remcos | cfc1ce14ea47f2cd1bfe204a9f6c3bc90cce83c7f4714b22e13bdba3a0f2ab24

Analysis

max time kernel
156s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 00:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a82700161c7914a19d7fa227e6bc7903.exe
Size 2.5MB
Sample221201-at4m8shb76
SHA256 cfc1ce14ea47f2cd1bfe204a9f6c3bc90cce83c7f4714b22e13bdba3a0f2ab24
MD5 a82700161c7914a19d7fa227e6bc7903
SHA1 34aa3bff8551a30599cda4f409540bd36294e80e
SHA512 0765144369ab4f5f51f20cf8794a304822b9935f1850d1670137707336573236922b6b7095214bdb9819d6a287e1767492cfd25022e7cb9531bcf9d61a7af5ed
SSDEEP 49152:idz8DuueHSdvKilDOLVKVi97UhyNybAxGFfvAFeCzlACqv6Ec1nHVP4WSUyv99IX:iVCdeyFKil0VIUo82Ax2HAFe4lACZEm1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos wesndayshost rat

Malware Config

Extracted

Family

remcos

Botnet

WesndaysHost

aryexpcrt.ddns.net:4982

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-Q2UDS3
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	a82700161c7914a19d7fa227e6bc7903.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1556 set thread context of 3248	1556	a82700161c7914a19d7fa227e6bc7903.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1640	powershell.exe
1640	powershell.exe
4088	powershell.exe
4088	powershell.exe
1556	a82700161c7914a19d7fa227e6bc7903.exe
1556	a82700161c7914a19d7fa227e6bc7903.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	powershell.exe
Token: SeDebugPrivilege	1556	a82700161c7914a19d7fa227e6bc7903.exe
Token: SeDebugPrivilege	4088	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3248	a82700161c7914a19d7fa227e6bc7903.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 1640	1556	a82700161c7914a19d7fa227e6bc7903.exe	81
PID 1556 wrote to memory of 1640	1556	a82700161c7914a19d7fa227e6bc7903.exe	81
PID 1556 wrote to memory of 1640	1556	a82700161c7914a19d7fa227e6bc7903.exe	81
PID 1556 wrote to memory of 4088	1556	a82700161c7914a19d7fa227e6bc7903.exe	95
PID 1556 wrote to memory of 4088	1556	a82700161c7914a19d7fa227e6bc7903.exe	95
PID 1556 wrote to memory of 4088	1556	a82700161c7914a19d7fa227e6bc7903.exe	95
PID 1556 wrote to memory of 3108	1556	a82700161c7914a19d7fa227e6bc7903.exe	100
PID 1556 wrote to memory of 3108	1556	a82700161c7914a19d7fa227e6bc7903.exe	100
PID 1556 wrote to memory of 3108	1556	a82700161c7914a19d7fa227e6bc7903.exe	100
PID 1556 wrote to memory of 3248	1556	a82700161c7914a19d7fa227e6bc7903.exe	101
PID 1556 wrote to memory of 3248	1556	a82700161c7914a19d7fa227e6bc7903.exe	101
PID 1556 wrote to memory of 3248	1556	a82700161c7914a19d7fa227e6bc7903.exe	101
PID 1556 wrote to memory of 3248	1556	a82700161c7914a19d7fa227e6bc7903.exe	101
PID 1556 wrote to memory of 3248	1556	a82700161c7914a19d7fa227e6bc7903.exe	101
PID 1556 wrote to memory of 3248	1556	a82700161c7914a19d7fa227e6bc7903.exe	101
PID 1556 wrote to memory of 3248	1556	a82700161c7914a19d7fa227e6bc7903.exe	101
PID 1556 wrote to memory of 3248	1556	a82700161c7914a19d7fa227e6bc7903.exe	101
PID 1556 wrote to memory of 3248	1556	a82700161c7914a19d7fa227e6bc7903.exe	101
PID 1556 wrote to memory of 3248	1556	a82700161c7914a19d7fa227e6bc7903.exe	101
PID 1556 wrote to memory of 3248	1556	a82700161c7914a19d7fa227e6bc7903.exe	101
PID 1556 wrote to memory of 3248	1556	a82700161c7914a19d7fa227e6bc7903.exe	101

C:\Users\Admin\AppData\Local\Temp\a82700161c7914a19d7fa227e6bc7903.exe
"C:\Users\Admin\AppData\Local\Temp\a82700161c7914a19d7fa227e6bc7903.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-Date
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1640
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4088
- C:\Users\Admin\AppData\Local\Temp\a82700161c7914a19d7fa227e6bc7903.exe
  C:\Users\Admin\AppData\Local\Temp\a82700161c7914a19d7fa227e6bc7903.exe
  2⤵
  PID:3108
- C:\Users\Admin\AppData\Local\Temp\a82700161c7914a19d7fa227e6bc7903.exe
  C:\Users\Admin\AppData\Local\Temp\a82700161c7914a19d7fa227e6bc7903.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3248

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 17KB
SHA256 5833a625dc2d0102ed5ceeed6e01552dd12adbab67185ce00343806f9dcf9dbe
MD5 44567e9ffb4e4668395648e05cba48ba
SHA1 98630900976b7ded30e9bfa65b24df96bb6ccd7e
SHA512 6ac17c5286d61f1db8c00e9f16fb4ec244da73434278082e115f65ad2194b8cfd2217af0e45e2f3001d3be42806111222686c4eab15883284b52e6eaa924bb1f
SSDEEP 384:Trf+BU9i+u92CrX3SdQ6Yo9owThK6seYjsE/ki3SoZ2YSorjEChCDHrSSSf:3fEPbCjowThNULzSj+fECj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1556-139-0x0000000005FA0000-0x0000000005FAA000-memory.dmp

Download

memory/1556-134-0x0000000005740000-0x0000000005CE4000-memory.dmp

Download

memory/1556-136-0x0000000005FD0000-0x0000000006062000-memory.dmp

Download

memory/1556-133-0x0000000000660000-0x00000000008DE000-memory.dmp

Download

memory/1640-138-0x0000000005540000-0x0000000005B68000-memory.dmp

Download

memory/1640-141-0x00000000053A0000-0x0000000005406000-memory.dmp

Download

memory/1640-142-0x0000000005C70000-0x0000000005CD6000-memory.dmp

Download

memory/1640-143-0x0000000006330000-0x000000000634E000-memory.dmp

Download

memory/1640-144-0x0000000007A40000-0x00000000080BA000-memory.dmp

Download

memory/1640-145-0x0000000006820000-0x000000000683A000-memory.dmp

Download

memory/1640-140-0x0000000005300000-0x0000000005322000-memory.dmp

Download

memory/1640-137-0x0000000002970000-0x00000000029A6000-memory.dmp

Download

memory/3248-151-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3248-152-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3248-153-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3248-154-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3248-155-0x0000000000400000-0x000000000047F000-memory.dmp

Download