remcos | 0639a34ed8b8a0702daec2d05da6afdd33c6c41dc2bb9cb2537c247825843adf

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
01/06/2022, 20:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pre alert documents.exe
Size 714KB
Sample220601-y698jsbef4
SHA256 0639a34ed8b8a0702daec2d05da6afdd33c6c41dc2bb9cb2537c247825843adf
MD5 916e5acc3ae9ef32c065913b73dceb4f
SHA1 2e74ebf894739e35b0ffd299b22591e47feb9f54
SHA512 2970ade691d0a45a3a0984c4a3a5c67ea13765da401b0cc59312dd37c350ead25fdf417b6af418680e7ad779fdcc89172a8202595997abab2cc46689259873eb
MD5 SHA1 SHA512

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

172.111.153.127:3033

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-XP3ST8
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 4500 created 4288	4500	svchost.exe	87
PID 4500 created 4288	4500	svchost.exe	87

Nirsoft 1 IoCs

resource	yara_rule
behavioral2/files/0x0003000000000731-139.dat	Nirsoft

Executes dropped EXE 2 IoCs

pid	Process
4780	129d7a19-e92d-4c47-bcc7-cec600b8ddcf.exe
4288	AdvancedRun.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	pre alert documents.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2368 set thread context of 4796	2368	pre alert documents.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2368	pre alert documents.exe
2368	pre alert documents.exe
2368	pre alert documents.exe
2368	pre alert documents.exe
2368	pre alert documents.exe
2368	pre alert documents.exe
2368	pre alert documents.exe
2368	pre alert documents.exe
4288	AdvancedRun.exe
4288	AdvancedRun.exe
4288	AdvancedRun.exe
4288	AdvancedRun.exe
2368	pre alert documents.exe
2368	pre alert documents.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	pre alert documents.exe
Token: SeDebugPrivilege	4288	AdvancedRun.exe
Token: SeImpersonatePrivilege	4288	AdvancedRun.exe
Token: SeTcbPrivilege	4500	svchost.exe
Token: SeTcbPrivilege	4500	svchost.exe
Token: SeTakeOwnershipPrivilege	4780	129d7a19-e92d-4c47-bcc7-cec600b8ddcf.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 4796	2368	pre alert documents.exe	85
PID 2368 wrote to memory of 4796	2368	pre alert documents.exe	85
PID 2368 wrote to memory of 4796	2368	pre alert documents.exe	85
PID 2368 wrote to memory of 4796	2368	pre alert documents.exe	85
PID 2368 wrote to memory of 4796	2368	pre alert documents.exe	85
PID 2368 wrote to memory of 4796	2368	pre alert documents.exe	85
PID 2368 wrote to memory of 4796	2368	pre alert documents.exe	85
PID 2368 wrote to memory of 4796	2368	pre alert documents.exe	85
PID 2368 wrote to memory of 4796	2368	pre alert documents.exe	85
PID 2368 wrote to memory of 4796	2368	pre alert documents.exe	85
PID 2368 wrote to memory of 4796	2368	pre alert documents.exe	85
PID 2368 wrote to memory of 4796	2368	pre alert documents.exe	85
PID 2368 wrote to memory of 4780	2368	pre alert documents.exe	86
PID 2368 wrote to memory of 4780	2368	pre alert documents.exe	86
PID 2368 wrote to memory of 4288	2368	pre alert documents.exe	87
PID 2368 wrote to memory of 4288	2368	pre alert documents.exe	87
PID 2368 wrote to memory of 4288	2368	pre alert documents.exe	87
PID 4500 wrote to memory of 4496	4500	svchost.exe	90
PID 4500 wrote to memory of 4496	4500	svchost.exe	90

C:\Users\Admin\AppData\Local\Temp\pre alert documents.exe
"C:\Users\Admin\AppData\Local\Temp\pre alert documents.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\PkgMgr.exe
  "C:\Windows\SysWOW64\PkgMgr.exe"
  2⤵
  PID:4796
- C:\Users\Admin\AppData\Local\Temp\c10acd8f-04b0-4c1b-8fa6-132a5cddf400\129d7a19-e92d-4c47-bcc7-cec600b8ddcf.exe
  "C:\Users\Admin\AppData\Local\Temp\c10acd8f-04b0-4c1b-8fa6-132a5cddf400\129d7a19-e92d-4c47-bcc7-cec600b8ddcf.exe" /o /c "Windows-Defender" /r
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4780
- C:\Users\Admin\AppData\Local\Temp\c10acd8f-04b0-4c1b-8fa6-132a5cddf400\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\c10acd8f-04b0-4c1b-8fa6-132a5cddf400\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\c10acd8f-04b0-4c1b-8fa6-132a5cddf400\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\c10acd8f-04b0-4c1b-8fa6-132a5cddf400\test.bat"
    3⤵
    PID:4496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

129d7a19-e92d-4c47-bcc7-cec600b8ddcf.exe

Path C:\Users\Admin\AppData\Local\Temp\c10acd8f-04b0-4c1b-8fa6-132a5cddf400\129d7a19-e92d-4c47-bcc7-cec600b8ddcf.exe
Size 25KB
SHA256 70b785e5cb5b2e61c0f5da4a71ab0bbd14d9a0849387f037e0d75cc1ffe0a082
MD5 5951b52c9b4d11ca7f4f33e5a3fb2c31
SHA1 0bc54fd699fff7b93e5c447a141c0d904924ab0d
SHA512 30b3b1eed05ba724d9a19d0d301b6ffb45222a47cc5476cc7f61ae565ddea4deea669f6fc3f38a1c5f24396eb4d3d6a7a8b58992fdfe2fac57dbcc2fa5b9b1d8
SSDEEP 384:JmKTpZorxmuAvOj7JfPkb/P2mS4UA4SVPCOudVoQH:xorxOGj7Vkbt0fCudV
MD5 SHA1 SHA512 SSDEEP

Submit Download

129d7a19-e92d-4c47-bcc7-cec600b8ddcf.exe

Path C:\Users\Admin\AppData\Local\Temp\c10acd8f-04b0-4c1b-8fa6-132a5cddf400\129d7a19-e92d-4c47-bcc7-cec600b8ddcf.exe
Size 25KB
SHA256 70b785e5cb5b2e61c0f5da4a71ab0bbd14d9a0849387f037e0d75cc1ffe0a082
MD5 5951b52c9b4d11ca7f4f33e5a3fb2c31
SHA1 0bc54fd699fff7b93e5c447a141c0d904924ab0d
SHA512 30b3b1eed05ba724d9a19d0d301b6ffb45222a47cc5476cc7f61ae565ddea4deea669f6fc3f38a1c5f24396eb4d3d6a7a8b58992fdfe2fac57dbcc2fa5b9b1d8
SSDEEP 384:JmKTpZorxmuAvOj7JfPkb/P2mS4UA4SVPCOudVoQH:xorxOGj7Vkbt0fCudV
MD5 SHA1 SHA512 SSDEEP

Submit Download

AdvancedRun.exe

Path C:\Users\Admin\AppData\Local\Temp\c10acd8f-04b0-4c1b-8fa6-132a5cddf400\AdvancedRun.exe
Size 88KB
SHA256 29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
MD5 17fc12902f4769af3a9271eb4e2dacce
SHA1 9a4a1581cc3971579574f837e110f3bd6d529dab
SHA512 036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
SSDEEP 1536:JW3osrWjET3tYIrrRepnbZ6ObGk2nLY2jR+utQUN+WXim:HjjET9nX0pnUOik2nXjR+utQK+g3
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.bat

Path C:\Users\Admin\AppData\Local\Temp\c10acd8f-04b0-4c1b-8fa6-132a5cddf400\test.bat
Size 17B
SHA256 66304c3a46bcc4e191d40db4ed6b6f3c25049a730a63af205485979f430e445a
MD5 3276ac7dd29853e29046e0ffc4dd3b09
SHA1 2d14ed71932b60a3f3eebadf1c092cb7633c3fdf
SHA512 73e3c85c9aaacacdee433beb1e8503df9f3df227c8d567cf851549c9735592dfca059a042745d33d709797e71c2c97a0d509dbf9334ba81a1382b82ab2d36bde
MD5 SHA1 SHA512

Submit Download

memory/2368-131-0x0000000005380000-0x000000000541C000-memory.dmp

Download

memory/2368-130-0x0000000000230000-0x00000000002E8000-memory.dmp

Download

memory/4780-142-0x0000022682460000-0x000002268246C000-memory.dmp

Download

memory/4780-145-0x00007FFEFC2D0000-0x00007FFEFCD91000-memory.dmp

Download

memory/4780-147-0x00007FFEFC2D0000-0x00007FFEFCD91000-memory.dmp

Download

memory/4796-135-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/4796-134-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/4796-133-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/4796-144-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/4796-146-0x0000000000400000-0x000000000047B000-memory.dmp

Download