remcos | c2013fad6a1941c7f9958fb93cb178ff4fa76fcc698f0aef9260f68798c2f626

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Contract Draft.exe
Size 1.2MB
Sample221207-rnfsnafb53
SHA256 c2013fad6a1941c7f9958fb93cb178ff4fa76fcc698f0aef9260f68798c2f626
MD5 48ffc4ac92f5c5c2d263ba5dfadbec4b
SHA1 713a8f2630d96c6412d92382941a11a89f50ab73
SHA512 a18188ec5fc171cd333cae03ed08285a87632d6a65729fc7b0dbf41719d97956f162955a5ee2d073741187c18c7135653ae87daec164b9de2acd5e970b830f79
SSDEEP 24576:DjiAKI2U8qDJYJo9b1tKnnrOpV5HbioRcpDxwg5+RI:DjipXU8qmQYrOpfHbi0cp7e
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

brremcoz1.ddns.net:3270

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-GF6GEY
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 4 IoCs

pid	Process
4816	remcos.exe
1652	remcos.exe
3508	remcos.exe
4516	remcos.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Contract Draft.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Contract Draft.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	remcos.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	Contract Draft.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	Contract Draft.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Contract Draft.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	Contract Draft.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3140 set thread context of 4480	3140	Contract Draft.exe	88
PID 4816 set thread context of 4516	4816	remcos.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4364	schtasks.exe
764	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	Contract Draft.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3140	Contract Draft.exe
3140	Contract Draft.exe
3140	Contract Draft.exe
3140	Contract Draft.exe
4816	remcos.exe
4816	remcos.exe
4816	remcos.exe
4816	remcos.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3140	Contract Draft.exe
Token: SeDebugPrivilege	4816	remcos.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4516	remcos.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 4364	3140	Contract Draft.exe	84
PID 3140 wrote to memory of 4364	3140	Contract Draft.exe	84
PID 3140 wrote to memory of 4364	3140	Contract Draft.exe	84
PID 3140 wrote to memory of 3856	3140	Contract Draft.exe	86
PID 3140 wrote to memory of 3856	3140	Contract Draft.exe	86
PID 3140 wrote to memory of 3856	3140	Contract Draft.exe	86
PID 3140 wrote to memory of 4552	3140	Contract Draft.exe	87
PID 3140 wrote to memory of 4552	3140	Contract Draft.exe	87
PID 3140 wrote to memory of 4552	3140	Contract Draft.exe	87
PID 3140 wrote to memory of 4480	3140	Contract Draft.exe	88
PID 3140 wrote to memory of 4480	3140	Contract Draft.exe	88
PID 3140 wrote to memory of 4480	3140	Contract Draft.exe	88
PID 3140 wrote to memory of 4480	3140	Contract Draft.exe	88
PID 3140 wrote to memory of 4480	3140	Contract Draft.exe	88
PID 3140 wrote to memory of 4480	3140	Contract Draft.exe	88
PID 3140 wrote to memory of 4480	3140	Contract Draft.exe	88
PID 3140 wrote to memory of 4480	3140	Contract Draft.exe	88
PID 3140 wrote to memory of 4480	3140	Contract Draft.exe	88
PID 3140 wrote to memory of 4480	3140	Contract Draft.exe	88
PID 3140 wrote to memory of 4480	3140	Contract Draft.exe	88
PID 3140 wrote to memory of 4480	3140	Contract Draft.exe	88
PID 4480 wrote to memory of 4764	4480	Contract Draft.exe	89
PID 4480 wrote to memory of 4764	4480	Contract Draft.exe	89
PID 4480 wrote to memory of 4764	4480	Contract Draft.exe	89
PID 4764 wrote to memory of 4596	4764	WScript.exe	90
PID 4764 wrote to memory of 4596	4764	WScript.exe	90
PID 4764 wrote to memory of 4596	4764	WScript.exe	90
PID 4596 wrote to memory of 4816	4596	cmd.exe	92
PID 4596 wrote to memory of 4816	4596	cmd.exe	92
PID 4596 wrote to memory of 4816	4596	cmd.exe	92
PID 4816 wrote to memory of 764	4816	remcos.exe	93
PID 4816 wrote to memory of 764	4816	remcos.exe	93
PID 4816 wrote to memory of 764	4816	remcos.exe	93
PID 4816 wrote to memory of 1652	4816	remcos.exe	95
PID 4816 wrote to memory of 1652	4816	remcos.exe	95
PID 4816 wrote to memory of 1652	4816	remcos.exe	95
PID 4816 wrote to memory of 3508	4816	remcos.exe	96
PID 4816 wrote to memory of 3508	4816	remcos.exe	96
PID 4816 wrote to memory of 3508	4816	remcos.exe	96
PID 4816 wrote to memory of 4516	4816	remcos.exe	97
PID 4816 wrote to memory of 4516	4816	remcos.exe	97
PID 4816 wrote to memory of 4516	4816	remcos.exe	97
PID 4816 wrote to memory of 4516	4816	remcos.exe	97
PID 4816 wrote to memory of 4516	4816	remcos.exe	97
PID 4816 wrote to memory of 4516	4816	remcos.exe	97
PID 4816 wrote to memory of 4516	4816	remcos.exe	97
PID 4816 wrote to memory of 4516	4816	remcos.exe	97
PID 4816 wrote to memory of 4516	4816	remcos.exe	97
PID 4816 wrote to memory of 4516	4816	remcos.exe	97
PID 4816 wrote to memory of 4516	4816	remcos.exe	97
PID 4816 wrote to memory of 4516	4816	remcos.exe	97

C:\Users\Admin\AppData\Local\Temp\Contract Draft.exe
"C:\Users\Admin\AppData\Local\Temp\Contract Draft.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IReQLtJWFB" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEF4.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4364
- C:\Users\Admin\AppData\Local\Temp\Contract Draft.exe
  "{path}"
  2⤵
  PID:3856
- C:\Users\Admin\AppData\Local\Temp\Contract Draft.exe
  "{path}"
  2⤵
  PID:4552
- C:\Users\Admin\AppData\Local\Temp\Contract Draft.exe
  "{path}"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4764
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4596
    - - C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4816
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IReQLtJWFB" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBB51.tmp"
        6⤵
        Creates scheduled task(s)
        
        PID:764
      - C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        "{path}"
        6⤵
        Executes dropped EXE
        
        PID:1652
      - C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        "{path}"
        6⤵
        Executes dropped EXE
        
        PID:3508
      - C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
        
        "{path}"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:4516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 418B
SHA256 fa20e9aab03dc8e9f1910aaf0cf42662379fa16ae3a22642084fb97fa3d4f83a
MD5 b92d64fe5b1d1f59df4b738262aea8df
SHA1 c8fb1981759c2d9bb2ec91b705985fba5fc7af63
SHA512 2566248b93c0cfb0414f033b8dd18bbd4f88180093eac2861107289bcb4ee160f9593706ff1f7d1f2e4ecea430d67a5a2897551a4f9ebd82b707243e300520e2
MD5 SHA1 SHA512

Submit Download

tmpBB51.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpBB51.tmp
Size 1KB
SHA256 88e914a93e66004adc444727448c90e9ec499779694c591928916bb5a19ed848
MD5 2b3edf7bf7ee61b10468b86118795864
SHA1 1f10a94437eefa0259b31584e3b3ed383d28e4cc
SHA512 e8422b5dbbf56b2bb7a4e3c8da28faf76fde08d4cbc926966379fb9deeab23a7f8688e7a0920e67ce20660f94ac15a9d2d19d2396693ca8585b06c6399b5e56d
MD5 SHA1 SHA512

Submit Download

tmpEF4.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpEF4.tmp
Size 1KB
SHA256 88e914a93e66004adc444727448c90e9ec499779694c591928916bb5a19ed848
MD5 2b3edf7bf7ee61b10468b86118795864
SHA1 1f10a94437eefa0259b31584e3b3ed383d28e4cc
SHA512 e8422b5dbbf56b2bb7a4e3c8da28faf76fde08d4cbc926966379fb9deeab23a7f8688e7a0920e67ce20660f94ac15a9d2d19d2396693ca8585b06c6399b5e56d
MD5 SHA1 SHA512

Submit Download

remcos.exe

Path C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
Size 1.2MB
SHA256 c2013fad6a1941c7f9958fb93cb178ff4fa76fcc698f0aef9260f68798c2f626
MD5 48ffc4ac92f5c5c2d263ba5dfadbec4b
SHA1 713a8f2630d96c6412d92382941a11a89f50ab73
SHA512 a18188ec5fc171cd333cae03ed08285a87632d6a65729fc7b0dbf41719d97956f162955a5ee2d073741187c18c7135653ae87daec164b9de2acd5e970b830f79
SSDEEP 24576:DjiAKI2U8qDJYJo9b1tKnnrOpV5HbioRcpDxwg5+RI:DjipXU8qmQYrOpfHbi0cp7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

remcos.exe

Path C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
Size 1.2MB
SHA256 c2013fad6a1941c7f9958fb93cb178ff4fa76fcc698f0aef9260f68798c2f626
MD5 48ffc4ac92f5c5c2d263ba5dfadbec4b
SHA1 713a8f2630d96c6412d92382941a11a89f50ab73
SHA512 a18188ec5fc171cd333cae03ed08285a87632d6a65729fc7b0dbf41719d97956f162955a5ee2d073741187c18c7135653ae87daec164b9de2acd5e970b830f79
SSDEEP 24576:DjiAKI2U8qDJYJo9b1tKnnrOpV5HbioRcpDxwg5+RI:DjipXU8qmQYrOpfHbi0cp7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

remcos.exe

Path C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
Size 1.2MB
SHA256 c2013fad6a1941c7f9958fb93cb178ff4fa76fcc698f0aef9260f68798c2f626
MD5 48ffc4ac92f5c5c2d263ba5dfadbec4b
SHA1 713a8f2630d96c6412d92382941a11a89f50ab73
SHA512 a18188ec5fc171cd333cae03ed08285a87632d6a65729fc7b0dbf41719d97956f162955a5ee2d073741187c18c7135653ae87daec164b9de2acd5e970b830f79
SSDEEP 24576:DjiAKI2U8qDJYJo9b1tKnnrOpV5HbioRcpDxwg5+RI:DjipXU8qmQYrOpfHbi0cp7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

remcos.exe

Path C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
Size 1.2MB
SHA256 c2013fad6a1941c7f9958fb93cb178ff4fa76fcc698f0aef9260f68798c2f626
MD5 48ffc4ac92f5c5c2d263ba5dfadbec4b
SHA1 713a8f2630d96c6412d92382941a11a89f50ab73
SHA512 a18188ec5fc171cd333cae03ed08285a87632d6a65729fc7b0dbf41719d97956f162955a5ee2d073741187c18c7135653ae87daec164b9de2acd5e970b830f79
SSDEEP 24576:DjiAKI2U8qDJYJo9b1tKnnrOpV5HbioRcpDxwg5+RI:DjipXU8qmQYrOpfHbi0cp7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

remcos.exe

Path C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
Size 1.2MB
SHA256 c2013fad6a1941c7f9958fb93cb178ff4fa76fcc698f0aef9260f68798c2f626
MD5 48ffc4ac92f5c5c2d263ba5dfadbec4b
SHA1 713a8f2630d96c6412d92382941a11a89f50ab73
SHA512 a18188ec5fc171cd333cae03ed08285a87632d6a65729fc7b0dbf41719d97956f162955a5ee2d073741187c18c7135653ae87daec164b9de2acd5e970b830f79
SSDEEP 24576:DjiAKI2U8qDJYJo9b1tKnnrOpV5HbioRcpDxwg5+RI:DjipXU8qmQYrOpfHbi0cp7e
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3140-136-0x0000000004F10000-0x0000000004F1A000-memory.dmp

Download

memory/3140-132-0x00000000003A0000-0x00000000004DC000-memory.dmp

Download

memory/3140-135-0x0000000004FE0000-0x000000000507C000-memory.dmp

Download

memory/3140-134-0x0000000004E60000-0x0000000004EF2000-memory.dmp

Download

memory/3140-133-0x00000000054F0000-0x0000000005A94000-memory.dmp

Download

memory/4480-146-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4480-152-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4480-144-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4480-143-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4480-142-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4516-164-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4516-165-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4516-163-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4516-162-0x0000000000400000-0x000000000047F000-memory.dmp

Download