remcos | 29eeb8781216adf0c1a47bedab9f2eb5315a9888ceae6ba1525e7d5ecce1eeee

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
29/07/2022, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0x000800000001414c-55.exe
Size 100KB
Sample220729-sd4x6saff3
SHA256 29eeb8781216adf0c1a47bedab9f2eb5315a9888ceae6ba1525e7d5ecce1eeee
MD5 a693cb1e220a688311032a45f34e42cc
SHA1 8f99519487ee96ef05c4d5f94a06080173b05d9c
SHA512 50c2c6f62912a4c965d3dad4e4ebb9c18b00028a0763dbecc15e2f5da46f7d63dd83b9c21f76f3029530b3feb59a28fa4b95b30438fefb14a5341338ca604a7c
MD5 SHA1 SHA512

Score

10^/10

remcos president rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

President

winam.ddns.net:2401
dropy2.ddns.net:2400
dropy1.ddns.net:2404

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
svchost.exe
copy_folder
updates
delete_file
true
hide_file
true
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
windows
keylog_path
%AppData%
mouse_option
false
mutex
remcos_bvmobmufbe
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
Logs
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 1 IoCs

pid	Process
2100	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation	0x000800000001414c-55.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3692	PING.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2100	svchost.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 4064	4920	0x000800000001414c-55.exe	81
PID 4920 wrote to memory of 4064	4920	0x000800000001414c-55.exe	81
PID 4920 wrote to memory of 4064	4920	0x000800000001414c-55.exe	81
PID 4064 wrote to memory of 3692	4064	cmd.exe	83
PID 4064 wrote to memory of 3692	4064	cmd.exe	83
PID 4064 wrote to memory of 3692	4064	cmd.exe	83
PID 4064 wrote to memory of 2100	4064	cmd.exe	85
PID 4064 wrote to memory of 2100	4064	cmd.exe	85
PID 4064 wrote to memory of 2100	4064	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\0x000800000001414c-55.exe
"C:\Users\Admin\AppData\Local\Temp\0x000800000001414c-55.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Windows\SysWOW64\PING.EXE
    PING 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:3692
- - C:\Users\Admin\AppData\Roaming\updates\svchost.exe
    "C:\Users\Admin\AppData\Roaming\updates\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.bat

Path C:\Users\Admin\AppData\Local\Temp\install.bat
Size 168B
SHA256 a07e9c98182256ab0d45e23c3f414f6020b351a004ecda5049c61f87d43471c0
MD5 2aa2c1ef7cf033ca3e1d5dc070378aa8
SHA1 78b4295a05d5d79c7a9d44e9b381589768de1aad
SHA512 7511374ece306e7c85394e55ce5ceed56aa547401520d03eab8c79514ae1b69be64f4674d321aa4e9249e3df880f4ed772faedeea21e9a74a9a7f25697c14f9c
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\updates\svchost.exe
Size 100KB
SHA256 29eeb8781216adf0c1a47bedab9f2eb5315a9888ceae6ba1525e7d5ecce1eeee
MD5 a693cb1e220a688311032a45f34e42cc
SHA1 8f99519487ee96ef05c4d5f94a06080173b05d9c
SHA512 50c2c6f62912a4c965d3dad4e4ebb9c18b00028a0763dbecc15e2f5da46f7d63dd83b9c21f76f3029530b3feb59a28fa4b95b30438fefb14a5341338ca604a7c
SSDEEP 3072:vhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+JP/P69r1:vhzOv2fM13jsIFSHNT7P/P6V1
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\updates\svchost.exe
Size 100KB
SHA256 29eeb8781216adf0c1a47bedab9f2eb5315a9888ceae6ba1525e7d5ecce1eeee
MD5 a693cb1e220a688311032a45f34e42cc
SHA1 8f99519487ee96ef05c4d5f94a06080173b05d9c
SHA512 50c2c6f62912a4c965d3dad4e4ebb9c18b00028a0763dbecc15e2f5da46f7d63dd83b9c21f76f3029530b3feb59a28fa4b95b30438fefb14a5341338ca604a7c
SSDEEP 3072:vhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+JP/P69r1:vhzOv2fM13jsIFSHNT7P/P6V1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads