Analysis

  • max time kernel
    147s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-11-2024 00:18

General

  • Target

    Slf.msi

  • Size

    3.4MB

  • MD5

    6f92f923d8f87afe5fe757ff2ff56951

  • SHA1

    44780713a7026b9b0ff3cadeaffacb3cc3584eca

  • SHA256

    6ed0c218b751ec93293b5922e783b7a9b147a3c7cd6070022cd707050108d321

  • SHA512

    100df666e8c5b4c2e21de703fe7210a41daedf1480e1fe4b7388aa63dd51eccbe46e141a275ef61061c97cf3cd268a129cfd5fa0e290e4525b07915789713f0a

  • SSDEEP

    49152:vm5X8r6F5mCmR+juZZZL+H9IyKficUAG595WpZsNAaudSIuvLZ8:co6wZLSIX6cZGZWUNAaudgZ

Malware Config

Extracted

Family

remcos

Botnet

v2

C2

185.157.162.126:1995

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    qsdazeazd-EL00KX

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Detects HijackLoader (aka IDAT Loader) 1 IoCs
  • HijackLoader

    HijackLoader is a multistage loader first seen in 2023.

  • Hijackloader family
  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 11 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NSIS installer 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Slf.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2584
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1904
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding DE8C79BD7D57DD2641E5493C9FE84536
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1800
    • C:\Users\Admin\AppData\Local\Temp\EHttpSrv.exe
      "C:\Users\Admin\AppData\Local\Temp\EHttpSrv.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1880
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe
        3⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:3960
        • C:\Users\Admin\AppData\Local\Temp\EHttpSrv.exe
          C:\Users\Admin\AppData\Local\Temp\EHttpSrv.exe
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:5028
    • C:\Users\Admin\AppData\Local\Temp\Updwork.exe
      "C:\Users\Admin\AppData\Local\Temp\Updwork.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2156
      • C:\Windows\SysWOW64\WerFault.exe
        "C:\Windows\System32\WerFault.exe"
        3⤵
          PID:4300
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}
      1⤵
      • System Location Discovery: System Language Discovery
      PID:4872

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\e5783ba.rbs

      Filesize

      2KB

      MD5

      94246d0fc97edd83f70f5cab7eceffce

      SHA1

      681223694fe76556ba93867397b217477923b562

      SHA256

      121e2c4deeb74b175cb1558a2d2b89e737ad0914f688f8134f235d2700449808

      SHA512

      cee8d48df746d37bb2616496c515467b01597bdebaac75b26fc1f3a27d82b2d7e72e15d781ad8c6c59d0bcbdd539d80daea01e1fd10d4c5126718f6673860dd9

    • C:\Users\Admin\AppData\Local\Temp\EHttpSrv.exe

      Filesize

      20KB

      MD5

      9329ba45c8b97485926a171e34c2abb8

      SHA1

      20118bc0432b4e8b3660a4b038b20ca28f721e5c

      SHA256

      effa6fcb8759375b4089ccf61202a5c63243f4102872e64e3eb0a1bdc2727659

      SHA512

      0af06b5495142ba0632a46be0778a7bd3d507e9848b3159436aa504536919abbcacd8b740ef4b591296e86604b49e0642fee2c273a45e44b41a80f91a1d52acc

    • C:\Users\Admin\AppData\Local\Temp\MSI7824f.LOG

      Filesize

      20KB

      MD5

      86a2e903b8cbe5713179433c49d89b1b

      SHA1

      d1d8c022efe42eec2128ee72aaf7ee8d37cb5084

      SHA256

      f74436b4c17dc1c7fefbe5871dde9d940dc85bedec0e1cd2a9590fc8739cea95

      SHA512

      9a80ed415df65934aad8145fb994260a4e5055bba9964ca18e91026d4227dca1066b772cf9959bb71cfb4b330168aaefefde9ace16b1c65123a16d93f7923ab2

    • C:\Users\Admin\AppData\Local\Temp\RaftelibeGarss\zlib1.dll

      Filesize

      363KB

      MD5

      3ca940e27e87443f7891d39536650f9b

      SHA1

      2603ff220c43f13591a51abb0cf339aecb758207

      SHA256

      a91f13aece1ea7ebe326f0e340bda9d00613d3365cd81b7f138a4c9446ffbd38

      SHA512

      0c0e04cbb8247f6dfe0790d1c3453596e3cb5f5ff0d2c3bc4e01fb38ad8e042322130072263c135c5637a745ef70ac68487bdade3510990ce8f609cad46566ee

    • C:\Users\Admin\AppData\Local\Temp\Updwork.exe

      Filesize

      494KB

      MD5

      253c52411b256e4af301cba58dcb6cef

      SHA1

      f21252c959b9eb47cd210f41b997cf598612d7c9

      SHA256

      7d57b704dd881413e7ee2effb3d85bdfff1e208b0f3f745419e640930d9d339d

      SHA512

      40de728edae55f97ac9459cf78bbc31b38e8b59bdb7a74fbd9e09d7efd2a81b1dc5fd8011007c66efb58e850f1c57d099ec340aecd62911d6aebf2e70d1275d0

    • C:\Users\Admin\AppData\Local\Temp\audiogram.tif

      Filesize

      877KB

      MD5

      5124236fd955464317fbb1f344a1d2f2

      SHA1

      fe3a91e252f1dc3c3b4980ade7157369ea6f5097

      SHA256

      ed1389002cdf96c9b54de35b6e972166ee3296d628943fd594a383e674c5cba6

      SHA512

      2b2ac23244b16f936ef9a4049586f58c809fcc4391a56390cc5db2e8d96140001e0b977680ed1d8b0ab9c410e865a880209e22add8d42e563dc40bc91236b252

    • C:\Users\Admin\AppData\Local\Temp\ff3d5e01

      Filesize

      1.0MB

      MD5

      037346d568f61f2ab0792061207e03cb

      SHA1

      57191674928277f4383c41a5e589f8d8a31ccd3c

      SHA256

      3cee461aacf99b7d51b97e44866fae7c3ac060aa48003b2631fd7ca85d814698

      SHA512

      8838ca98f6c4eda06259b405008b8b98bf564e47820883f00844f765e0d1389e9b764872c2876458bbb477dfbefb68648b34941b0742ea618a3c05caeee62305

    • C:\Users\Admin\AppData\Local\Temp\http_dll.dll

      Filesize

      883KB

      MD5

      4366cd6c5d795811822b9ccc3df3eab4

      SHA1

      30f6050729b4c08b7657454cb79dd5a3d463c606

      SHA256

      55497a3eced5d8d190400bcd1a4b43a304ebf74a0d6d098665474ed4b1b0e9da

      SHA512

      4a56a2da7ded16125c2795d5760c7c08a93362536c9212cff3a31dbf6613cb3fca436efd77c256338f5134da955bc7ccc564b4af0c45ac0dfd645460b922a349

    • C:\Users\Admin\AppData\Local\Temp\mfc80u.dll

      Filesize

      1.0MB

      MD5

      686b224b4987c22b153fbb545fee9657

      SHA1

      684ee9f018fbb0bbf6ffa590f3782ba49d5d096c

      SHA256

      a2ac851f35066c2f13a7452b7a9a3fee05bfb42907ae77a6b85b212a2227fc36

      SHA512

      44d65db91ceea351d2b6217eaa27358dbc2ed27c9a83d226b59aecb336a9252b60aec5ce5e646706a2af5631d5ee0f721231ec751e97e47bbbc32d5f40908875

    • C:\Windows\Installer\MSI8414.tmp

      Filesize

      557KB

      MD5

      2c9c51ac508570303c6d46c0571ea3a1

      SHA1

      e3e0fe08fa11a43c8bca533f212bdf0704c726d5

      SHA256

      ff86c76a8d5846b3a1ad58ff2fd8e5a06a84eb5899cdee98e59c548d33335550

      SHA512

      df5f1def5aac44f39a2dfde9c6c73f15f83a7374b4ad42b67e425ccb7ac99a64c5701b676ae46d2f7167a04a955158031a839e7878d100aaf8fab0ce2059f127

    • memory/1880-49-0x0000000074390000-0x000000007450B000-memory.dmp

      Filesize

      1.5MB

    • memory/1880-73-0x0000000074390000-0x000000007450B000-memory.dmp

      Filesize

      1.5MB

    • memory/2156-59-0x0000000062E80000-0x0000000062EE3000-memory.dmp

      Filesize

      396KB

    • memory/3960-76-0x00007FFB38E70000-0x00007FFB39065000-memory.dmp

      Filesize

      2.0MB

    • memory/3960-78-0x0000000074390000-0x000000007450B000-memory.dmp

      Filesize

      1.5MB

    • memory/4300-64-0x0000000000690000-0x00000000006D9000-memory.dmp

      Filesize

      292KB

    • memory/5028-91-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5028-92-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5028-83-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5028-86-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5028-87-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5028-90-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5028-80-0x0000000072960000-0x0000000073BB4000-memory.dmp

      Filesize

      18.3MB

    • memory/5028-82-0x00007FFB38E70000-0x00007FFB39065000-memory.dmp

      Filesize

      2.0MB

    • memory/5028-93-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5028-94-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5028-95-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5028-96-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5028-97-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB

    • memory/5028-98-0x0000000000410000-0x0000000000494000-memory.dmp

      Filesize

      528KB