remcos | 1ec91c0ab95a84afe71e67bd355b04abf1cc65b68abded89ce1247dc5682a8e6

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2022, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2584c82f01d79e34c4eb4a44d58029aa.exe
Size 1.1MB
Sample221102-s77adscefm
SHA256 1ec91c0ab95a84afe71e67bd355b04abf1cc65b68abded89ce1247dc5682a8e6
MD5 2584c82f01d79e34c4eb4a44d58029aa
SHA1 c9a33e9be0262a8a755250e9fe7a3c1813592e74
SHA512 45173b9d45914ddf366a5715d1a154441f2b79826f7fdf5c807312f47ce6d482df277de16b6fe4104036ff1b9afc0f6014bfa2c363c4a1b6daaf5d06d0deece1
SSDEEP 24576:RYyeBQUFeejneTA8vsujOMFLDEStWk2fst/GQfHdVXipzcvP1W:Gyu9F5nr8vL6uXTQk8QrSGvPA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos wed file persistence rat

Malware Config

Extracted

Family

remcos

Botnet

Wed File

107.174.202.148:14207

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-X79YGO
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	2584c82f01d79e34c4eb4a44d58029aa.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Flcrnkvvzyx = "\"C:\\Users\\Admin\\AppData\\Roaming\\Yhdxheal\\Flcrnkvvzyx.exe\""	2584c82f01d79e34c4eb4a44d58029aa.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3912 set thread context of 3080	3912	2584c82f01d79e34c4eb4a44d58029aa.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
628	powershell.exe
628	powershell.exe
4216	powershell.exe
4216	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3912	2584c82f01d79e34c4eb4a44d58029aa.exe
Token: SeDebugPrivilege	628	powershell.exe
Token: SeDebugPrivilege	4216	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3080	MSBuild.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 628	3912	2584c82f01d79e34c4eb4a44d58029aa.exe	81
PID 3912 wrote to memory of 628	3912	2584c82f01d79e34c4eb4a44d58029aa.exe	81
PID 3912 wrote to memory of 628	3912	2584c82f01d79e34c4eb4a44d58029aa.exe	81
PID 3912 wrote to memory of 4216	3912	2584c82f01d79e34c4eb4a44d58029aa.exe	91
PID 3912 wrote to memory of 4216	3912	2584c82f01d79e34c4eb4a44d58029aa.exe	91
PID 3912 wrote to memory of 4216	3912	2584c82f01d79e34c4eb4a44d58029aa.exe	91
PID 3912 wrote to memory of 3080	3912	2584c82f01d79e34c4eb4a44d58029aa.exe	93
PID 3912 wrote to memory of 3080	3912	2584c82f01d79e34c4eb4a44d58029aa.exe	93
PID 3912 wrote to memory of 3080	3912	2584c82f01d79e34c4eb4a44d58029aa.exe	93
PID 3912 wrote to memory of 3080	3912	2584c82f01d79e34c4eb4a44d58029aa.exe	93
PID 3912 wrote to memory of 3080	3912	2584c82f01d79e34c4eb4a44d58029aa.exe	93
PID 3912 wrote to memory of 3080	3912	2584c82f01d79e34c4eb4a44d58029aa.exe	93
PID 3912 wrote to memory of 3080	3912	2584c82f01d79e34c4eb4a44d58029aa.exe	93
PID 3912 wrote to memory of 3080	3912	2584c82f01d79e34c4eb4a44d58029aa.exe	93
PID 3912 wrote to memory of 3080	3912	2584c82f01d79e34c4eb4a44d58029aa.exe	93
PID 3912 wrote to memory of 3080	3912	2584c82f01d79e34c4eb4a44d58029aa.exe	93
PID 3912 wrote to memory of 3080	3912	2584c82f01d79e34c4eb4a44d58029aa.exe	93
PID 3912 wrote to memory of 3080	3912	2584c82f01d79e34c4eb4a44d58029aa.exe	93

C:\Users\Admin\AppData\Local\Temp\2584c82f01d79e34c4eb4a44d58029aa.exe
"C:\Users\Admin\AppData\Local\Temp\2584c82f01d79e34c4eb4a44d58029aa.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:628
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXAAnAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4216
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
MD5 06ad34f9739c5159b4d92d702545bd49
SHA1 9152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA512 c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYoFi3j39MVvjMLUsszyhMUp7Fv+Eca5b/h4ie:KC+jH04tAHk5MrxyNhftflJdPYoFi3jc
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 a4241e9424d72f05b6f783699b5b4cc2bbb211d5561a5dabe2270a690de12af2
MD5 a7594d797d5563493a0b13b433adf071
SHA1 90e99f91c14338181d536139116e4dcc82bd00d6
SHA512 e11325e2c36e03e82a243c6199f5b013d264ef7e9d49041ac7396434b752684dff7a8a94c5429d9086cad97919f9f279d22873fbafe2d3c8896a55e060ef97b5
SSDEEP 384:Jrf+jI9i+sPRVCO2vFDyDk+o9o2TVK6seYcI1/r03SoZofYSPUjE0L6Q:BfgPRz2dljo2TVNbaYSPRqE0P
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/628-139-0x0000000005690000-0x00000000056F6000-memory.dmp

Download

memory/628-137-0x00000000047F0000-0x0000000004826000-memory.dmp

Download

memory/628-138-0x0000000004E60000-0x0000000005488000-memory.dmp

Download

memory/628-143-0x0000000006200000-0x000000000621A000-memory.dmp

Download

memory/628-140-0x0000000005700000-0x0000000005766000-memory.dmp

Download

memory/628-141-0x0000000005D80000-0x0000000005D9E000-memory.dmp

Download

memory/628-142-0x00000000077D0000-0x0000000007E4A000-memory.dmp

Download

memory/3080-161-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3080-160-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3080-159-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3080-158-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3080-157-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3912-132-0x0000000000070000-0x000000000019C000-memory.dmp

Download

memory/3912-135-0x0000000004FD0000-0x0000000004FF2000-memory.dmp

Download

memory/3912-134-0x0000000005550000-0x0000000005AF4000-memory.dmp

Download

memory/3912-133-0x0000000004F00000-0x0000000004F92000-memory.dmp

Download

memory/4216-148-0x0000000007830000-0x0000000007862000-memory.dmp

Download

memory/4216-154-0x0000000007D80000-0x0000000007D9A000-memory.dmp

Download

memory/4216-155-0x0000000007950000-0x0000000007958000-memory.dmp

Download

memory/4216-153-0x0000000007910000-0x000000000791E000-memory.dmp

Download

memory/4216-152-0x0000000007E20000-0x0000000007EB6000-memory.dmp

Download

memory/4216-151-0x0000000007890000-0x000000000789A000-memory.dmp

Download

memory/4216-150-0x0000000006E20000-0x0000000006E3E000-memory.dmp

Download

memory/4216-149-0x000000006FE20000-0x000000006FE6C000-memory.dmp

Download