remcos | 45cd8dd797af4fd769eef00243134c46c38bd9e65e15d7bd2e9b834d5e8b3095

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
22/11/2022, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.Evo-gen.5765.4565.exe
Size 481KB
Sample221122-e5ynksdf3v
SHA256 45cd8dd797af4fd769eef00243134c46c38bd9e65e15d7bd2e9b834d5e8b3095
MD5 92383014282141ff4664d242b3f17689
SHA1 f61565ed8039627abe35d5eee5ec3fad80bf9f66
SHA512 cad1fab7027f4ef214dc0361b4033580ea963fc9ae40c390e96a94022602ce3264dd9e91dd705105a5b0274ad48e7013f16a1d9f62edae4b62c9bd2501f03a12
SSDEEP 12288:WA+2Rsnvy5bKCrqvEDRzrXvOp54LLLq6le8c4R9/:J+2RaJvgvXvi54L/q6cG/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

drremcoz1.ddns.net:1307

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-FADJRF
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
2012	wrhpkzrfsy.exe
1372	wrhpkzrfsy.exe

Loads dropped DLL 2 IoCs

pid	Process
1048	SecuriteInfo.com.Win32.Evo-gen.5765.4565.exe
2012	wrhpkzrfsy.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\bowwjsllnljw = "C:\\Users\\Admin\\AppData\\Roaming\\eifdwjb\\bxdvvr.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\wrhpkzrfsy.exe\" C:\\Users\\Admin\\AppData\\Local\\"	wrhpkzrfsy.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2012 set thread context of 1372	2012	wrhpkzrfsy.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2012	wrhpkzrfsy.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1372	wrhpkzrfsy.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 2012	1048	SecuriteInfo.com.Win32.Evo-gen.5765.4565.exe	27
PID 1048 wrote to memory of 2012	1048	SecuriteInfo.com.Win32.Evo-gen.5765.4565.exe	27
PID 1048 wrote to memory of 2012	1048	SecuriteInfo.com.Win32.Evo-gen.5765.4565.exe	27
PID 1048 wrote to memory of 2012	1048	SecuriteInfo.com.Win32.Evo-gen.5765.4565.exe	27
PID 2012 wrote to memory of 1372	2012	wrhpkzrfsy.exe	29
PID 2012 wrote to memory of 1372	2012	wrhpkzrfsy.exe	29
PID 2012 wrote to memory of 1372	2012	wrhpkzrfsy.exe	29
PID 2012 wrote to memory of 1372	2012	wrhpkzrfsy.exe	29
PID 2012 wrote to memory of 1372	2012	wrhpkzrfsy.exe	29

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.5765.4565.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.5765.4565.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\wrhpkzrfsy.exe
  "C:\Users\Admin\AppData\Local\Temp\wrhpkzrfsy.exe" C:\Users\Admin\AppData\Local\Temp\iqdsikunk.c
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Users\Admin\AppData\Local\Temp\wrhpkzrfsy.exe
    "C:\Users\Admin\AppData\Local\Temp\wrhpkzrfsy.exe" C:\Users\Admin\AppData\Local\Temp\iqdsikunk.c
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1372

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

iqdsikunk.c

Path C:\Users\Admin\AppData\Local\Temp\iqdsikunk.c
Size 7KB
SHA256 b9c5a2ba53c7357e5fb1c817ac6048693b8a7bcb16300864ea12a0a960e9be14
MD5 cfadd12980282e64023d14be036484fd
SHA1 ca4fdeeb72600f51cd102dac85738282b8ad76f1
SHA512 a6c8790850d4408559aae328bf400754e85eb6dc2f54888bdf26a02f09ee82de2710ae22d78bcd4f42a8e6cac79db8afd4b5883062e426dec36de70e7c737daf
SSDEEP 192:OpO/24UZmQ1CtwDVa/qAAut5STtx7b63N4e0j4jLGZ9+ef3AU:OE/24iewDVuJt5aH/q4e3eZP
MD5 SHA1 SHA512 SSDEEP

Submit Download

uwjfb.opb

Path C:\Users\Admin\AppData\Local\Temp\uwjfb.opb
Size 469KB
SHA256 5cf00b22782985be9b9663a7452bfafa4a8ab453cf34a4b4ad6d96c2cdbcd62c
MD5 d70316f25d6f61a3ce4bff0fc63b8765
SHA1 157f3fd304ca8461215220129a995e202bdd0aeb
SHA512 098fd81b17536a427563e113c6d98dae4881059488af216dfc219191a0ee0018ff0a745a960eab2f77527b7d1829b3d56aa0a9e6e9f376bcae023953fc631e9d
SSDEEP 12288:ZAI2cp8c5m28k8swSHgkct+vUrJXRuuH73Z6h1:Yc95nESA2Ouub3S
MD5 SHA1 SHA512 SSDEEP

Submit Download

wrhpkzrfsy.exe

Path C:\Users\Admin\AppData\Local\Temp\wrhpkzrfsy.exe
Size 7KB
SHA256 60b56f3f784d21da3a18156269e2eda3b84ae715e86724056cf34e986bc62be6
MD5 090f307e0c9b05d868b17f9a248a9de9
SHA1 6585cc35ec435404ae991bafaab9e561c14cab8c
SHA512 cefcd6d7236848bd1b50a38ffb2d2f3c9065b0482980b0f1d29478a50e582b5be3c73afc409deccfa0e1194444a45ef7a90b57e72d72e0db565e6c31a554def1
SSDEEP 96:02cQX5ZVjZDzaZHodkrpNddkSPOoynlnE7plgt2/WWK1SrxLB:02c455zwHoOpH5POoynlEtl7+WNhB
MD5 SHA1 SHA512 SSDEEP

Submit Download

wrhpkzrfsy.exe

Path C:\Users\Admin\AppData\Local\Temp\wrhpkzrfsy.exe
Size 7KB
SHA256 60b56f3f784d21da3a18156269e2eda3b84ae715e86724056cf34e986bc62be6
MD5 090f307e0c9b05d868b17f9a248a9de9
SHA1 6585cc35ec435404ae991bafaab9e561c14cab8c
SHA512 cefcd6d7236848bd1b50a38ffb2d2f3c9065b0482980b0f1d29478a50e582b5be3c73afc409deccfa0e1194444a45ef7a90b57e72d72e0db565e6c31a554def1
SSDEEP 96:02cQX5ZVjZDzaZHodkrpNddkSPOoynlnE7plgt2/WWK1SrxLB:02c455zwHoOpH5POoynlEtl7+WNhB
MD5 SHA1 SHA512 SSDEEP

Submit Download

wrhpkzrfsy.exe

Path C:\Users\Admin\AppData\Local\Temp\wrhpkzrfsy.exe
Size 7KB
SHA256 60b56f3f784d21da3a18156269e2eda3b84ae715e86724056cf34e986bc62be6
MD5 090f307e0c9b05d868b17f9a248a9de9
SHA1 6585cc35ec435404ae991bafaab9e561c14cab8c
SHA512 cefcd6d7236848bd1b50a38ffb2d2f3c9065b0482980b0f1d29478a50e582b5be3c73afc409deccfa0e1194444a45ef7a90b57e72d72e0db565e6c31a554def1
SSDEEP 96:02cQX5ZVjZDzaZHodkrpNddkSPOoynlnE7plgt2/WWK1SrxLB:02c455zwHoOpH5POoynlEtl7+WNhB
MD5 SHA1 SHA512 SSDEEP

Submit Download

wrhpkzrfsy.exe

Path \Users\Admin\AppData\Local\Temp\wrhpkzrfsy.exe
Size 7KB
SHA256 60b56f3f784d21da3a18156269e2eda3b84ae715e86724056cf34e986bc62be6
MD5 090f307e0c9b05d868b17f9a248a9de9
SHA1 6585cc35ec435404ae991bafaab9e561c14cab8c
SHA512 cefcd6d7236848bd1b50a38ffb2d2f3c9065b0482980b0f1d29478a50e582b5be3c73afc409deccfa0e1194444a45ef7a90b57e72d72e0db565e6c31a554def1
SSDEEP 96:02cQX5ZVjZDzaZHodkrpNddkSPOoynlnE7plgt2/WWK1SrxLB:02c455zwHoOpH5POoynlEtl7+WNhB
MD5 SHA1 SHA512 SSDEEP

Submit Download

wrhpkzrfsy.exe

Path \Users\Admin\AppData\Local\Temp\wrhpkzrfsy.exe
Size 7KB
SHA256 60b56f3f784d21da3a18156269e2eda3b84ae715e86724056cf34e986bc62be6
MD5 090f307e0c9b05d868b17f9a248a9de9
SHA1 6585cc35ec435404ae991bafaab9e561c14cab8c
SHA512 cefcd6d7236848bd1b50a38ffb2d2f3c9065b0482980b0f1d29478a50e582b5be3c73afc409deccfa0e1194444a45ef7a90b57e72d72e0db565e6c31a554def1
SSDEEP 96:02cQX5ZVjZDzaZHodkrpNddkSPOoynlnE7plgt2/WWK1SrxLB:02c455zwHoOpH5POoynlEtl7+WNhB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1048-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Download

memory/1372-66-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1372-67-0x0000000000400000-0x000000000047F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads