Analysis

  • max time kernel
    77s
  • max time network
    80s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241211-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    19-12-2024 19:20

General

  • Target

    Remcos Professional Cracked By Alcatraz3222/Remcos Professional Cracked By Alcatraz3222.exe

  • Size

    17.7MB

  • MD5

    efc159c7cf75545997f8c6af52d3e802

  • SHA1

    b85bd368c91a13db1c5de2326deb25ad666c24c1

  • SHA256

    898ac001d0f6c52c1001c640d9860287fdf30a648d580e9f5dd15e2ef84ab18e

  • SHA512

    d06a432233dceb731defd53238971699fef201d0f9144ee50e5dd7d6620dfdd6c298d52618bf2c9feb0519574f4565fb0177b00fd8292768fbd8b85dd11e650d

  • SSDEEP

    393216:GYuGvp8EHb+in8f4Zg41+Q4AXf5ZZcyfHDMxVpSc+q+eOFxdx:3mqSi8fN4sAXfrZcyfo7p0eYHx

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

dllsys.duckdns.org:3202

Mutex

3b570ffeeb3d34249b9a5ce0ee58a328

Attributes
  • reg_key

    3b570ffeeb3d34249b9a5ce0ee58a328

  • splitter

    svchost

Signatures

  • Njrat family
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 40 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222\Remcos Professional Cracked By Alcatraz3222.exe
    "C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222\Remcos Professional Cracked By Alcatraz3222.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222.exe
      "C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3448
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/Remcos Professional Cracked By Alcatraz3222/Remcos Professional Cracked By Alcatraz3222.exe" "%temp%\Profile Remcos\Update_Lock_Remcos.exe" /Y
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3016
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\Profile Remcos\Update_Lock_Remcos.exe.lnk" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1816
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Profile Remcos\Update_Lock_Remcos.exe.lnk" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1296
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\Profile Remcos\Update_Lock_Remcos.exe:Zone.Identifier
      2⤵
      • System Location Discovery: System Language Discovery
      PID:744
    • C:\Users\Admin\AppData\Local\Temp\taskhost.exe
      "C:\Users\Admin\AppData\Local\Temp\taskhost.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2428
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\taskhost.exe" "taskhost.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:3620

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222.exe

    Filesize

    17.4MB

    MD5

    c3c21fa4c2186deb641455482ab0d3aa

    SHA1

    2f4b49e8383e073ccb965943ce970de403412567

    SHA256

    4ea203509d0fdff3e31f976413c546ca3d36133bc708e9a1301860961cc3a8d9

    SHA512

    31db2963f1bd49f7b4a6ee38e54940d20120d6c05ef7bf34ec97eb93051bee6d5428e9e1271e4ae8f5544b824188ac7278315e2e2c27be302a312eebbf8c3fb7

  • C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222\Remcos_Settings.ini

    Filesize

    881B

    MD5

    a3468935e33e361cf94f4721ed4cb66d

    SHA1

    c3b19ca8382534b2179940cabede8c6c952a9c06

    SHA256

    b374af58c24b6085f64f979dab434643da39d0267a27975f396473327dc98c7d

    SHA512

    c1caa0b9637a46187d54b2952db204182fad5a5324574949ce4db13bdb17624ccd8b3228eb9b2bcfe5851add2c5d2f586945e7264b1d1cd02d91acf1fd81583a

  • C:\Users\Admin\AppData\Local\Temp\taskhost.exe

    Filesize

    256KB

    MD5

    8fdf47e0ff70c40ed3a17014aeea4232

    SHA1

    e6256a0159688f0560b015da4d967f41cbf8c9bd

    SHA256

    ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82

    SHA512

    bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be

  • memory/2428-41-0x0000000004FA0000-0x0000000004FAA000-memory.dmp

    Filesize

    40KB

  • memory/2428-40-0x0000000004FE0000-0x0000000005072000-memory.dmp

    Filesize

    584KB

  • memory/2428-34-0x00000000054B0000-0x0000000005A56000-memory.dmp

    Filesize

    5.6MB

  • memory/2428-32-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/3448-25-0x0000000000762000-0x000000000181E000-memory.dmp

    Filesize

    16.7MB

  • memory/3448-24-0x0000000004870000-0x0000000004871000-memory.dmp

    Filesize

    4KB

  • memory/3448-22-0x0000000002B60000-0x0000000002B61000-memory.dmp

    Filesize

    4KB

  • memory/3448-21-0x0000000002B50000-0x0000000002B51000-memory.dmp

    Filesize

    4KB

  • memory/3448-20-0x0000000002B40000-0x0000000002B41000-memory.dmp

    Filesize

    4KB

  • memory/3448-19-0x00000000029E0000-0x00000000029E1000-memory.dmp

    Filesize

    4KB

  • memory/3448-27-0x0000000004890000-0x0000000004891000-memory.dmp

    Filesize

    4KB

  • memory/3448-26-0x0000000004880000-0x0000000004881000-memory.dmp

    Filesize

    4KB

  • memory/3448-28-0x0000000000400000-0x0000000002991000-memory.dmp

    Filesize

    37.6MB

  • memory/3448-23-0x0000000004860000-0x0000000004861000-memory.dmp

    Filesize

    4KB

  • memory/3448-39-0x0000000000762000-0x000000000181E000-memory.dmp

    Filesize

    16.7MB

  • memory/4648-4-0x000000000D640000-0x000000000E7C2000-memory.dmp

    Filesize

    17.5MB

  • memory/4648-37-0x000000007454E000-0x000000007454F000-memory.dmp

    Filesize

    4KB

  • memory/4648-38-0x0000000074540000-0x0000000074CF1000-memory.dmp

    Filesize

    7.7MB

  • memory/4648-0-0x000000007454E000-0x000000007454F000-memory.dmp

    Filesize

    4KB

  • memory/4648-3-0x0000000074540000-0x0000000074CF1000-memory.dmp

    Filesize

    7.7MB

  • memory/4648-2-0x0000000005E80000-0x0000000005F1C000-memory.dmp

    Filesize

    624KB

  • memory/4648-43-0x0000000074540000-0x0000000074CF1000-memory.dmp

    Filesize

    7.7MB

  • memory/4648-1-0x0000000000380000-0x000000000152E000-memory.dmp

    Filesize

    17.7MB