remcos | dfa62653c2606c14be6b244fdc19c07c2d31fe4553f2cebba08c972e92f27434

Analysis

max time kernel
149s
max time network
154s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NWAA.exe
Size 342KB
Sample201109-wbejdslys6
SHA256 dfa62653c2606c14be6b244fdc19c07c2d31fe4553f2cebba08c972e92f27434
MD5 2e3c900b4bebe6456c4ebb313abc7fa8
SHA1 cd712b5d86081e3b1fc79930186900a3fd2f5c1c
SHA512 ba5ac0f69a503c0b35e06febd46d14c8abdbf475c80666fef178389b22c7597386f9f32ed871da1bb2c61f25c23c82006199f27dfd7cd6e6e5e49c493b062016
MD5 SHA1 SHA512

Score

10^/10

remcos agilenet persistence rat

Malware Config

Extracted

Family

remcos

noapology.myq-see.com:5149

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
4444	remcos.exe
4488	remcos.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/memory/4672-3-0x00000000053D0000-0x00000000053DE000-memory.dmp	agile_net

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\	NWAA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\remoteaccess = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc\\remcos.exe\""	NWAA.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\remoteaccess = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc\\remcos.exe\""	remcos.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4672 set thread context of 1852	4672	NWAA.exe	78
PID 4444 set thread context of 4488	4444	remcos.exe	83

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings	NWAA.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4672	NWAA.exe
4672	NWAA.exe
4672	NWAA.exe
4444	remcos.exe
4444	remcos.exe
4444	remcos.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4672	NWAA.exe
Token: SeDebugPrivilege	4444	remcos.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4488	remcos.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 1852	4672	NWAA.exe	78
PID 4672 wrote to memory of 1852	4672	NWAA.exe	78
PID 4672 wrote to memory of 1852	4672	NWAA.exe	78
PID 4672 wrote to memory of 1852	4672	NWAA.exe	78
PID 4672 wrote to memory of 1852	4672	NWAA.exe	78
PID 4672 wrote to memory of 1852	4672	NWAA.exe	78
PID 4672 wrote to memory of 1852	4672	NWAA.exe	78
PID 4672 wrote to memory of 1852	4672	NWAA.exe	78
PID 4672 wrote to memory of 1852	4672	NWAA.exe	78
PID 4672 wrote to memory of 1852	4672	NWAA.exe	78
PID 1852 wrote to memory of 4284	1852	NWAA.exe	79
PID 1852 wrote to memory of 4284	1852	NWAA.exe	79
PID 1852 wrote to memory of 4284	1852	NWAA.exe	79
PID 4284 wrote to memory of 4300	4284	WScript.exe	80
PID 4284 wrote to memory of 4300	4284	WScript.exe	80
PID 4284 wrote to memory of 4300	4284	WScript.exe	80
PID 4300 wrote to memory of 4444	4300	cmd.exe	82
PID 4300 wrote to memory of 4444	4300	cmd.exe	82
PID 4300 wrote to memory of 4444	4300	cmd.exe	82
PID 4444 wrote to memory of 4488	4444	remcos.exe	83
PID 4444 wrote to memory of 4488	4444	remcos.exe	83
PID 4444 wrote to memory of 4488	4444	remcos.exe	83
PID 4444 wrote to memory of 4488	4444	remcos.exe	83
PID 4444 wrote to memory of 4488	4444	remcos.exe	83
PID 4444 wrote to memory of 4488	4444	remcos.exe	83
PID 4444 wrote to memory of 4488	4444	remcos.exe	83
PID 4444 wrote to memory of 4488	4444	remcos.exe	83
PID 4444 wrote to memory of 4488	4444	remcos.exe	83
PID 4444 wrote to memory of 4488	4444	remcos.exe	83

C:\Users\Admin\AppData\Local\Temp\NWAA.exe
"C:\Users\Admin\AppData\Local\Temp\NWAA.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Users\Admin\AppData\Local\Temp\NWAA.exe
  "C:\Users\Admin\AppData\Local\Temp\NWAA.exe"
  2⤵
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4284
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\vlc\remcos.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4300
    - - C:\Users\Admin\AppData\Roaming\vlc\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\vlc\remcos.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4444
      - C:\Users\Admin\AppData\Roaming\vlc\remcos.exe
        
        "C:\Users\Admin\AppData\Roaming\vlc\remcos.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:4488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1852-10-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1852-12-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4444-19-0x0000000073900000-0x0000000073FEE000-memory.dmp

Download

memory/4672-5-0x0000000005500000-0x0000000005502000-memory.dmp

Download

memory/4672-6-0x0000000005600000-0x0000000005601000-memory.dmp

Download

memory/4672-0-0x0000000073900000-0x0000000073FEE000-memory.dmp

Download

memory/4672-4-0x0000000005A10000-0x0000000005A11000-memory.dmp

Download

memory/4672-9-0x0000000006650000-0x0000000006651000-memory.dmp

Download

memory/4672-3-0x00000000053D0000-0x00000000053DE000-memory.dmp

Download

memory/4672-8-0x00000000058B0000-0x00000000058B1000-memory.dmp

Download

memory/4672-7-0x0000000005710000-0x0000000005712000-memory.dmp

Download

memory/4672-1-0x0000000000B10000-0x0000000000B11000-memory.dmp

Download