Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
14/01/2025, 13:55
General
- Target inward_payment_confirmation_reference_Z1766053541_notifications.bat.exe
- Size 537KB
- Sample250114-q737ma1req
- SHA256 e075807417590255de4d395fa3dfbc336e88c96bbab8afca1d5e5d5abbac0237
Malware Config
Extracted
-
remcos
-
Manifest
-
linktreewealth.zapto.org:3980
-
linktreewealth.zapto.org:3981
-
linktreewealthy.zapto.org:3980
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-0B1XIG
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Extracted
-
latentbot
-
linktreewealth.zapto.org
Signatures
- LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
- Latentbot family
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Remcos family
- Detected Nirsoft tools 7 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
- NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: MapViewOfSection 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\inward_payment_confirmation_reference_Z1766053541_notifications.bat.exe"C:\Users\Admin\AppData\Local\Temp\inward_payment_confirmation_reference_Z1766053541_notifications.bat.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\inward_payment_confirmation_reference_Z1766053541_notifications.bat.exe"C:\Users\Admin\AppData\Local\Temp\inward_payment_confirmation_reference_Z1766053541_notifications.bat.exe"2⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\inward_payment_confirmation_reference_Z1766053541_notifications.bat.exeC:\Users\Admin\AppData\Local\Temp\inward_payment_confirmation_reference_Z1766053541_notifications.bat.exe /stext "C:\Users\Admin\AppData\Local\Temp\zsdrdvxwymmoeoc"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\inward_payment_confirmation_reference_Z1766053541_notifications.bat.exeC:\Users\Admin\AppData\Local\Temp\inward_payment_confirmation_reference_Z1766053541_notifications.bat.exe /stext "C:\Users\Admin\AppData\Local\Temp\cmijenhquuetocrrzq"3⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\inward_payment_confirmation_reference_Z1766053541_notifications.bat.exeC:\Users\Admin\AppData\Local\Temp\inward_payment_confirmation_reference_Z1766053541_notifications.bat.exe /stext "C:\Users\Admin\AppData\Local\Temp\mpvuxgssicwfqjnvitnxdg"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
logs.dat
System.dll
zsdrdvxwymmoeoc
memory/2596-74-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-17-0x0000000076F51000-0x0000000077071000-memory.dmp
memory/2596-24-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-27-0x0000000076F51000-0x0000000077071000-memory.dmp
memory/2596-28-0x0000000000433000-0x0000000000434000-memory.dmp
memory/2596-29-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-30-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-31-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-32-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-33-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-34-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-35-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-36-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-37-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-38-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-39-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-40-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-41-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-42-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-44-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-45-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-46-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-47-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-48-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-49-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-50-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-51-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-52-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-53-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-54-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-55-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-56-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-57-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-15-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-19-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-105-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-104-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-103-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-102-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-101-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-100-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-99-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-98-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-97-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-96-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-95-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-82-0x00000000068C0000-0x00000000068D9000-memory.dmp
memory/2596-16-0x0000000076FD8000-0x0000000076FD9000-memory.dmp
memory/2596-86-0x00000000068C0000-0x00000000068D9000-memory.dmp
memory/2596-85-0x00000000068C0000-0x00000000068D9000-memory.dmp
memory/2596-87-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-89-0x0000000076F51000-0x0000000077071000-memory.dmp
memory/2596-92-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2596-94-0x0000000000400000-0x0000000001654000-memory.dmp
memory/2700-71-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2700-70-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2700-69-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2700-68-0x0000000000400000-0x0000000000424000-memory.dmp
memory/2904-61-0x0000000000400000-0x0000000000462000-memory.dmp
memory/2904-63-0x0000000000400000-0x0000000000462000-memory.dmp
memory/2904-62-0x0000000000400000-0x0000000000462000-memory.dmp
memory/2904-67-0x0000000000400000-0x0000000000462000-memory.dmp
memory/3496-80-0x0000000000400000-0x0000000000478000-memory.dmp
memory/3496-58-0x0000000000400000-0x0000000000478000-memory.dmp
memory/3496-60-0x0000000000400000-0x0000000000478000-memory.dmp
memory/3496-59-0x0000000000400000-0x0000000000478000-memory.dmp
memory/4920-12-0x0000000076F51000-0x0000000077071000-memory.dmp
memory/4920-13-0x0000000076F51000-0x0000000077071000-memory.dmp
memory/4920-14-0x00000000743F5000-0x00000000743F6000-memory.dmp