Analysis

  • max time kernel
    115s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    26-12-2024 03:37

General

  • Target

    88586521287a64331eb275b700110ff4fae5884e8a62655fe88cae71d59cb73cN.exe

  • Size

    140KB

  • MD5

    26ef5428d0ca17146002a3cea5b96810

  • SHA1

    c2e9289ff3932e602884ce4d1f03f0fde8c2e67a

  • SHA256

    88586521287a64331eb275b700110ff4fae5884e8a62655fe88cae71d59cb73c

  • SHA512

    795bdcb328f09ff8c1f5f2934fd104c8865f1ac744bac01d988def996ce7a521139d8a686bb7bd8f6ceda74891ab560c96b86d09f0fc62ca6f98d003b0758c77

  • SSDEEP

    3072:xPd4n/M+WLcilrpgGH/GwY87mVmIXhIHVSJ:xP6/M+WLckOBhVmIYI

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

systemcontrol.ddns.net:45000

systemcontrol2.ddns.net:45000

Attributes
  • audio_folder

    audio

  • audio_path

    %AppData%

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    5

  • copy_file

    OfficeUpgrade.exe

  • copy_folder

    OfficeUpgrade

  • delete_file

    false

  • hide_file

    true

  • hide_keylog_file

    true

  • install_flag

    false

  • install_path

    %AppData%

  • keylog_crypt

    true

  • keylog_file

    Upgrader.dat

  • keylog_flag

    false

  • keylog_folder

    Upgrader

  • keylog_path

    %AppData%

  • mouse_option

    false

  • mutex

    req_khauflaoyr

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screens

  • screenshot_path

    %AppData%

  • screenshot_time

    1

  • startup_value

    OfficeUpgrade

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\88586521287a64331eb275b700110ff4fae5884e8a62655fe88cae71d59cb73cN.exe
    "C:\Users\Admin\AppData\Local\Temp\88586521287a64331eb275b700110ff4fae5884e8a62655fe88cae71d59cb73cN.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2944
    • C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe
      "C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2720
      • C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe
        "C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2576

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe

    Filesize

    140KB

    MD5

    8329081c1a1b90cfd052330f631eb1d6

    SHA1

    c754a6bde7b565b3cef79a1d0af124c58beca29d

    SHA256

    007b86d95e19cbacca81c2718dc84094180579a0f4961e8f30389cbe08821cd8

    SHA512

    8867d3647141a19a787165a34c17ced9918da6ad7b4d52e2046d7af36ba2c2b8542843f8194598561fafb9d1a47cf70f44fe8eb056c3be39ef57513552c7a514

  • memory/2576-24-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2576-40-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2576-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2576-21-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2576-36-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2576-19-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2576-37-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2576-27-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2576-30-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2576-17-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2576-45-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/2720-42-0x0000000073EF0000-0x00000000745DE000-memory.dmp

    Filesize

    6.9MB

  • memory/2720-13-0x00000000013A0000-0x00000000013C8000-memory.dmp

    Filesize

    160KB

  • memory/2720-14-0x0000000073EF0000-0x00000000745DE000-memory.dmp

    Filesize

    6.9MB

  • memory/2720-41-0x0000000073EF0000-0x00000000745DE000-memory.dmp

    Filesize

    6.9MB

  • memory/2720-16-0x0000000073EF0000-0x00000000745DE000-memory.dmp

    Filesize

    6.9MB

  • memory/2944-15-0x0000000073EF0000-0x00000000745DE000-memory.dmp

    Filesize

    6.9MB

  • memory/2944-0-0x0000000073EFE000-0x0000000073EFF000-memory.dmp

    Filesize

    4KB

  • memory/2944-3-0x0000000000560000-0x0000000000580000-memory.dmp

    Filesize

    128KB

  • memory/2944-2-0x0000000073EF0000-0x00000000745DE000-memory.dmp

    Filesize

    6.9MB

  • memory/2944-12-0x0000000073EFE000-0x0000000073EFF000-memory.dmp

    Filesize

    4KB

  • memory/2944-1-0x0000000000CB0000-0x0000000000CD8000-memory.dmp

    Filesize

    160KB