0704c726d5

    SHA256

    ff86c76a8d5846b3a1ad58ff2fd8e5a06a84eb5899cdee98e59c548d33335550

    SHA512

    df5f1def5aac44f39a2dfde9c6c73f15f83a7374b4ad42b67e425ccb7ac99a64c5701b676ae46d2f7167a04a955158031a839e7878d100aaf8fab0ce2059f127

  • \Users\Admin\AppData\Local\Temp\http_dll.dll

    Filesize

    883KB

    MD5

    4366cd6c5d795811822b9ccc3df3eab4

    SHA1

    30f6050729b4c08b7657454cb79dd5a3d463c606

    SHA256

    55497a3eced5d8d190400bcd1a4b43a304ebf74a0d6d098665474ed4b1b0e9da

    SHA512

    4a56a2da7ded16125c2795d5760c7c08a93362536c9212cff3a31dbf6613cb3fca436efd77c256338f5134da955bc7ccc564b4af0c45ac0dfd645460b922a349

  • memory/848-102-0x0000000071D30000-0x0000000072D92000-memory.dmp

    Filesize

    16.4MB

  • memory/848-112-0x00000000001C0000-0x0000000000244000-memory.dmp

    Filesize

    528KB

  • memory/848-120-0x00000000001C0000-0x0000000000244000-memory.dmp

    Filesize

    528KB

  • memory/848-119-0x00000000001C0000-0x0000000000244000-memory.dmp

    Filesize

    528KB

  • memory/848-118-0x00000000001C0000-0x0000000000244000-memory.dmp

    Filesize

    528KB

  • memory/848-104-0x00000000779C0000-0x0000000077B69000-memory.dmp

    Filesize

    1.7MB

  • memory/848-105-0x00000000001C0000-0x0000000000244000-memory.dmp

    Filesize

    528KB

  • memory/848-109-0x00000000001C0000-0x0000000000244000-memory.dmp

    Filesize

    528KB

  • memory/848-110-0x00000000001C0000-0x0000000000244000-memory.dmp

    Filesize

    528KB

  • memory/848-117-0x00000000001C0000-0x0000000000244000-memory.dmp

    Filesize

    528KB

  • memory/848-113-0x00000000001C0000-0x0000000000244000-memory.dmp

    Filesize

    528KB

  • memory/848-114-0x00000000001C0000-0x0000000000244000-memory.dmp

    Filesize

    528KB

  • memory/848-115-0x00000000001C0000-0x0000000000244000-memory.dmp

    Filesize

    528KB

  • memory/848-116-0x00000000001C0000-0x0000000000244000-memory.dmp

    Filesize

    528KB

  • memory/2528-98-0x00000000750A0000-0x0000000075214000-memory.dmp

    Filesize

    1.5MB

  • memory/2528-51-0x00000000779C0000-0x0000000077B69000-memory.dmp

    Filesize

    1.7MB

  • memory/2808-48-0x00000000750A0000-0x0000000075214000-memory.dmp

    Filesize

    1.5MB

  • memory/2808-47-0x00000000750A0000-0x0000000075214000-memory.dmp

    Filesize

    1.5MB