remcos | 2bca2ddb0d37c48969f9ca795248774bc84b2408240e8a26a6bf2df03ea3caf7

Analysis

max time kernel
155s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2022, 19:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
csQDaSnx.exe
Size 124KB
Sample220810-ylyn1secem
SHA256 2bca2ddb0d37c48969f9ca795248774bc84b2408240e8a26a6bf2df03ea3caf7
MD5 b239afc5e3fec697142676c5de84a52a
SHA1 c6915d02b759be4a2feb2cfe79bd861dd98d2486
SHA512 904dd7ef5dcaa94701e799d3e70ce14b2fced73191deef01b225435b93ca8c01b88d451c4d7739fe27430a3ccec0fedeb3aec327078c110ea63881db1aa7d092
MD5 SHA1 SHA512

Score

10^/10

remcos ccleaner evasion persistence rat trojan

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

ccleaner

keyrat.ddns.net:7777

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
ccleaner.exe
copy_folder
ccleaner
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%WinDir%\System32
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
ccleaner
keylog_path
%WinDir%\System32
mouse_option
false
mutex
ccleaner-ZZVBDM
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
ccleaner
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Executes dropped EXE 1 IoCs

pid	Process
4744	ccleaner.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation	csQDaSnx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Software\Microsoft\Windows\CurrentVersion\Run\	csQDaSnx.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ccleaner = "\"C:\\Windows\\SysWOW64\\ccleaner\\ccleaner.exe\""	csQDaSnx.exe
Key created	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Software\Microsoft\Windows\CurrentVersion\Run\	ccleaner.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ccleaner = "\"C:\\Windows\\SysWOW64\\ccleaner\\ccleaner.exe\""	ccleaner.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ccleaner\ccleaner.exe	csQDaSnx.exe
File opened for modification	C:\Windows\SysWOW64\ccleaner\ccleaner.exe	csQDaSnx.exe
File opened for modification	C:\Windows\SysWOW64\ccleaner\logs.dat	ccleaner.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4744 set thread context of 2304	4744	ccleaner.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000_Classes\Local Settings	csQDaSnx.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4756	reg.exe
1140	reg.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4744	ccleaner.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 1268	884	csQDaSnx.exe	80
PID 884 wrote to memory of 1268	884	csQDaSnx.exe	80
PID 884 wrote to memory of 1268	884	csQDaSnx.exe	80
PID 1268 wrote to memory of 4756	1268	cmd.exe	82
PID 1268 wrote to memory of 4756	1268	cmd.exe	82
PID 1268 wrote to memory of 4756	1268	cmd.exe	82
PID 884 wrote to memory of 4872	884	csQDaSnx.exe	83
PID 884 wrote to memory of 4872	884	csQDaSnx.exe	83
PID 884 wrote to memory of 4872	884	csQDaSnx.exe	83
PID 4872 wrote to memory of 3468	4872	WScript.exe	84
PID 4872 wrote to memory of 3468	4872	WScript.exe	84
PID 4872 wrote to memory of 3468	4872	WScript.exe	84
PID 3468 wrote to memory of 4744	3468	cmd.exe	86
PID 3468 wrote to memory of 4744	3468	cmd.exe	86
PID 3468 wrote to memory of 4744	3468	cmd.exe	86
PID 4744 wrote to memory of 1492	4744	ccleaner.exe	87
PID 4744 wrote to memory of 1492	4744	ccleaner.exe	87
PID 4744 wrote to memory of 1492	4744	ccleaner.exe	87
PID 4744 wrote to memory of 2304	4744	ccleaner.exe	89
PID 4744 wrote to memory of 2304	4744	ccleaner.exe	89
PID 4744 wrote to memory of 2304	4744	ccleaner.exe	89
PID 4744 wrote to memory of 2304	4744	ccleaner.exe	89
PID 4744 wrote to memory of 2304	4744	ccleaner.exe	89
PID 4744 wrote to memory of 2304	4744	ccleaner.exe	89
PID 4744 wrote to memory of 2304	4744	ccleaner.exe	89
PID 4744 wrote to memory of 2304	4744	ccleaner.exe	89
PID 4744 wrote to memory of 2304	4744	ccleaner.exe	89
PID 4744 wrote to memory of 2304	4744	ccleaner.exe	89
PID 1492 wrote to memory of 1140	1492	cmd.exe	90
PID 1492 wrote to memory of 1140	1492	cmd.exe	90
PID 1492 wrote to memory of 1140	1492	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\csQDaSnx.exe
"C:\Users\Admin\AppData\Local\Temp\csQDaSnx.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\SysWOW64\cmd.exe
  /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - Modifies registry key
    PID:4756
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Windows\SysWOW64\ccleaner\ccleaner.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3468
  - - C:\Windows\SysWOW64\ccleaner\ccleaner.exe
      C:\Windows\SysWOW64\ccleaner\ccleaner.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4744
    - - C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1492
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        UAC bypass
        Modifies registry key
        
        PID:1140
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        5⤵
        
        PID:2304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 404B
SHA256 0ec3cbcef684d90edce49fe82d651e40b8bf90520c7b0770edf26641d65d0111
MD5 2ee6ccb45f1708e0261ab384e6153d1f
SHA1 6b145cbe064a958bb37a47c9d80b312d0b3deaa5
SHA512 d60edb2fb40946a3bd793bade57c64f4e0a8018c052f8bc6309c1500ff5ec3bfc3af8e201f07a27e187e0c2ffdf56264621e4e63aec4b053bfa651bc1743d864
MD5 SHA1 SHA512

Submit Download

ccleaner.exe

Path C:\Windows\SysWOW64\ccleaner\ccleaner.exe
Size 124KB
SHA256 2bca2ddb0d37c48969f9ca795248774bc84b2408240e8a26a6bf2df03ea3caf7
MD5 b239afc5e3fec697142676c5de84a52a
SHA1 c6915d02b759be4a2feb2cfe79bd861dd98d2486
SHA512 904dd7ef5dcaa94701e799d3e70ce14b2fced73191deef01b225435b93ca8c01b88d451c4d7739fe27430a3ccec0fedeb3aec327078c110ea63881db1aa7d092
SSDEEP 3072:mFh1qaSs6IF9OK4b80S2Van4Va1cpcQjed5OzqhUka:Sh1qn3IF9Obbj/a1cpcQjeHOzqhUk
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccleaner.exe

Path C:\Windows\SysWOW64\ccleaner\ccleaner.exe
Size 124KB
SHA256 2bca2ddb0d37c48969f9ca795248774bc84b2408240e8a26a6bf2df03ea3caf7
MD5 b239afc5e3fec697142676c5de84a52a
SHA1 c6915d02b759be4a2feb2cfe79bd861dd98d2486
SHA512 904dd7ef5dcaa94701e799d3e70ce14b2fced73191deef01b225435b93ca8c01b88d451c4d7739fe27430a3ccec0fedeb3aec327078c110ea63881db1aa7d092
SSDEEP 3072:mFh1qaSs6IF9OK4b80S2Van4Va1cpcQjed5OzqhUka:Sh1qn3IF9Obbj/a1cpcQjeHOzqhUk
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2304-142-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2304-145-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2304-146-0x0000000000400000-0x0000000000420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads