remcos | 902f4adc25817f82a216b60a7658cb9a267e877ea0197d69cc279fc02ba4906d

Analysis

max time kernel
122s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
12/04/2022, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8c2849b00405b4a005b68fa898334005.exe
Size 96KB
Sample220412-ppgegabdcp
SHA256 902f4adc25817f82a216b60a7658cb9a267e877ea0197d69cc279fc02ba4906d
MD5 8c2849b00405b4a005b68fa898334005
SHA1 83f1b06a9095034bd4865639936517d4fa603fff
SHA512 1803717a27e1938fcf07805cc0181d458937a6f8738c5c649c158475a6e3142cb3c92d9883b1ae30731a1b96201edaf00a1dd72bdb78f31dbccf9c8066e10ecb
MD5 SHA1 SHA512

Score

10^/10

remcos gee2022 persistence rat

Malware Config

Extracted

Family

remcos

Botnet

Gee2022

davidwongwarzone.zapto.org:2030

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
UDP.exe
copy_folder
delete_file
false
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-PKSLI4
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
web
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 1 IoCs

pid	Process
4192	UDP.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Software\Microsoft\Windows\CurrentVersion\Run\	MSBuild.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\web = "\"C:\\Users\\Admin\\AppData\\Roaming\\UDP.exe\""	MSBuild.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4176 set thread context of 4636	4176	8c2849b00405b4a005b68fa898334005.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000_Classes\Local Settings	MSBuild.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4176	8c2849b00405b4a005b68fa898334005.exe
4176	8c2849b00405b4a005b68fa898334005.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4176	8c2849b00405b4a005b68fa898334005.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 4636	4176	8c2849b00405b4a005b68fa898334005.exe	90
PID 4176 wrote to memory of 4636	4176	8c2849b00405b4a005b68fa898334005.exe	90
PID 4176 wrote to memory of 4636	4176	8c2849b00405b4a005b68fa898334005.exe	90
PID 4176 wrote to memory of 4636	4176	8c2849b00405b4a005b68fa898334005.exe	90
PID 4176 wrote to memory of 4636	4176	8c2849b00405b4a005b68fa898334005.exe	90
PID 4176 wrote to memory of 4636	4176	8c2849b00405b4a005b68fa898334005.exe	90
PID 4176 wrote to memory of 4636	4176	8c2849b00405b4a005b68fa898334005.exe	90
PID 4176 wrote to memory of 4636	4176	8c2849b00405b4a005b68fa898334005.exe	90
PID 4176 wrote to memory of 4636	4176	8c2849b00405b4a005b68fa898334005.exe	90
PID 4176 wrote to memory of 4636	4176	8c2849b00405b4a005b68fa898334005.exe	90
PID 4176 wrote to memory of 4636	4176	8c2849b00405b4a005b68fa898334005.exe	90
PID 4176 wrote to memory of 4636	4176	8c2849b00405b4a005b68fa898334005.exe	90
PID 4636 wrote to memory of 4568	4636	MSBuild.exe	91
PID 4636 wrote to memory of 4568	4636	MSBuild.exe	91
PID 4636 wrote to memory of 4568	4636	MSBuild.exe	91
PID 4568 wrote to memory of 1524	4568	WScript.exe	92
PID 4568 wrote to memory of 1524	4568	WScript.exe	92
PID 4568 wrote to memory of 1524	4568	WScript.exe	92
PID 1524 wrote to memory of 4192	1524	cmd.exe	94
PID 1524 wrote to memory of 4192	1524	cmd.exe	94
PID 1524 wrote to memory of 4192	1524	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\8c2849b00405b4a005b68fa898334005.exe
"C:\Users\Admin\AppData\Local\Temp\8c2849b00405b4a005b68fa898334005.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2⤵
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4568
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\UDP.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1524
    - - C:\Users\Admin\AppData\Roaming\UDP.exe
        
        C:\Users\Admin\AppData\Roaming\UDP.exe
        5⤵
        Executes dropped EXE
        
        PID:4192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 398B
SHA256 58f08f34f43b44c5a943ce873a724f40bc68d01ceb03ec0928a8413be52532d5
MD5 bbb0311005473afb679030217176b21b
SHA1 f1289670bbdfedb24cc86dfb78b8b90356deade9
SHA512 9d083de0fac8d971d678f0b3e7f7aaf2c48e4cd972a7df3d5f71e1bb3245e9675b606bd61d60a249bd753412625ebad31fb55075f46c27889dcfe1e81b39ead0
MD5 SHA1 SHA512

Submit Download

UDP.exe

Path C:\Users\Admin\AppData\Roaming\UDP.exe
Size 256KB
SHA256 ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
MD5 8fdf47e0ff70c40ed3a17014aeea4232
SHA1 e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA512 bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be
SSDEEP 3072:7a0t0yH5wCwie3NnQNLpj/Wnqvsw2XpFU4rwOeTubZSzf02RFihx2uzj:m0ny3nnKpqnZRXfw702birr/
MD5 SHA1 SHA512 SSDEEP

Submit Download

UDP.exe

Path C:\Users\Admin\AppData\Roaming\UDP.exe
Size 256KB
SHA256 ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
MD5 8fdf47e0ff70c40ed3a17014aeea4232
SHA1 e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA512 bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be
SSDEEP 3072:7a0t0yH5wCwie3NnQNLpj/Wnqvsw2XpFU4rwOeTubZSzf02RFihx2uzj:m0ny3nnKpqnZRXfw702birr/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4176-125-0x0000000005EA0000-0x0000000006444000-memory.dmp

Download

memory/4176-126-0x00000000058F0000-0x0000000005982000-memory.dmp

Download

memory/4176-127-0x0000000005AA0000-0x0000000005AAA000-memory.dmp

Download

memory/4176-124-0x0000000000F30000-0x0000000000F4E000-memory.dmp

Download

memory/4192-140-0x0000000005740000-0x000000000589A000-memory.dmp

Download

memory/4192-139-0x00000000017D0000-0x00000000017EA000-memory.dmp

Download

memory/4192-138-0x0000000000D90000-0x0000000000DD0000-memory.dmp

Download

memory/4636-131-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/4636-130-0x0000000000400000-0x000000000047A000-memory.dmp

Download

memory/4636-129-0x0000000000400000-0x000000000047A000-memory.dmp

Download