remcos | ba821e2f6571df5cee19a5418cbf07983f71ceb9f3c01da2bebfd9832cb698f3

Analysis

max time kernel
147s
max time network
130s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
19/12/2022, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WECC2263FXT1385.exe
Size 616KB
Sample221219-ss15tsfc87
SHA256 ba821e2f6571df5cee19a5418cbf07983f71ceb9f3c01da2bebfd9832cb698f3
MD5 7422529e2fabf5d88c882e9ab8020f37
SHA1 9f81297f4d2bf82a35f79f5fd9885d8cb8214fa1
SHA512 5df6166db60a31b17dd373fecbc4381295495f1f5e95804654b862131cce423dc5a2096c7f738f533a2842d1d3a903a2f7490afd635746a8161da41500443b29
SSDEEP 12288:3SVTjSqmCt38XNBFvsDaNXc6e+f3gdJrXVNqYCi/fI:31Zo8XNne8Qnr6YN3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos awele-host rat

Malware Config

Extracted

Family

remcos

Botnet

Awele-Host

gdyhjjdhbvxgsfe.gotdns.ch:2718

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
qos.exe
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_path
%AppData%
mouse_option
false
mutex
Rmc-BMFNKP
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Jm
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.exe	Powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1764 set thread context of 692	1764	WECC2263FXT1385.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1312	Powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1764	WECC2263FXT1385.exe
Token: SeDebugPrivilege	1312	Powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
692	RegSvcs.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1312	1764	WECC2263FXT1385.exe	28
PID 1764 wrote to memory of 1312	1764	WECC2263FXT1385.exe	28
PID 1764 wrote to memory of 1312	1764	WECC2263FXT1385.exe	28
PID 1764 wrote to memory of 1312	1764	WECC2263FXT1385.exe	28
PID 1764 wrote to memory of 692	1764	WECC2263FXT1385.exe	30
PID 1764 wrote to memory of 692	1764	WECC2263FXT1385.exe	30
PID 1764 wrote to memory of 692	1764	WECC2263FXT1385.exe	30
PID 1764 wrote to memory of 692	1764	WECC2263FXT1385.exe	30
PID 1764 wrote to memory of 692	1764	WECC2263FXT1385.exe	30
PID 1764 wrote to memory of 692	1764	WECC2263FXT1385.exe	30
PID 1764 wrote to memory of 692	1764	WECC2263FXT1385.exe	30
PID 1764 wrote to memory of 692	1764	WECC2263FXT1385.exe	30
PID 1764 wrote to memory of 692	1764	WECC2263FXT1385.exe	30
PID 1764 wrote to memory of 692	1764	WECC2263FXT1385.exe	30
PID 1764 wrote to memory of 692	1764	WECC2263FXT1385.exe	30
PID 1764 wrote to memory of 692	1764	WECC2263FXT1385.exe	30
PID 1764 wrote to memory of 692	1764	WECC2263FXT1385.exe	30
PID 1764 wrote to memory of 692	1764	WECC2263FXT1385.exe	30
PID 1764 wrote to memory of 692	1764	WECC2263FXT1385.exe	30
PID 1764 wrote to memory of 692	1764	WECC2263FXT1385.exe	30

C:\Users\Admin\AppData\Local\Temp\WECC2263FXT1385.exe
"C:\Users\Admin\AppData\Local\Temp\WECC2263FXT1385.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
  "Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\WECC2263FXT1385.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.exe'
  2⤵
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1312
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/692-65-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/692-67-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/692-79-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/692-66-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/692-59-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/692-60-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/692-62-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/692-64-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/692-77-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/692-75-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/692-69-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/692-71-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1312-76-0x00000000702B0000-0x000000007085B000-memory.dmp

Download

memory/1312-78-0x00000000702B0000-0x000000007085B000-memory.dmp

Download

memory/1764-57-0x0000000000280000-0x000000000029C000-memory.dmp

Download

memory/1764-54-0x00000000002A0000-0x000000000033A000-memory.dmp

Download

memory/1764-55-0x00000000763D1000-0x00000000763D3000-memory.dmp

Download