remcos | 8dfee94c273148e304ce65b2174c1bcf211e31b9fb7074bb03069c831a4b119a

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
25/03/2022, 13:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1098eea1ee550a0b6100a11be53d27d8.exe
Size 1.0MB
Sample220325-qf4n3sgdf2
SHA256 8dfee94c273148e304ce65b2174c1bcf211e31b9fb7074bb03069c831a4b119a
MD5 1098eea1ee550a0b6100a11be53d27d8
SHA1 5311193409a6600da97c9a54b4f7c7140c1f6741
SHA512 5df902d590c31081641b23d8f8e38719d0a94f098c6d2ece6c36e7433326246a96722b584e01ebeb65ce13f8747bbc814d76cb03f2ec6fa4160222305a0fe231
MD5 SHA1 SHA512

Score

10^/10

remcos 03242022 persistence rat

Malware Config

Extracted

Family

remcos

Botnet

03242022

nikahuve.ac.ug:6968
kalskala.ac.ug:6968
tuekisaa.ac.ug:6968
parthaha.ac.ug:6968

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
scxs.dat
keylog_flag
false
keylog_folder
forbas
keylog_path
%AppData%
mouse_option
false
mutex
cvxyttydfsgbghfgfhtd-3MD7P9
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wxmxcsw = "C:\\Users\\Public\\wscxmxW.url"	1098eea1ee550a0b6100a11be53d27d8.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5056	powershell.exe
5056	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5056	powershell.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 1772	4372	1098eea1ee550a0b6100a11be53d27d8.exe	92
PID 4372 wrote to memory of 1772	4372	1098eea1ee550a0b6100a11be53d27d8.exe	92
PID 4372 wrote to memory of 1772	4372	1098eea1ee550a0b6100a11be53d27d8.exe	92
PID 4372 wrote to memory of 1772	4372	1098eea1ee550a0b6100a11be53d27d8.exe	92
PID 4372 wrote to memory of 1772	4372	1098eea1ee550a0b6100a11be53d27d8.exe	92
PID 4372 wrote to memory of 1772	4372	1098eea1ee550a0b6100a11be53d27d8.exe	92
PID 4372 wrote to memory of 1772	4372	1098eea1ee550a0b6100a11be53d27d8.exe	92
PID 4372 wrote to memory of 1772	4372	1098eea1ee550a0b6100a11be53d27d8.exe	92
PID 4372 wrote to memory of 1772	4372	1098eea1ee550a0b6100a11be53d27d8.exe	92
PID 4372 wrote to memory of 1772	4372	1098eea1ee550a0b6100a11be53d27d8.exe	92
PID 4372 wrote to memory of 1772	4372	1098eea1ee550a0b6100a11be53d27d8.exe	92
PID 4372 wrote to memory of 1772	4372	1098eea1ee550a0b6100a11be53d27d8.exe	92
PID 4372 wrote to memory of 1772	4372	1098eea1ee550a0b6100a11be53d27d8.exe	92
PID 4372 wrote to memory of 1772	4372	1098eea1ee550a0b6100a11be53d27d8.exe	92
PID 4372 wrote to memory of 1772	4372	1098eea1ee550a0b6100a11be53d27d8.exe	92
PID 4372 wrote to memory of 32	4372	1098eea1ee550a0b6100a11be53d27d8.exe	93
PID 4372 wrote to memory of 32	4372	1098eea1ee550a0b6100a11be53d27d8.exe	93
PID 4372 wrote to memory of 32	4372	1098eea1ee550a0b6100a11be53d27d8.exe	93
PID 32 wrote to memory of 4540	32	cmd.exe	95
PID 32 wrote to memory of 4540	32	cmd.exe	95
PID 32 wrote to memory of 4540	32	cmd.exe	95
PID 4540 wrote to memory of 3452	4540	cmd.exe	97
PID 4540 wrote to memory of 3452	4540	cmd.exe	97
PID 4540 wrote to memory of 3452	4540	cmd.exe	97
PID 3452 wrote to memory of 936	3452	net.exe	98
PID 3452 wrote to memory of 936	3452	net.exe	98
PID 3452 wrote to memory of 936	3452	net.exe	98
PID 4540 wrote to memory of 5056	4540	cmd.exe	99
PID 4540 wrote to memory of 5056	4540	cmd.exe	99
PID 4540 wrote to memory of 5056	4540	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\1098eea1ee550a0b6100a11be53d27d8.exe
"C:\Users\Admin\AppData\Local\Temp\1098eea1ee550a0b6100a11be53d27d8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\SysWOW64\DpiScaling.exe
  C:\Windows\System32\DpiScaling.exe
  2⤵
  PID:1772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Wxmxcswt.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:32
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Public\WxmxcswO.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Windows\SysWOW64\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3452
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:936
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1772-135-0x0000000010590000-0x000000001060D000-memory.dmp

Download

memory/1772-136-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/5056-145-0x00000000050A0000-0x0000000005106000-memory.dmp

Download

memory/5056-150-0x000000006F120000-0x000000006F16C000-memory.dmp

Download

memory/5056-143-0x0000000005140000-0x0000000005768000-memory.dmp

Download

memory/5056-144-0x0000000004F00000-0x0000000004F22000-memory.dmp

Download

memory/5056-146-0x0000000005770000-0x00000000057D6000-memory.dmp

Download

memory/5056-147-0x0000000005DB0000-0x0000000005DCE000-memory.dmp

Download

memory/5056-148-0x0000000004B05000-0x0000000004B07000-memory.dmp

Download

memory/5056-149-0x0000000006360000-0x0000000006392000-memory.dmp

Download

memory/5056-142-0x00000000028D0000-0x0000000002906000-memory.dmp

Download

memory/5056-151-0x0000000006340000-0x000000000635E000-memory.dmp

Download

memory/5056-152-0x0000000007750000-0x0000000007DCA000-memory.dmp

Download

memory/5056-153-0x0000000006FD0000-0x0000000006FEA000-memory.dmp

Download

memory/5056-154-0x0000000007110000-0x000000000711A000-memory.dmp

Download

memory/5056-155-0x0000000007300000-0x0000000007396000-memory.dmp

Download

memory/5056-156-0x00000000072C0000-0x00000000072CE000-memory.dmp

Download

memory/5056-157-0x00000000073C0000-0x00000000073DA000-memory.dmp

Download

memory/5056-158-0x00000000073B0000-0x00000000073B8000-memory.dmp

Download