remcos | 1dec2e1465205a4a69f71ce916c2f970072b8e6b1b075748bed557f3449940b4

Analysis

max time kernel
137s
max time network
130s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
06-12-2022 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ProcessKO.exe
Size

124KB
MD5

ca8cb6abd81db6107fe35cfbb7cbd8e6
SHA1

4a645ae8ab0da7092503e9cee6ce66032897a0af
SHA256

1dec2e1465205a4a69f71ce916c2f970072b8e6b1b075748bed557f3449940b4
SHA512

1046274e86986ae1f48ac47a63cb65bbc1761266169a9ed6b38461589293110779dc1f9587eef51c833e361a959c2a37a8edbf11980df471e29964a8259a41cd
SSDEEP

3072:tYZXD5IEkbYx2jHtmk0NdAL9cRu8rox/A7pZ5QmxeY+zQMNQIbJ:tYZXFEY47tP0UpKmA7pZ5QmxL+zQMNQI

Score

10^/10

remcos planes2 persistence rat

Malware Config

Extracted

Family

remcos

Version

2.2.0 Pro

Botnet

Planes2

remfff.duckdns.org:48604

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
csrss.exe
copy_folder
csrss.exe
delete_file
false
hide_file
true
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
RemcosXs-H20591
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
csrss.exe
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 1 IoCs

Processes:

csrss.exe

pid process

4492 csrss.exe

pid	process
4492	csrss.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ProcessKO.execsrss.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\	ProcessKO.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\csrss.exe\\csrss.exe\""	ProcessKO.exe
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\csrss.exe\\csrss.exe\""	csrss.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

ProcessKO.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings ProcessKO.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

csrss.exe

pid process

4492 csrss.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

csrss.exe

pid process

4492 csrss.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000_Classes\Local Settings	ProcessKO.exe

pid	process
4492	csrss.exe

pid	process
4492	csrss.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

ProcessKO.exeWScript.execmd.exe

description	pid	process	target process
PID 4940 wrote to memory of 4324	4940	ProcessKO.exe	WScript.exe
PID 4940 wrote to memory of 4324	4940	ProcessKO.exe	WScript.exe
PID 4940 wrote to memory of 4324	4940	ProcessKO.exe	WScript.exe
PID 4324 wrote to memory of 3340	4324	WScript.exe	cmd.exe
PID 4324 wrote to memory of 3340	4324	WScript.exe	cmd.exe
PID 4324 wrote to memory of 3340	4324	WScript.exe	cmd.exe
PID 3340 wrote to memory of 4492	3340	cmd.exe	csrss.exe
PID 3340 wrote to memory of 4492	3340	cmd.exe	csrss.exe
PID 3340 wrote to memory of 4492	3340	cmd.exe	csrss.exe

C:\Users\Admin\AppData\Local\Temp\ProcessKO.exe
"C:\Users\Admin\AppData\Local\Temp\ProcessKO.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4940

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
2⤵
- Suspicious use of WriteProcessMemory
PID:4324

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\csrss.exe\csrss.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:3340

C:\Users\Admin\AppData\Roaming\csrss.exe\csrss.exe
C:\Users\Admin\AppData\Roaming\csrss.exe\csrss.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4492

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs
Filesize
422B

MD5
f3ed21a8dbf48ccf6487d68cd12b8e89

SHA1
37b725cdc3bb8b91cb6242529721a2c3f1f03af2

SHA256
a2c8cc5a927929bb186c39f2deefa5ca869ab705ada7b13c2687a54c99df0416

SHA512
da85bc3517b3d085a29ae9c1a200ca7ae6c46f6bff4d5dc199bf493e6eda9cd223acf3945a4e24ae24f5a7fbc134f0345d725a6af1061b6c3f526ffec599851f

Download Submit
C:\Users\Admin\AppData\Roaming\csrss.exe\csrss.exe
Filesize
124KB

MD5
ca8cb6abd81db6107fe35cfbb7cbd8e6

SHA1
4a645ae8ab0da7092503e9cee6ce66032897a0af

SHA256
1dec2e1465205a4a69f71ce916c2f970072b8e6b1b075748bed557f3449940b4

SHA512
1046274e86986ae1f48ac47a63cb65bbc1761266169a9ed6b38461589293110779dc1f9587eef51c833e361a959c2a37a8edbf11980df471e29964a8259a41cd

Download Submit
C:\Users\Admin\AppData\Roaming\csrss.exe\csrss.exe
Filesize
124KB

MD5
ca8cb6abd81db6107fe35cfbb7cbd8e6

SHA1
4a645ae8ab0da7092503e9cee6ce66032897a0af

SHA256
1dec2e1465205a4a69f71ce916c2f970072b8e6b1b075748bed557f3449940b4

SHA512
1046274e86986ae1f48ac47a63cb65bbc1761266169a9ed6b38461589293110779dc1f9587eef51c833e361a959c2a37a8edbf11980df471e29964a8259a41cd

Download Submit
memory/3340-234-0x0000000000000000-mapping.dmp

Download
memory/4324-180-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-178-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-172-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-177-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-179-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-181-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-167-0x0000000000000000-mapping.dmp

Download
memory/4324-170-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-174-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-176-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-175-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-173-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-168-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-169-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4324-171-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4492-247-0x0000000000000000-mapping.dmp

Download
memory/4940-134-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-159-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-139-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-140-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-141-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-142-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-143-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-144-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-145-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-146-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-147-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-148-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-150-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-149-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-151-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-152-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-153-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-154-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-155-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-156-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-157-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-158-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-161-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-160-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-162-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-138-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-163-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-164-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-165-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-166-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-137-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-136-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-135-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-117-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-133-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-132-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-131-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-130-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-129-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-128-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-127-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-126-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-125-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-124-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-123-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-122-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-121-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-120-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-119-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download
memory/4940-118-0x0000000077B00000-0x0000000077C8E000-memory.dmp

Filesize
1.6MB

Download