Analysis

  • max time kernel
    297s
  • max time network
    297s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-12-2024 00:26

General

  • Target

    Електронне платіжне доручення.exe

  • Size

    1.3MB

  • MD5

    ada3c3c6301b67daa99a09c65d93e0b4

  • SHA1

    f2caa797fba73b53637dab45ddc4aefe36dc8fd3

  • SHA256

    d3f253244f5298f184a93f33f9d58823e676d1a2e9253f0e2cc85912544f2fff

  • SHA512

    65142861430847fb588930532d32416c2d466d69937037ceac7f72c1a5c531109c9fa3d18088164c75e3b7a96b0ccf8b4cc767907f542c26a0a2782b4b5a3390

  • SSDEEP

    24576:MebHcAT/WwS275kpc4gIDTFyIt+nbhjQRJGtlz2BQFVUaQLEZM9S+pQkyf:t/WDS5FIbt+nbhcAJyQEZsvWQBf

Malware Config

Extracted

Family

remcos

Botnet

host_one

C2

101.99.75.173:22

101.99.75.173:80

101.99.75.173:5432

101.99.75.173:3306

101.99.75.173:55555

Attributes
  • audio_folder

    ??????????? ??????

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    6C@=0;K.dat

  • keylog_flag

    false

  • keylog_folder

    key

  • mouse_option

    false

  • mutex

    ???-62U21F

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    ?????????

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3444
      • C:\Users\Admin\AppData\Local\Temp\Електронне платіжне доручення.exe
        "C:\Users\Admin\AppData\Local\Temp\Електронне платіжне доручення.exe"
        2⤵
        • Checks computer location settings
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4716
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c copy Nipple Nipple.cmd & Nipple.cmd
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2232
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            4⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:1336
          • C:\Windows\SysWOW64\findstr.exe
            findstr /I "opssvc wrsa"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4736
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            4⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4032
          • C:\Windows\SysWOW64\findstr.exe
            findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1880
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c md 817563
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2216
          • C:\Windows\SysWOW64\findstr.exe
            findstr /V "In" Monitor
            4⤵
            • System Location Discovery: System Language Discovery
            PID:880
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c copy /b ..\Expense + ..\Cult + ..\Guns + ..\Upset + ..\Collective + ..\Wallace + ..\Open + ..\Monkey + ..\Sake + ..\Patches + ..\Basis R
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4300
          • C:\Users\Admin\AppData\Local\Temp\817563\Preliminary.com
            Preliminary.com R
            4⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Deletes itself
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2652
          • C:\Windows\SysWOW64\choice.exe
            choice /d y /t 5
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3048
      • C:\Windows\SysWOW64\cmd.exe
        cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftServe.url" & echo URL="C:\Users\Admin\AppData\Local\ServerSwift Systems Inc\SwiftServe.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftServe.url" & exit
        2⤵
        • Drops startup file
        • System Location Discovery: System Language Discovery
        PID:4304

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\key\журналы.dat

      Filesize

      144B

      MD5

      b2ee3621d8b1a70e810638365f3a762b

      SHA1

      51439e224c045183d4472d4cb4f40b379bdaf947

      SHA256

      4ba831e1857e4e82f9276492c3907eb9528603407512b77b11492874a98560ba

      SHA512

      40d039227e5ce9f6af899ec22edb06e45d42654d1f716208f4e1d08f9124351eb59cecebed80953fdb2616ffaca4ae9ff8b27cc879d801f37ce0cca2c13affc4

    • C:\Users\Admin\AppData\Local\Temp\817563\Preliminary.com

      Filesize

      925KB

      MD5

      62d09f076e6e0240548c2f837536a46a

      SHA1

      26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

      SHA256

      1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

      SHA512

      32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

    • C:\Users\Admin\AppData\Local\Temp\817563\R

      Filesize

      678KB

      MD5

      3117317df882a3e2e203f6e8533d1b7b

      SHA1

      67fe92238cf0eb81e5d4d1454f9272ec29e33d32

      SHA256

      84c2377004b78e739bc4dc0d07fef57434ee7c04c83db9ded6a49b2c94e5b9f0

      SHA512

      e6f10584f4663ee03a9fa9f108c8d4691057f8155bda6906b31d245fccf8acac376d31af05dd5b1e259380869174d9f8d555f04e5a6ecf9b2ea23871a79971bd

    • C:\Users\Admin\AppData\Local\Temp\Aerospace

      Filesize

      139KB

      MD5

      6d2c8d0119a14f92c6cc08f277eee5e7

      SHA1

      e1baf13573e9b78f4cb368f9346ddc2cbd1da0fe

      SHA256

      2867fac0bb48ec79f7671b1d7985f9658d5d61733138b151acfebb6aa7fd4a38

      SHA512

      a1ea5afeb3f61dfa896bfd5bc40d4d2e556ed3c436e5f0032b7648bc9a791d46ccf1007ec6e9061954d77828b36ff7b1d3b30f34eefac0caed80590a25056b8a

    • C:\Users\Admin\AppData\Local\Temp\Basis

      Filesize

      10KB

      MD5

      67ca58ff26ae469bdd85481b18319e10

      SHA1

      15a43221ae1b0f4ab84e1e85e4e5471546c22d55

      SHA256

      baeaac4e266f0d1276d4b3804d6a664fdf7b200cce32665f83eeeedfb29f9aec

      SHA512

      814486e7ba766ab84713211767213f42370382b7bfbdd6daf2899595dacaf6ac52b5e0761cd2933645bdd693190af709c97c45377d987850425bf6a8e29f6d5e

    • C:\Users\Admin\AppData\Local\Temp\Collective

      Filesize

      65KB

      MD5

      8d67c5a284b862d5aa90b407612e45aa

      SHA1

      90f205651eca176f7e62dd96269550aeaa3cca62

      SHA256

      80d9f4041d897c07fe642bb0e7525c6c0149757ed8285452664aea7fc90f0f25

      SHA512

      d3a171d7ab9138fc1dc3c07b960a81ac0c56beef4edef253ce1e13839d2f880569e2a2039c642bab4db9f22f36c013a4a94167a2755fc784aa9b935382ae82ff

    • C:\Users\Admin\AppData\Local\Temp\Cult

      Filesize

      51KB

      MD5

      cea038e616c6906ecbe8fc5f04049e34

      SHA1

      fc82a87f120421e7f0fa96d029c11da396ed6aa7

      SHA256

      9f1e3046324430430a953a6a503c669cd8fca33afc6882efca06798eccd318af

      SHA512

      cd7ef83fff6c7b826a1a60f7bb255e566fe562763e7606ca951d978ce562e529c8786e169f724b48d731149334a465107f6f7d8ba2a053c289308cf4e4680030

    • C:\Users\Admin\AppData\Local\Temp\Discussed

      Filesize

      100KB

      MD5

      30ba094c9550130ce416b46dafe1532a

      SHA1

      9de498240f6521a410328b55ad4ee97f8e8e1352

      SHA256

      b57e3138c28ead65bc5e96b3216fac18ce98027222190b49df1aa3b7ae63b377

      SHA512

      c78e9226a6a0bf6440f138894d746c889c9aa06dad275e7f629abbeb7c752e8a53eef8edc1d8e884536b32fc666a1ed333c544e546147994200e374eb80217b6

    • C:\Users\Admin\AppData\Local\Temp\Dom

      Filesize

      135KB

      MD5

      3c5dd95b530f83b28ed31f3cb96539e7

      SHA1

      a4c312b5250482caf2c92d204df27e2668db5585

      SHA256

      c5b62b01be484af0691d478b69baa78e89508ae5396801f6f59371411156ef05

      SHA512

      75a0f9d4c975bc2b75637c80f1c3380ab303a9332c3fc77ccac48d515794ec147fa5cacf118a1d5e31bf6e32686580aa0e4cbf20ac07abaf0bab8c49127e2a0c

    • C:\Users\Admin\AppData\Local\Temp\Expense

      Filesize

      81KB

      MD5

      02385eaad7b6cc355d94b8e17296ff77

      SHA1

      ccd5942d88d54115dcbcd9bba5cd96c42a4c5fd1

      SHA256

      71c3feb52b7f0412843bbf1dd95c669721b880ea353f2501691a172ffbd55b5c

      SHA512

      cc6f494e4c796f0c28e954f0af938a2b63d6c61ed567c9a150148a3e481f252c6d8acb3240d0db34128de0163e1284f7d544ad80a7c72e8130cf06f86bcad92f

    • C:\Users\Admin\AppData\Local\Temp\Fucked

      Filesize

      68KB

      MD5

      7849cdc03a785b912b0b81c786707168

      SHA1

      f48b6f97994dcd30037e38997e14355e9963a8a2

      SHA256

      e0a74f965293ec2082090df4f1257e8cddd67831c123e72e7567d9185d2612eb

      SHA512

      118721c64ad8ebe1092d9cfc14bd7909d2f33900887b2f1613757841e914d3f0a2cb62d55b62998b620e0388bc9f7e26861584007c9954aa092015bac2d6df13

    • C:\Users\Admin\AppData\Local\Temp\Guns

      Filesize

      84KB

      MD5

      2939c911762915087adfafc90d8af697

      SHA1

      cfe419f55929278ad7fe67e354ad674b6abe7a48

      SHA256

      335abbf36a40cef8c373e8854b03ef4dd4b91397227092dd453f0021ba00fc31

      SHA512

      1c1240ef98af92fe3c201540a52cf9f95793f6483c9f1325647310a69ebb1d1a856a1ce1dabd8b99daa3b2660455a0931ce202c327f29ca9662b82156773412b

    • C:\Users\Admin\AppData\Local\Temp\Hobbies

      Filesize

      115KB

      MD5

      e761cdc5c0ca9b4999d03d5fd7b18c23

      SHA1

      596816e504795def37028f50f8e0e3dae408c7a4

      SHA256

      7977e801712ae5663a61f53c01505a97e84a4f2807be8aa1153fabaf005cb765

      SHA512

      80ab72fd74cf57a741e3237113358b76547876b76a7b60e5e772c27ec458a403f94bea870bc88095a04c51aa5ecc0c9d4b72ad336d3525f5d7dfe957b2807472

    • C:\Users\Admin\AppData\Local\Temp\Impression

      Filesize

      148KB

      MD5

      db90ad37a148a7825a72bec7c6919ac0

      SHA1

      ec137bab60653e30a15706907f7012403719aeb1

      SHA256

      4d2c27754883f105181f82ba6b9aed10e1a1c6e7bcb2aefb5b9deb1510bac199

      SHA512

      3957c0b124ff6fc1799b84ad3e85d746cd79b378cb1062056c5bccc9f1d96939c4c4132e13bb3195ac8df025a94b76451821ce7c5a7e9e951a50253dc468deb2

    • C:\Users\Admin\AppData\Local\Temp\Memo

      Filesize

      76KB

      MD5

      2dce523ee63985400fcbf2d855f69541

      SHA1

      fa449fb98533f65bddf8e7907824a4e984e67818

      SHA256

      6c166f048ba5b13a8dbfedc9183db0d1729c7661d2f54b174a87a3dc97400ab5

      SHA512

      8d40540402008af15d4e2a5fcc660d231791d9f8d0f14de61ae6c853d565c4d7c6d16f68e01eabfec4f6edd75cbbc552f6545c69c7e6d8953693052c6eab2a22

    • C:\Users\Admin\AppData\Local\Temp\Monitor

      Filesize

      1KB

      MD5

      a5f53ea6f702ac1c58c0dd9707fd4dc7

      SHA1

      99833c2c7446431d5fddbf6d12fbdef220f5d83a

      SHA256

      4b84339936faf19f684137fc814fc29d658e4130d28b2c3355061247b8dc047a

      SHA512

      9620191c6b27bb92211f2b0b5ac0e58a5624f42cc053904d82a0a71d19b08c5290bc55cec1f2c5d8202690d3ba6dca89565211c1158ac44296814e4d89573bc1

    • C:\Users\Admin\AppData\Local\Temp\Monkey

      Filesize

      53KB

      MD5

      6930c94d3e7bbd6efeb59bcda53d4dc4

      SHA1

      e69f3a0e316489e41bef26045b738b16bd36b0b0

      SHA256

      8804a091a1512b07e557dff8a36dd5cc1aebf92699233036761374ab4ff44347

      SHA512

      bf69311904e26ab90b18bc9cb4a6676a756d3c5a4582ea75aa24f5d39ffd86271c98254267aba753ac398f5c1fe85bb8b3bfdd0292544333f22b1afcc163c038

    • C:\Users\Admin\AppData\Local\Temp\Nipple

      Filesize

      11KB

      MD5

      a3d812b823ac43607bb800e23ed6d6b3

      SHA1

      84ceb6869e2b473d9810b522eb174d8ad65161e3

      SHA256

      cd0911fd74ce1d3adffec09169a47af00e29331c2c96e9da9b75ef7b6bd7a172

      SHA512

      2a74e650e618550fb4f649865f690eff18b31c899eb7c58b848df787b9f6c8a1aa39a5d521058ea5b3e93c132290bc7013c3e70e381ca56e920956437ff89949

    • C:\Users\Admin\AppData\Local\Temp\Open

      Filesize

      57KB

      MD5

      7b88f239324c6d2e5ea2ee02e69a895d

      SHA1

      c3d4e122c3e668342fada164fb87fceb62f3a9e6

      SHA256

      78be5a740818b47529c00d31a2ffcceddc55faff9c0a661372c365f2445b8e04

      SHA512

      94861fe8352d4cd80556fd5a116aeb11dc17214314b11486689fa07d020397b33bc65c6336deda1b1b545735f14ba6b1b20883f7c819cd7bc7d1dcc48336cd90

    • C:\Users\Admin\AppData\Local\Temp\Patches

      Filesize

      93KB

      MD5

      da4e2954c412963a8e4a362a149a25ea

      SHA1

      750ef09012486d0ac29fab4bfcd52589bd035b18

      SHA256

      e49fff842cc68fd56a8a36ede5f9fa9312f8b91a90da7bd9ff54cbbfe4d1e6fc

      SHA512

      55895bcdffcc423005c9f743ae268a45b2f182a33f5a10bcebc9ab488ea1a554392420393587f8dba74ca849c54c99eb5bed8c87b8def2b9cbc4d611cd778a7a

    • C:\Users\Admin\AppData\Local\Temp\Sake

      Filesize

      57KB

      MD5

      d2e88e9a1e84adb4b2cd36ea2ffe474e

      SHA1

      c3302ebd865399e75abf44c43cda3652673d35c0

      SHA256

      de178d850d69153a46ba9ef54e59d69e1771f18b639bd3942ee8f4dfc3fc577f

      SHA512

      60f22a805361fb4debee045b50de856259183d3fee71ac9cbf05efdce54d2f78941029db86eb3d19590363e145dda46b525d68b6fdaf883d14ea432af3d84198

    • C:\Users\Admin\AppData\Local\Temp\Sucking

      Filesize

      75KB

      MD5

      deac902709c1db93008ecf6a576a28e3

      SHA1

      40e66900ae8030e4af929b954b964f8a919e87da

      SHA256

      251e10b34683ffcb11236d1f053d7f95a6187dc2d036829a8fbfc369df6007df

      SHA512

      49e3b1269403f06d1c9b920ee5f0e4ae53a3b8c6335225f34d83036bb3bf0aedf03f526b769ddda682c81ba16baa946e93200c2393a23d08efaa221cb28dda05

    • C:\Users\Admin\AppData\Local\Temp\Sum

      Filesize

      68KB

      MD5

      11f85cc6b71e46a9dd3f0335389b2b28

      SHA1

      64911f3b3fd6bbc3c9ebb24150fa3c84ad0a0d35

      SHA256

      a64d3b96baffec7914c57ff00a3ea4442122d5ae5172aaf9de950fdc85d97988

      SHA512

      5c7591e1d247aa0618d28fadf89d45a8404c7674c2e9f211bbc97ddaf90537e3be6e529049bf63ff70bc5dd5907d05e49b345140ec2ec689ac93f8c510bfc80a

    • C:\Users\Admin\AppData\Local\Temp\Upset

      Filesize

      76KB

      MD5

      0de0c37358fcc69dc27f2b2a4d9a0a6f

      SHA1

      73252fad569a557d48c914197b68d4d6cac1b338

      SHA256

      f7f9e3b0e36ae01a389bd977ba50ddbc30b4fe8bcf48252e35cf6522e03745b7

      SHA512

      781715c0d341bf7e0a400be3fea78b409213318eb07d2e70a3eb351a2b6c659356d1a38b22c4a4024ccf0c33b78c197fb13024d309076e4663b68db4c915f8b3

    • C:\Users\Admin\AppData\Local\Temp\Wallace

      Filesize

      51KB

      MD5

      5a8423517ba5970a230ff275b891acd1

      SHA1

      c0b1a3eef833bc748e18088dd01b3315349c0fc3

      SHA256

      73682c353ab37fc9939b36a00d5c664d4b8ca211e5ba283f0bf665126e76e5b6

      SHA512

      5443abcab48dc53633f14341324875c34fd725ec20b980c72e875b122e699e4b8e8eaf5b316fd1e99e5fa165c8c3a7fb481433a4ebbfbb1e451096047d8caff2

    • memory/2652-308-0x00000000046F0000-0x000000000476F000-memory.dmp

      Filesize

      508KB

    • memory/2652-310-0x00000000046F0000-0x000000000476F000-memory.dmp

      Filesize

      508KB

    • memory/2652-313-0x00000000046F0000-0x000000000476F000-memory.dmp

      Filesize

      508KB

    • memory/2652-312-0x00000000046F0000-0x000000000476F000-memory.dmp

      Filesize

      508KB

    • memory/2652-311-0x00000000046F0000-0x000000000476F000-memory.dmp

      Filesize

      508KB

    • memory/2652-314-0x00000000046F0000-0x000000000476F000-memory.dmp

      Filesize

      508KB

    • memory/2652-318-0x00000000046F0000-0x000000000476F000-memory.dmp

      Filesize

      508KB

    • memory/2652-317-0x00000000046F0000-0x000000000476F000-memory.dmp

      Filesize

      508KB

    • memory/2652-323-0x00000000046F0000-0x000000000476F000-memory.dmp

      Filesize

      508KB

    • memory/2652-309-0x00000000046F0000-0x000000000476F000-memory.dmp

      Filesize

      508KB

    • memory/2652-329-0x00000000046F0000-0x000000000476F000-memory.dmp

      Filesize

      508KB

    • memory/2652-336-0x00000000046F0000-0x000000000476F000-memory.dmp

      Filesize

      508KB

    • memory/2652-341-0x00000000046F0000-0x000000000476F000-memory.dmp

      Filesize

      508KB

    • memory/2652-347-0x00000000046F0000-0x000000000476F000-memory.dmp

      Filesize

      508KB

    • memory/2652-349-0x00000000046F0000-0x000000000476F000-memory.dmp

      Filesize

      508KB

    • memory/2652-354-0x00000000046F0000-0x000000000476F000-memory.dmp

      Filesize

      508KB

    • memory/2652-361-0x00000000046F0000-0x000000000476F000-memory.dmp

      Filesize

      508KB

    • memory/2652-366-0x00000000046F0000-0x000000000476F000-memory.dmp

      Filesize

      508KB

    • memory/2652-373-0x00000000046F0000-0x000000000476F000-memory.dmp

      Filesize

      508KB

    • memory/2652-379-0x00000000046F0000-0x000000000476F000-memory.dmp

      Filesize

      508KB

    • memory/2652-380-0x00000000046F0000-0x000000000476F000-memory.dmp

      Filesize

      508KB

    • memory/2652-385-0x00000000046F0000-0x000000000476F000-memory.dmp

      Filesize

      508KB

    • memory/2652-391-0x00000000046F0000-0x000000000476F000-memory.dmp

      Filesize

      508KB