Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 01:20
General
-
Target
8df645995df261a5bc7c19d2ba16127256054497e498faaba582dffe10e01f91.exe
-
Size
986KB
-
MD5
d5da623ad42a511796d291c516a5dbb6
-
SHA1
029ef97714317521a472f7a8770295421a585e45
-
SHA256
8df645995df261a5bc7c19d2ba16127256054497e498faaba582dffe10e01f91
-
SHA512
eb64880cbe757026605f76d737f00ed73fb28b0580cab7a1f225295252fa3f366875e999e2493c4a7050769aa8989660ec140dc39231974f011e91001eb50acd
-
SSDEEP
24576:xGQ3AgIk9qzYhJVbysG2iPQE2cjYkT0CdA0uYvr0TzP1R:gQQJk9xVboRPQLcfTZZRvwTzPn
Malware Config
Extracted
remcos
RemoteHost
mandope483.duckdns.org:59033
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-JPRNP1
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Detected Nirsoft tools 3 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: MapViewOfSection 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8df645995df261a5bc7c19d2ba16127256054497e498faaba582dffe10e01f91.exe"C:\Users\Admin\AppData\Local\Temp\8df645995df261a5bc7c19d2ba16127256054497e498faaba582dffe10e01f91.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8df645995df261a5bc7c19d2ba16127256054497e498faaba582dffe10e01f91.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\8df645995df261a5bc7c19d2ba16127256054497e498faaba582dffe10e01f91.exe"C:\Users\Admin\AppData\Local\Temp\8df645995df261a5bc7c19d2ba16127256054497e498faaba582dffe10e01f91.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8df645995df261a5bc7c19d2ba16127256054497e498faaba582dffe10e01f91.exeC:\Users\Admin\AppData\Local\Temp\8df645995df261a5bc7c19d2ba16127256054497e498faaba582dffe10e01f91.exe /stext "C:\Users\Admin\AppData\Local\Temp\jkubuzbkvznaajeg"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\8df645995df261a5bc7c19d2ba16127256054497e498faaba582dffe10e01f91.exeC:\Users\Admin\AppData\Local\Temp\8df645995df261a5bc7c19d2ba16127256054497e498faaba582dffe10e01f91.exe /stext "C:\Users\Admin\AppData\Local\Temp\tezturmejhffdpssyrf"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\8df645995df261a5bc7c19d2ba16127256054497e498faaba582dffe10e01f91.exeC:\Users\Admin\AppData\Local\Temp\8df645995df261a5bc7c19d2ba16127256054497e498faaba582dffe10e01f91.exe /stext "C:\Users\Admin\AppData\Local\Temp\tezturmejhffdpssyrf"3⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\8df645995df261a5bc7c19d2ba16127256054497e498faaba582dffe10e01f91.exeC:\Users\Admin\AppData\Local\Temp\8df645995df261a5bc7c19d2ba16127256054497e498faaba582dffe10e01f91.exe /stext "C:\Users\Admin\AppData\Local\Temp\wgeevkxffpxrnvowicshnk"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5ead2b476a1d282c209748c9e2a3ff2bb
SHA1eb132bcdd096f49b355552efd2d1423430583c7c
SHA2562895dc5419c14a918965a9ff0e80353d74a9baf3f7a18a96fc2e808810fa1207
SHA512e06d8b7a56c57f04148960d07e2046406dda5143ae97780f2fc94055a96d6bc2d5efb693f2cfd16b4005ec34980379d3a9cf9afe3595d0bae1113705ec1f6fcd
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD57aca43b2800ceb18b3ed2326532545de
SHA1d4cf207ef85bd749d59c1cb27a09c167ee21523a
SHA2563d9f8622d97587fd84d3d0560a50ab38e5f894fe4b5bcaa34279643fdaaeb480
SHA5120e002e6b8d965c227d9b1aa7c0251619c787ec7717e59667e756e5815e3666a955ea397eb148a1ed6bb7d8045727e4efa656a103f14bc70a03b03f0c91283c2f
-
Filesize
6.5MB
-
Filesize
652KB
-
Filesize
40KB
-
Filesize
80KB
-
Filesize
600KB
-
Filesize
56KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
68KB
-
Filesize
7.7MB
-
Filesize
120KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
200KB
-
Filesize
4KB
-
Filesize
216KB
-
Filesize
7.7MB
-
Filesize
32KB
-
Filesize
6.2MB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
584KB
-
Filesize
72KB
-
Filesize
784KB
-
Filesize
1008KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
392KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
508KB