Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
HUDGEWS2352ERFQ.exe

Overview

General Information

Sample name:HUDGEWS2352ERFQ.exe
Analysis ID:1471529
MD5:8f251ec69c2faae7090b2bf78cfd4881
SHA1:8cdc6e16ad2adcbb3002b772d05e78a725be2c9a
SHA256:c008880967c64851e47f97ca7ed5a9f8d2029dd87b3ae6eb77f19c43d8fefd89
Tags:exeRATRemcosRAT
Infos:

Detection

Remcos
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to bypass UAC (CMSTPLUA)
Detected Remcos RAT
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Remcos
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic
Yara detected AntiVM3
Yara detected Remcos RAT
Yara detected UAC Bypass using CMSTP
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Contains functionality to register a low level keyboard hook
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Firefox passwords or cookies
Contains functionalty to change the wallpaper
Delayed program exit found
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Uses schtasks.exe or at.exe to add and modify task schedules
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to download and launch executables
Contains functionality to dynamically determine API calls
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to launch a control a shell (cmd.exe)
Contains functionality to modify clipboard data
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Schtasks From Env Var Folder
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

  • System is w10x64
  • HUDGEWS2352ERFQ.exe (PID: 6664 cmdline: "C:\Users\user\Desktop\HUDGEWS2352ERFQ.exe" MD5: 8F251EC69C2FAAE7090B2BF78CFD4881)
    • powershell.exe (PID: 5676 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\HUDGEWS2352ERFQ.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 3264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WmiPrvSE.exe (PID: 7420 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
    • powershell.exe (PID: 5796 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\RAFUlP.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 6344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • schtasks.exe (PID: 2596 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RAFUlP" /XML "C:\Users\user\AppData\Local\Temp\tmp53B5.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 3368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • HUDGEWS2352ERFQ.exe (PID: 7268 cmdline: "C:\Users\user\Desktop\HUDGEWS2352ERFQ.exe" MD5: 8F251EC69C2FAAE7090B2BF78CFD4881)
  • RAFUlP.exe (PID: 7380 cmdline: C:\Users\user\AppData\Roaming\RAFUlP.exe MD5: 8F251EC69C2FAAE7090B2BF78CFD4881)
    • schtasks.exe (PID: 7584 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RAFUlP" /XML "C:\Users\user\AppData\Local\Temp\tmp6112.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)
      • conhost.exe (PID: 7592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • RAFUlP.exe (PID: 7640 cmdline: "C:\Users\user\AppData\Roaming\RAFUlP.exe" MD5: 8F251EC69C2FAAE7090B2BF78CFD4881)
  • cleanup
NameDescriptionAttributionBlogpost URLsLink
Remcos, RemcosRATRemcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
  • UAC-0050
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos
{"Host:Port:Password": "45.66.231.218:4259:0", "Assigned name": "THEONE", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-UII1DP", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}
SourceRuleDescriptionAuthorStrings
C:\ProgramData\remcos\logs.datJoeSecurity_RemcosYara detected Remcos RATJoe Security
    SourceRuleDescriptionAuthorStrings
    00000008.00000002.4118577302.0000000001127000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
      00000008.00000002.4119330069.0000000002E7F000.00000004.00000010.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
        0000000D.00000002.1714210948.0000000000EC7000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
          00000008.00000002.4118577302.000000000115E000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
            0000000D.00000002.1713657358.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
              Click to see the 22 entries
              SourceRuleDescriptionAuthorStrings
              0.2.HUDGEWS2352ERFQ.exe.4169790.1.unpackJoeSecurity_RemcosYara detected Remcos RATJoe Security
                0.2.HUDGEWS2352ERFQ.exe.4169790.1.unpackJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
                  0.2.HUDGEWS2352ERFQ.exe.4169790.1.unpackWindows_Trojan_Remcos_b296e965unknownunknown
                  • 0x690a8:$a1: Remcos restarted by watchdog!
                  • 0x69620:$a3: %02i:%02i:%02i:%03i
                  0.2.HUDGEWS2352ERFQ.exe.4169790.1.unpackREMCOS_RAT_variantsunknownunknown
                  • 0x630fc:$str_a1: C:\Windows\System32\cmd.exe
                  • 0x63078:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
                  • 0x63078:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
                  • 0x63578:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
                  • 0x63da8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
                  • 0x6316c:$str_b2: Executing file:
                  • 0x641ec:$str_b3: GetDirectListeningPort
                  • 0x63b98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
                  • 0x63d18:$str_b7: \update.vbs
                  • 0x63194:$str_b9: Downloaded file:
                  • 0x63180:$str_b10: Downloading file:
                  • 0x63224:$str_b12: Failed to upload file:
                  • 0x641b4:$str_b13: StartForward
                  • 0x641d4:$str_b14: StopForward
                  • 0x63c70:$str_b15: fso.DeleteFile "
                  • 0x63c04:$str_b16: On Error Resume Next
                  • 0x63ca0:$str_b17: fso.DeleteFolder "
                  • 0x63214:$str_b18: Uploaded file:
                  • 0x631d4:$str_b19: Unable to delete:
                  • 0x63c38:$str_b20: while fso.FileExists("
                  • 0x636b1:$str_c0: [Firefox StoredLogins not found]
                  0.2.HUDGEWS2352ERFQ.exe.4169790.1.unpackINDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOMDetects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)ditekSHen
                  • 0x62fe8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                  • 0x62f7c:$s1: CoGetObject
                  • 0x62f90:$s1: CoGetObject
                  • 0x62fac:$s1: CoGetObject
                  • 0x6cf38:$s1: CoGetObject
                  • 0x62f3c:$s2: Elevation:Administrator!new: