remcos | c2013fad6a1941c7f9958fb93cb178ff4fa76fcc698f0aef9260f68798c2f626

Analysis

max time kernel
152s
max time network
202s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07/12/2022, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Contract Draft.exe
Size 1.2MB
Sample221207-rnfsnafb53
SHA256 c2013fad6a1941c7f9958fb93cb178ff4fa76fcc698f0aef9260f68798c2f626
MD5 48ffc4ac92f5c5c2d263ba5dfadbec4b
SHA1 713a8f2630d96c6412d92382941a11a89f50ab73
SHA512 a18188ec5fc171cd333cae03ed08285a87632d6a65729fc7b0dbf41719d97956f162955a5ee2d073741187c18c7135653ae87daec164b9de2acd5e970b830f79
SSDEEP 24576:DjiAKI2U8qDJYJo9b1tKnnrOpV5HbioRcpDxwg5+RI:DjipXU8qmQYrOpfHbi0cp7e
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

brremcoz1.ddns.net:3270

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-GF6GEY
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
1496	remcos.exe
1360	remcos.exe

Loads dropped DLL 1 IoCs

pid	Process
808	cmd.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	Contract Draft.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Contract Draft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	Contract Draft.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	Contract Draft.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1636 set thread context of 1320	1636	Contract Draft.exe	32
PID 1496 set thread context of 1360	1496	remcos.exe	39

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
772	schtasks.exe
1300	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1636	Contract Draft.exe
1636	Contract Draft.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1636	Contract Draft.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1360	remcos.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 1300	1636	Contract Draft.exe	28
PID 1636 wrote to memory of 1300	1636	Contract Draft.exe	28
PID 1636 wrote to memory of 1300	1636	Contract Draft.exe	28
PID 1636 wrote to memory of 1300	1636	Contract Draft.exe	28
PID 1636 wrote to memory of 268	1636	Contract Draft.exe	30
PID 1636 wrote to memory of 268	1636	Contract Draft.exe	30
PID 1636 wrote to memory of 268	1636	Contract Draft.exe	30
PID 1636 wrote to memory of 268	1636	Contract Draft.exe	30
PID 1636 wrote to memory of 1176	1636	Contract Draft.exe	31
PID 1636 wrote to memory of 1176	1636	Contract Draft.exe	31
PID 1636 wrote to memory of 1176	1636	Contract Draft.exe	31
PID 1636 wrote to memory of 1176	1636	Contract Draft.exe	31
PID 1636 wrote to memory of 1320	1636	Contract Draft.exe	32
PID 1636 wrote to memory of 1320	1636	Contract Draft.exe	32
PID 1636 wrote to memory of 1320	1636	Contract Draft.exe	32
PID 1636 wrote to memory of 1320	1636	Contract Draft.exe	32
PID 1636 wrote to memory of 1320	1636	Contract Draft.exe	32
PID 1636 wrote to memory of 1320	1636	Contract Draft.exe	32
PID 1636 wrote to memory of 1320	1636	Contract Draft.exe	32
PID 1636 wrote to memory of 1320	1636	Contract Draft.exe	32
PID 1636 wrote to memory of 1320	1636	Contract Draft.exe	32
PID 1636 wrote to memory of 1320	1636	Contract Draft.exe	32
PID 1636 wrote to memory of 1320	1636	Contract Draft.exe	32
PID 1636 wrote to memory of 1320	1636	Contract Draft.exe	32
PID 1636 wrote to memory of 1320	1636	Contract Draft.exe	32
PID 1320 wrote to memory of 1540	1320	Contract Draft.exe	33
PID 1320 wrote to memory of 1540	1320	Contract Draft.exe	33
PID 1320 wrote to memory of 1540	1320	Contract Draft.exe	33
PID 1320 wrote to memory of 1540	1320	Contract Draft.exe	33
PID 1540 wrote to memory of 808	1540	WScript.exe	34
PID 1540 wrote to memory of 808	1540	WScript.exe	34
PID 1540 wrote to memory of 808	1540	WScript.exe	34
PID 1540 wrote to memory of 808	1540	WScript.exe	34
PID 808 wrote to memory of 1496	808	cmd.exe	36
PID 808 wrote to memory of 1496	808	cmd.exe	36
PID 808 wrote to memory of 1496	808	cmd.exe	36
PID 808 wrote to memory of 1496	808	cmd.exe	36
PID 1496 wrote to memory of 772	1496	remcos.exe	37
PID 1496 wrote to memory of 772	1496	remcos.exe	37
PID 1496 wrote to memory of 772	1496	remcos.exe	37
PID 1496 wrote to memory of 772	1496	remcos.exe	37
PID 1496 wrote to memory of 1360	1496	remcos.exe	39
PID 1496 wrote to memory of 1360	1496	remcos.exe	39
PID 1496 wrote to memory of 1360	1496	remcos.exe	39
PID 1496 wrote to memory of 1360	1496	remcos.exe	39
PID 1496 wrote to memory of 1360	1496	remcos.exe	39
PID 1496 wrote to memory of 1360	1496	remcos.exe	39
PID 1496 wrote to memory of 1360	1496	remcos.exe	39
PID 1496 wrote to memory of 1360	1496	remcos.exe	39
PID 1496 wrote to memory of 1360	1496	remcos.exe	39
PID 1496 wrote to memory of 1360	1496	remcos.exe	39
PID 1496 wrote to memory of 1360	1496	remcos.exe	39
PID 1496 wrote to memory of 1360	1496	remcos.exe	39
PID 1496 wrote to memory of 1360	1496	remcos.exe	39

C:\Users\Admin\AppData\Local\Temp\Contract Draft.exe
"C:\Users\Admin\AppData\Local\Temp\Contract Draft.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IReQLtJWFB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp954E.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1300
- C:\Users\Admin\AppData\Local\Temp\Contract Draft.exe
  "{path}"
  2⤵
  PID:268
- C:\Users\Admin\AppData\Local\Temp\Contract Draft.exe
  "{path}"
  2⤵
  PID:1176
- C:\Users\Admin\AppData\Local\Temp\Contract Draft.exe
  "{path}"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1540
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:808
    - - C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1496
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IReQLtJWFB" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD347.tmp"
        6⤵
        Creates scheduled task(s)
        
        PID:772
      - C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        "{path}"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:1360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 418B
SHA256 fa20e9aab03dc8e9f1910aaf0cf42662379fa16ae3a22642084fb97fa3d4f83a
MD5 b92d64fe5b1d1f59df4b738262aea8df
SHA1 c8fb1981759c2d9bb2ec91b705985fba5fc7af63
SHA512 2566248b93c0cfb0414f033b8dd18bbd4f88180093eac2861107289bcb4ee160f9593706ff1f7d1f2e4ecea430d67a5a2897551a4f9ebd82b707243e300520e2
MD5 SHA1 SHA512

Submit Download

tmp954E.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp954E.tmp
Size 1KB
SHA256 c923d1774487c7b1c862cebb71917cbe9ac7cb05dbeacd68978c320a3fda5e44
MD5 f322d3ffeb08cb6ce2708eb8e732fcce
SHA1 6ac37e99721bccc5856fbec03c3cf2313ed71db9
SHA512 e2390b54792effc588794bf193f58a9031fa03bdf63038d5e824598193cf099cb5279541c8995483976320567308b11393a507000ed5098e6ef89e486c14a1fe
MD5 SHA1 SHA512

Submit Download

tmpD347.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpD347.tmp
Size 1KB
SHA256 c923d1774487c7b1c862cebb71917cbe9ac7cb05dbeacd68978c320a3fda5e44
MD5 f322d3ffeb08cb6ce2708eb8e732fcce
SHA1 6ac37e99721bccc5856fbec03c3cf2313ed71db9
SHA512 e2390b54792effc588794bf193f58a9031fa03bdf63038d5e824598193cf099cb5279541c8995483976320567308b11393a507000ed5098e6ef89e486c14a1fe
MD5 SHA1 SHA512

Submit Download

remcos.exe

Path C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
Size 1.2MB
SHA256 c2013fad6a1941c7f9958fb93cb178ff4fa76fcc698f0aef9260f68798c2f626
MD5 48ffc4ac92f5c5c2d263ba5dfadbec4b
SHA1 713a8f2630d96c6412d92382941a11a89f50ab73
SHA512 a18188ec5fc171cd333cae03ed08285a87632d6a65729fc7b0dbf41719d97956f162955a5ee2d073741187c18c7135653ae87daec164b9de2acd5e970b830f79
SSDEEP 24576:DjiAKI2U8qDJYJo9b1tKnnrOpV5HbioRcpDxwg5+RI:DjipXU8qmQYrOpfHbi0cp7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

remcos.exe

Path C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
Size 1.2MB
SHA256 c2013fad6a1941c7f9958fb93cb178ff4fa76fcc698f0aef9260f68798c2f626
MD5 48ffc4ac92f5c5c2d263ba5dfadbec4b
SHA1 713a8f2630d96c6412d92382941a11a89f50ab73
SHA512 a18188ec5fc171cd333cae03ed08285a87632d6a65729fc7b0dbf41719d97956f162955a5ee2d073741187c18c7135653ae87daec164b9de2acd5e970b830f79
SSDEEP 24576:DjiAKI2U8qDJYJo9b1tKnnrOpV5HbioRcpDxwg5+RI:DjipXU8qmQYrOpfHbi0cp7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

remcos.exe

Path C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
Size 1.2MB
SHA256 c2013fad6a1941c7f9958fb93cb178ff4fa76fcc698f0aef9260f68798c2f626
MD5 48ffc4ac92f5c5c2d263ba5dfadbec4b
SHA1 713a8f2630d96c6412d92382941a11a89f50ab73
SHA512 a18188ec5fc171cd333cae03ed08285a87632d6a65729fc7b0dbf41719d97956f162955a5ee2d073741187c18c7135653ae87daec164b9de2acd5e970b830f79
SSDEEP 24576:DjiAKI2U8qDJYJo9b1tKnnrOpV5HbioRcpDxwg5+RI:DjipXU8qmQYrOpfHbi0cp7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

remcos.exe

Path \Users\Admin\AppData\Roaming\Remcos\remcos.exe
Size 1.2MB
SHA256 c2013fad6a1941c7f9958fb93cb178ff4fa76fcc698f0aef9260f68798c2f626
MD5 48ffc4ac92f5c5c2d263ba5dfadbec4b
SHA1 713a8f2630d96c6412d92382941a11a89f50ab73
SHA512 a18188ec5fc171cd333cae03ed08285a87632d6a65729fc7b0dbf41719d97956f162955a5ee2d073741187c18c7135653ae87daec164b9de2acd5e970b830f79
SSDEEP 24576:DjiAKI2U8qDJYJo9b1tKnnrOpV5HbioRcpDxwg5+RI:DjipXU8qmQYrOpfHbi0cp7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1320-78-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1320-62-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1320-68-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1320-69-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1320-71-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1320-73-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1320-77-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1320-61-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1320-67-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1320-80-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1320-66-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1320-64-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1360-112-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1360-111-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1360-110-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1496-88-0x0000000000F70000-0x00000000010AC000-memory.dmp

Download

memory/1496-90-0x00000000002D0000-0x00000000002E2000-memory.dmp

Download

memory/1636-57-0x0000000005A30000-0x0000000005B12000-memory.dmp

Download

memory/1636-55-0x00000000757B1000-0x00000000757B3000-memory.dmp

Download

memory/1636-56-0x0000000000380000-0x0000000000392000-memory.dmp

Download

memory/1636-58-0x0000000004B60000-0x0000000004C00000-memory.dmp

Download

memory/1636-54-0x0000000000E60000-0x0000000000F9C000-memory.dmp

Download