remcos | 1632fb66124c756cf322fd6dc71425fc05ff8f41dbb8f4985cfc15192caf4cf3

Analysis

max time kernel
78s
max time network
142s
platform
windows10_x64
resource
win10v20210410
submitted
04/07/2021, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
67fea9924acd6609b05ab7f729f3cee0.exe
Size 670KB
Sample210704-xy92pc81cs
SHA256 1632fb66124c756cf322fd6dc71425fc05ff8f41dbb8f4985cfc15192caf4cf3
MD5 67fea9924acd6609b05ab7f729f3cee0
SHA1 17d293b245ab5a1aec6bda207ea5c658501a52af
SHA512 3578f51485ebecab3b299c486a3f4ce25829d90ca22f742837253976ff09f761675eb9615adfbf55eec40bcc56317d887b825576a749b92249df77306fbcd9d4
MD5 SHA1 SHA512

Score

10^/10

remcos host persistence rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

accessgranted.ydns.eu:2404

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
conhosts.exe
copy_folder
office
delete_file
false
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
remcos_mrpexdygxj
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
3836	conhosts.exe
2504	conhosts.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\	67fea9924acd6609b05ab7f729f3cee0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\office\\conhosts.exe\""	67fea9924acd6609b05ab7f729f3cee0.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\	conhosts.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\office\\conhosts.exe\""	conhosts.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1496 set thread context of 4048	1496	67fea9924acd6609b05ab7f729f3cee0.exe	81
PID 3836 set thread context of 2504	3836	conhosts.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3984	schtasks.exe
2868	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1000	PING.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2504	conhosts.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 3984	1496	67fea9924acd6609b05ab7f729f3cee0.exe	79
PID 1496 wrote to memory of 3984	1496	67fea9924acd6609b05ab7f729f3cee0.exe	79
PID 1496 wrote to memory of 3984	1496	67fea9924acd6609b05ab7f729f3cee0.exe	79
PID 1496 wrote to memory of 4048	1496	67fea9924acd6609b05ab7f729f3cee0.exe	81
PID 1496 wrote to memory of 4048	1496	67fea9924acd6609b05ab7f729f3cee0.exe	81
PID 1496 wrote to memory of 4048	1496	67fea9924acd6609b05ab7f729f3cee0.exe	81
PID 1496 wrote to memory of 4048	1496	67fea9924acd6609b05ab7f729f3cee0.exe	81
PID 1496 wrote to memory of 4048	1496	67fea9924acd6609b05ab7f729f3cee0.exe	81
PID 1496 wrote to memory of 4048	1496	67fea9924acd6609b05ab7f729f3cee0.exe	81
PID 1496 wrote to memory of 4048	1496	67fea9924acd6609b05ab7f729f3cee0.exe	81
PID 1496 wrote to memory of 4048	1496	67fea9924acd6609b05ab7f729f3cee0.exe	81
PID 1496 wrote to memory of 4048	1496	67fea9924acd6609b05ab7f729f3cee0.exe	81
PID 4048 wrote to memory of 2340	4048	67fea9924acd6609b05ab7f729f3cee0.exe	82
PID 4048 wrote to memory of 2340	4048	67fea9924acd6609b05ab7f729f3cee0.exe	82
PID 4048 wrote to memory of 2340	4048	67fea9924acd6609b05ab7f729f3cee0.exe	82
PID 2340 wrote to memory of 1000	2340	cmd.exe	84
PID 2340 wrote to memory of 1000	2340	cmd.exe	84
PID 2340 wrote to memory of 1000	2340	cmd.exe	84
PID 2340 wrote to memory of 3836	2340	cmd.exe	85
PID 2340 wrote to memory of 3836	2340	cmd.exe	85
PID 2340 wrote to memory of 3836	2340	cmd.exe	85
PID 3836 wrote to memory of 2868	3836	conhosts.exe	86
PID 3836 wrote to memory of 2868	3836	conhosts.exe	86
PID 3836 wrote to memory of 2868	3836	conhosts.exe	86
PID 3836 wrote to memory of 2504	3836	conhosts.exe	88
PID 3836 wrote to memory of 2504	3836	conhosts.exe	88
PID 3836 wrote to memory of 2504	3836	conhosts.exe	88
PID 3836 wrote to memory of 2504	3836	conhosts.exe	88
PID 3836 wrote to memory of 2504	3836	conhosts.exe	88
PID 3836 wrote to memory of 2504	3836	conhosts.exe	88
PID 3836 wrote to memory of 2504	3836	conhosts.exe	88
PID 3836 wrote to memory of 2504	3836	conhosts.exe	88
PID 3836 wrote to memory of 2504	3836	conhosts.exe	88

C:\Users\Admin\AppData\Local\Temp\67fea9924acd6609b05ab7f729f3cee0.exe
"C:\Users\Admin\AppData\Local\Temp\67fea9924acd6609b05ab7f729f3cee0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ByPWkGleuQGAh" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB348.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3984
- C:\Users\Admin\AppData\Local\Temp\67fea9924acd6609b05ab7f729f3cee0.exe
  "{path}"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\Windows\SysWOW64\PING.EXE
      PING 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:1000
  - - C:\Users\Admin\AppData\Roaming\office\conhosts.exe
      "C:\Users\Admin\AppData\Roaming\office\conhosts.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:3836
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ByPWkGleuQGAh" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4AD5.tmp"
        5⤵
        Creates scheduled task(s)
        
        PID:2868
    - - C:\Users\Admin\AppData\Roaming\office\conhosts.exe
        
        "{path}"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:2504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1496-121-0x00000000057E0000-0x0000000005CDE000-memory.dmp

Download

memory/1496-114-0x0000000000F50000-0x0000000000F51000-memory.dmp

Download

memory/1496-118-0x0000000005850000-0x0000000005851000-memory.dmp

Download

memory/1496-122-0x0000000007A40000-0x0000000007AC7000-memory.dmp

Download

memory/1496-116-0x0000000005CE0000-0x0000000005CE1000-memory.dmp

Download

memory/1496-123-0x0000000007B20000-0x0000000007B5B000-memory.dmp

Download

memory/1496-119-0x00000000059B0000-0x00000000059B2000-memory.dmp

Download

memory/1496-117-0x0000000005880000-0x0000000005881000-memory.dmp

Download

memory/1496-120-0x0000000007C80000-0x0000000007C81000-memory.dmp

Download

memory/3836-142-0x0000000003150000-0x0000000003151000-memory.dmp

Download

memory/4048-131-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/4048-126-0x0000000000400000-0x0000000000417000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads