remcos | d68a8086daa22485827f74140e91325a1c751329c29f23f61c7c33856705b151

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2022, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
74948fcfeb4232ecaee315a1e75b9756.exe
Size 100KB
Sample220724-e81bksfcg5
SHA256 d68a8086daa22485827f74140e91325a1c751329c29f23f61c7c33856705b151
MD5 74948fcfeb4232ecaee315a1e75b9756
SHA1 13a35894d0c32cbc4ceca199d383ba4b2486a6ad
SHA512 a8012f9b4789d9062002712c4c571a00a43a906e1f5fc6b13c1ea853c42fb1fc2edd13fb64e11c2ac37cfc6b8e9715dab0e0179f43ec5d6215247009f437ea4d
MD5 SHA1 SHA512

Score

10^/10

remcos president rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

President

winam.ddns.net:2404
runam.ddns.net:2404
windda.ddns.net:2404
widda1.ddns.net:2404

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
180
copy_file
svchost.exe
copy_folder
updates
delete_file
true
hide_file
true
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
windows
keylog_path
%AppData%
mouse_option
false
mutex
remcos_nsttxbncgz
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
Logs
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 1 IoCs

pid	Process
4412	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation	74948fcfeb4232ecaee315a1e75b9756.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3424	PING.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4412	svchost.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 1540	4176	74948fcfeb4232ecaee315a1e75b9756.exe	83
PID 4176 wrote to memory of 1540	4176	74948fcfeb4232ecaee315a1e75b9756.exe	83
PID 4176 wrote to memory of 1540	4176	74948fcfeb4232ecaee315a1e75b9756.exe	83
PID 1540 wrote to memory of 3424	1540	cmd.exe	85
PID 1540 wrote to memory of 3424	1540	cmd.exe	85
PID 1540 wrote to memory of 3424	1540	cmd.exe	85
PID 1540 wrote to memory of 4412	1540	cmd.exe	86
PID 1540 wrote to memory of 4412	1540	cmd.exe	86
PID 1540 wrote to memory of 4412	1540	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\74948fcfeb4232ecaee315a1e75b9756.exe
"C:\Users\Admin\AppData\Local\Temp\74948fcfeb4232ecaee315a1e75b9756.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Windows\SysWOW64\PING.EXE
    PING 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:3424
- - C:\Users\Admin\AppData\Roaming\updates\svchost.exe
    "C:\Users\Admin\AppData\Roaming\updates\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4412

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.bat

Path C:\Users\Admin\AppData\Local\Temp\install.bat
Size 179B
SHA256 2f0ee730d53e8e8045cc41adfd9d202de2e9e060e6978f54d7ff641f8578e44d
MD5 64e34d5ecd595eee22f5e184177bbb8d
SHA1 733e7833cbd09fd27d34b9ada088d72a9a3b0055
SHA512 2953ed6b94a5bb5207978d302bab3928f1b8b039c3f8448ad5495dca94f0339f11da14048436b5870327c46bee7d38fad52e1b0b03242bad3bcc50132c746934
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\updates\svchost.exe
Size 100KB
SHA256 d68a8086daa22485827f74140e91325a1c751329c29f23f61c7c33856705b151
MD5 74948fcfeb4232ecaee315a1e75b9756
SHA1 13a35894d0c32cbc4ceca199d383ba4b2486a6ad
SHA512 a8012f9b4789d9062002712c4c571a00a43a906e1f5fc6b13c1ea853c42fb1fc2edd13fb64e11c2ac37cfc6b8e9715dab0e0179f43ec5d6215247009f437ea4d
SSDEEP 3072:vhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+JP/P6nrs:vhzOv2fM13jsIFSHNT7P/P6rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\updates\svchost.exe
Size 100KB
SHA256 d68a8086daa22485827f74140e91325a1c751329c29f23f61c7c33856705b151
MD5 74948fcfeb4232ecaee315a1e75b9756
SHA1 13a35894d0c32cbc4ceca199d383ba4b2486a6ad
SHA512 a8012f9b4789d9062002712c4c571a00a43a906e1f5fc6b13c1ea853c42fb1fc2edd13fb64e11c2ac37cfc6b8e9715dab0e0179f43ec5d6215247009f437ea4d
SSDEEP 3072:vhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+JP/P6nrs:vhzOv2fM13jsIFSHNT7P/P6rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads