Overview
overview
10Static
static
3TaxOrganizer24.exe
windows7-x64
10TaxOrganizer24.exe
windows10-2004-x64
10libcrypto-1_1-x64.dll
windows7-x64
1libcrypto-1_1-x64.dll
windows10-2004-x64
1libcurl-4.dll
windows7-x64
1libcurl-4.dll
windows10-2004-x64
1libiconv-2.dll
windows7-x64
10libiconv-2.dll
windows10-2004-x64
10libintl-8.dll
windows7-x64
1libintl-8.dll
windows10-2004-x64
1libpcre2-8-0.dll
windows7-x64
1libpcre2-8-0.dll
windows10-2004-x64
1libssp-0.dll
windows7-x64
1libssp-0.dll
windows10-2004-x64
1msvcp144.dll
windows7-x64
4msvcp144.dll
windows10-2004-x64
4vcruntime211.dll
windows7-x64
1vcruntime211.dll
windows10-2004-x64
1zlib1.dll
windows7-x64
1zlib1.dll
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
06-02-2025 09:58
Static task
static1
Behavioral task
behavioral1
Sample
TaxOrganizer24.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
TaxOrganizer24.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
libcrypto-1_1-x64.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
libcrypto-1_1-x64.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
libcurl-4.dll
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral6
Sample
libcurl-4.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
libiconv-2.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
libiconv-2.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
libintl-8.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
libintl-8.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
libpcre2-8-0.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
libpcre2-8-0.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
libssp-0.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral14
Sample
libssp-0.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
msvcp144.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
msvcp144.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
vcruntime211.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
vcruntime211.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
zlib1.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
zlib1.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
General
-
Target
libiconv-2.dll
-
Size
2.4MB
-
MD5
02aaf0ef4140a80669e21c35547e0520
-
SHA1
8949f73b8ef36037f80a6b54d1f0280ac87647fb
-
SHA256
adacf7b709443ec0e4f479c33a6d9101f55d342e1b517c048f5440cd0862b76f
-
SHA512
1f5baeb5651632831836e02a28a2cfcc281f59943b89cf115bdf4fd98daf2752e238de6623e3336611d36d64b15bef1225a1921d17bd94678bc9895bfaa7b6a7
-
SSDEEP
49152:8ymzJaUsHOsxGYPJ1xNIsCFOXGCaDiO6eadE1MRvk/ATlEHS9:+Ybxqw+H
Malware Config
Extracted
remcos
RemoteHost
bangerr.duckdns.org:1012
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-Z95DP4
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Remcos family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4116 set thread context of 2228 4116 rundll32.exe 87 -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\cabapi.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\dggpext.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\@WindowsUpdateToastIcon.png rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\AppExtension.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\certmgr.msc rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\chxinputrouter.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\csplte.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\dimsroam.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\authentication.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\btpanui.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\diagtrack.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\avrt.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\cfgmgr32.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\BOOTVID.DLL rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\BthRadioMedia.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\AppVStreamingUX.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\coredpussvr.exe rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\cipher.exe rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\credprovslegacy.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\C_21027.NLS rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\DeviceReactivation.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\ApplySettingsTemplateCatalog.exe rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\AudioHandlers.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\BluetoothApis.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\cmcfg32.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\computecore.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\C_1148.NLS rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\d3d8thk.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\amstream.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\BluetoothSystemToastIcon.contrast-white.png rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\CfgSPPolicy.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\CoreShellAPI.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\adsldp.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\AppVShNotify.exe rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\BingMaps.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\bootux.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Chakra.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\ChtBopomofoDS.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\CloudExperienceHostBroker.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\cfmifsproxy.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\CredDialogBroker.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\deploymentcsphelper.exe rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\APHostService.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\AppMon.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\apprepapi.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\bcdprov.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\certcli.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\CertPKICmdlet.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\chkntfs.exe rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\C_20949.NLS rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\CastLaunch.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\C_10082.NLS rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\C_932.NLS rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\cimfs.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\C_21866.NLS rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Direct2DDesktop.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\auditpolmsg.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\BioCredProv.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\CapabilityAccessHandlers.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\CloudNotifications.exe rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\ConsentUX.dll rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\C_1140.NLS rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\C_855.NLS rundll32.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\dafBth.dll rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aspnet_wp.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4116 rundll32.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4116 wrote to memory of 2228 4116 rundll32.exe 87 PID 4116 wrote to memory of 2228 4116 rundll32.exe 87 PID 4116 wrote to memory of 2228 4116 rundll32.exe 87 PID 4116 wrote to memory of 2228 4116 rundll32.exe 87 PID 4116 wrote to memory of 2228 4116 rundll32.exe 87 PID 4116 wrote to memory of 2228 4116 rundll32.exe 87 PID 4116 wrote to memory of 2228 4116 rundll32.exe 87 PID 4116 wrote to memory of 2228 4116 rundll32.exe 87 PID 4116 wrote to memory of 2228 4116 rundll32.exe 87 PID 4116 wrote to memory of 2228 4116 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\libiconv-2.dll,#11⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2228
-