Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    23/11/2024, 10:21

General

  • Target

    3e080ccb41529931481861828df6a2ca32b039ed0217adcecb832547d8da0566.exe

  • Size

    897KB

  • MD5

    667060459d876845db2677ddc3d58488

  • SHA1

    800f741383f4f4027d70a5942fe4b263b592eed5

  • SHA256

    3e080ccb41529931481861828df6a2ca32b039ed0217adcecb832547d8da0566

  • SHA512

    c9fce460c1b2de0e53782df4a84dc6c1d28bc4b8b8850b0adcbf3f87e72d156654760ebb32e52582a7adc4e3d58526959b51cdfd72fa947b314749c23492fee7

  • SSDEEP

    24576:vMy1GyhxutkS+BwTCEGh0BV0i7OqD4uTfV:LFhxutkdeCEGmB6uD4uD

Malware Config

Extracted

Family

remcos

Botnet

Host

C2

oyo.work.gd:3142

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    vlc

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    pdf

  • mouse_option

    false

  • mutex

    jkm-I9KENP

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    ios

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3e080ccb41529931481861828df6a2ca32b039ed0217adcecb832547d8da0566.exe
    "C:\Users\Admin\AppData\Local\Temp\3e080ccb41529931481861828df6a2ca32b039ed0217adcecb832547d8da0566.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Users\Admin\AppData\Local\Temp\3e080ccb41529931481861828df6a2ca32b039ed0217adcecb832547d8da0566.exe
      "C:\Users\Admin\AppData\Local\Temp\3e080ccb41529931481861828df6a2ca32b039ed0217adcecb832547d8da0566.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2840

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\pdf\logs.dat

    Filesize

    144B

    MD5

    1c0190cd2da4eb3b90a57d6dbd25bda4

    SHA1

    b7ada8ee279658c344a9abb98afe9adb3feef7f2

    SHA256

    21dece2f1ea5de5bcc353021fdaf11009e4187ad22eaf00732b87479335e41fd

    SHA512

    1566cb5d3928a0f1a6f0f87e47bc805fb25fe08ea4690a490b9a615b436104a2275e9f5a315d60ffeeb97c861b5bc7c79d844dc6ad6bf7d09068e497ca1c7591

  • memory/2808-0-0x000000007430E000-0x000000007430F000-memory.dmp

    Filesize

    4KB

  • memory/2808-1-0x00000000011B0000-0x0000000001296000-memory.dmp

    Filesize

    920KB

  • memory/2808-2-0x0000000074300000-0x00000000749EE000-memory.dmp

    Filesize

    6.9MB

  • memory/2808-3-0x0000000000520000-0x0000000000532000-memory.dmp

    Filesize

    72KB

  • memory/2808-4-0x000000007430E000-0x000000007430F000-memory.dmp

    Filesize

    4KB

  • memory/2808-5-0x0000000074300000-0x00000000749EE000-memory.dmp

    Filesize

    6.9MB

  • memory/2808-6-0x0000000005C70000-0x0000000005D30000-memory.dmp

    Filesize

    768KB

  • memory/2808-34-0x0000000074300000-0x00000000749EE000-memory.dmp

    Filesize

    6.9MB

  • memory/2840-8-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-13-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-25-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-31-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-32-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-29-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-27-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2840-21-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-19-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-17-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-33-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-15-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-11-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-9-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-35-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-36-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-37-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-39-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-40-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-41-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-42-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-43-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-45-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-46-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-47-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-48-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-50-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-51-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-52-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-53-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-54-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-56-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-57-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-58-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-59-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-61-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-62-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-63-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-64-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-66-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-67-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-68-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-69-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-70-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-72-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-73-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-74-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-75-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-77-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-78-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-79-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/2840-80-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB