remcos | f79d3098bfb090b6aaa390943e247178f3acff7c8214467df000cd3f102a2382

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2022, 03:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
833bc61d4955551fee83afc1fb812496.exe
Size 100KB
Sample220722-dplhmscbd2
SHA256 f79d3098bfb090b6aaa390943e247178f3acff7c8214467df000cd3f102a2382
MD5 833bc61d4955551fee83afc1fb812496
SHA1 2d8217b33639194edc86fc212cb5bf87f1552a42
SHA512 5c7236cf26d8ee2c26b75ff4c420e9bd4668aba9ccc32f857c793e8a3fc94967136eba420f323a7217c3ad01837b4f2a8689e83714f6d6b58f4eae2255f08bfe
MD5 SHA1 SHA512

Score

10^/10

remcos president rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

President

widda1.ddns.net:2404
windda.ddns.net:2404
6.tcp.ngrok.io:10880

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
svchost.exe
copy_folder
updates
delete_file
true
hide_file
true
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
windows
keylog_path
%AppData%
mouse_option
false
mutex
remcos_bvmobmufbe
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
Logs
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 1 IoCs

pid	Process
4204	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	833bc61d4955551fee83afc1fb812496.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4376	PING.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4204	svchost.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 3380	5064	833bc61d4955551fee83afc1fb812496.exe	77
PID 5064 wrote to memory of 3380	5064	833bc61d4955551fee83afc1fb812496.exe	77
PID 5064 wrote to memory of 3380	5064	833bc61d4955551fee83afc1fb812496.exe	77
PID 3380 wrote to memory of 4376	3380	cmd.exe	79
PID 3380 wrote to memory of 4376	3380	cmd.exe	79
PID 3380 wrote to memory of 4376	3380	cmd.exe	79
PID 3380 wrote to memory of 4204	3380	cmd.exe	80
PID 3380 wrote to memory of 4204	3380	cmd.exe	80
PID 3380 wrote to memory of 4204	3380	cmd.exe	80

C:\Users\Admin\AppData\Local\Temp\833bc61d4955551fee83afc1fb812496.exe
"C:\Users\Admin\AppData\Local\Temp\833bc61d4955551fee83afc1fb812496.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Windows\SysWOW64\PING.EXE
    PING 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:4376
- - C:\Users\Admin\AppData\Roaming\updates\svchost.exe
    "C:\Users\Admin\AppData\Roaming\updates\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4204

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.bat

Path C:\Users\Admin\AppData\Local\Temp\install.bat
Size 179B
SHA256 6c159dbbd5149831e23ee7b34664159ec66eaf0a5a67813514c1cfeb50692b21
MD5 78330f40e7234bd935c0e4ba978821ec
SHA1 51ea1fbf9a951b72c7f4a6a8ba4a3f9f1231b4af
SHA512 58cdbec248609964f15f326ff2d8cc092f734f9645d966c3ce665b73b80fb29ec93a9b219e6e60c3b4b8bd39183fbbaa0a78127c6f32b75bc548bb1f148b29ea
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\updates\svchost.exe
Size 100KB
SHA256 f79d3098bfb090b6aaa390943e247178f3acff7c8214467df000cd3f102a2382
MD5 833bc61d4955551fee83afc1fb812496
SHA1 2d8217b33639194edc86fc212cb5bf87f1552a42
SHA512 5c7236cf26d8ee2c26b75ff4c420e9bd4668aba9ccc32f857c793e8a3fc94967136eba420f323a7217c3ad01837b4f2a8689e83714f6d6b58f4eae2255f08bfe
SSDEEP 3072:vhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+JP/P6yrw:vhzOv2fM13jsIFSHNT7P/P6aw
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\updates\svchost.exe
Size 100KB
SHA256 f79d3098bfb090b6aaa390943e247178f3acff7c8214467df000cd3f102a2382
MD5 833bc61d4955551fee83afc1fb812496
SHA1 2d8217b33639194edc86fc212cb5bf87f1552a42
SHA512 5c7236cf26d8ee2c26b75ff4c420e9bd4668aba9ccc32f857c793e8a3fc94967136eba420f323a7217c3ad01837b4f2a8689e83714f6d6b58f4eae2255f08bfe
SSDEEP 3072:vhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+JP/P6yrw:vhzOv2fM13jsIFSHNT7P/P6aw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads