Analysis
-
max time kernel
177s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-01-2025 12:34
General
-
Target
Purchase Order27112024.scr
-
Size
660KB
-
MD5
5e1c814fc675448c381899d325aba145
-
SHA1
46a9e1b34f90d4be128fc1b6f1d698d79c93297b
-
SHA256
bf065b1f51eb32228108a6508ff649143a97526a06b27fa6771a85246b162f84
-
SHA512
ea3befc73db84c42834e59198f5dd416b738c33fd1105384ff87031205888a018da7d124582d25ed8a8cea8567ef07051d1ee6fa77fe4c4b74688bcaa1e88338
-
SSDEEP
12288:ORqeNjN24O1o46FW+iLOWIRKiKuI+v8nbDVJNtjzFwZnayIjYa9iXb8TOM:Ejoo7W+1WU2Y0nPVJNJlTYXYiM
Malware Config
Extracted
remcos
RemoteHost
mynewpro.online:2404
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-B4UZRV
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos
Remcos is a closed-source remote control and surveillance software.
-
Remcos family
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order27112024.scr"C:\Users\Admin\AppData\Local\Temp\Purchase Order27112024.scr" /S1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order27112024.scr"C:\Users\Admin\AppData\Local\Temp\Purchase Order27112024.scr" /S2⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order27112024.scr"Purchase Order27112024.scr"2⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order27112024.scr"Purchase Order27112024.scr"3⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SDRSVC1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
734B
MD5e192462f281446b5d1500d474fbacc4b
SHA15ed0044ac937193b78f9878ad7bac5c9ff7534ff
SHA256f1ba9f1b63c447682ebf9de956d0da2a027b1b779abef9522d347d3479139a60
SHA512cc69a761a4e8e1d4bf6585aa8e3e5a7dfed610f540a6d43a288ebb35b16e669874ed5d2b06756ee4f30854f6465c84ee423502fc5b67ee9e7758a2dab41b31d3
-
Filesize
192B
MD5f861c1755ee8ef25934c506b991e0153
SHA1450054750332e73ee4293867e9bd330a53e4b75c
SHA25689561d201fa46dacf5dc0d22942655932247b147bdc65020a824474e25549e7a
SHA5124ab81f837b2a097c75ac008cea2bccefdb9b578eb6a26940f43a20c533e47809522efb8fad32ed0a52a0e1a2dea399da2ec3f47de2c5e75500a93527ea0993d5
-
Filesize
96B
MD5545554c4429dcf84aa817dbf398a231a
SHA16dc5431f0cb93cef3c3acf6e551b32145d9d4b31
SHA256408da71e53292ddb4c3a8481c34dfb74e652ff1d1d8870dc38658b1a27d9f9ef
SHA512f18ad305a1db6023054c9e5a1d5812487a630ca68e6e9de93175c460554b9b7179986b24874d9baca18c843852838b45af7d3710ba5a1cda73c041821fc0b8e2
-
Filesize
74B
MD5d4d66db71f7a9cb8c9ed31779113a77f
SHA1a9f0e41992f0c9e017d54269371379fa1e7cef15
SHA256f8536748b100429ea636ac348f3f2594ddcffa753d459c5e40b7d5ce7b68f85b
SHA512555fa7c5f51b8c5db53b275c6cfe613bffd60c7fa8089c80f9c70b93512d0172f58300749f8071670dc7f0d9813596086a25704f14909964771d49c17aeb9878
-
Filesize
11KB
MD53e6bf00b3ac976122f982ae2aadb1c51
SHA1caab188f7fdc84d3fdcb2922edeeb5ed576bd31d
SHA2564ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe
SHA5121286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706
-
Filesize
660KB
MD5f6ea580a4f4b7ecdd2be034d74338251
SHA102cfed15b2b0b8fae60e860fa057b0a4f4289175
SHA25644b6505169140d674daaf1a76cb3ecd7ed329462d66973b1643fddd3c291aa57
SHA5121d470197e7e717ea5d0d1a8e2fb471f46f51d40373779c1dc32e1d0bcddfbbbb36f9814c386f7b5edbff18d1878f665f0c19a6d471b07fa89595904c4fc8cc7b
-
Filesize
27B
MD57ab6006a78c23c5dec74c202b85a51a4
SHA1c0ff9305378be5ec16a18127c171bb9f04d5c640
SHA256bddcbc9f6e35e10fa203e176d28cdb86ba3add97f2cffd2bda7a335b1037b71d
SHA51240464f667e1cdf9d627642be51b762245fa62097f09d3739bf94728bc9337e8a296ce4ac18380b1aed405adb72435a2cd915e3bc37f6840f34781028f3d8aed6
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
4KB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
1.1MB
-
Filesize
18.3MB
-
Filesize
1.1MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
1.1MB
-
Filesize
18.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB