remcos | 2bff54b9373397bb78dc3dd57f37b85affb564edec73fbb265e9a14d313a2a1d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2023, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
INV20230104-BR.exe
Size 7KB
Sample230104-tym1tscb8z
SHA256 2bff54b9373397bb78dc3dd57f37b85affb564edec73fbb265e9a14d313a2a1d
MD5 7ff9457d0721e01547b556e0c833594c
SHA1 5963c193d856ead444804089ff3f147902c4afe5
SHA512 a3ae95d38a479d563e64674bda4673a4e91eebb1bfe72768a3469d33b4f3c5569662961657fcdfd72526aabe975f4a5b7a07d03c93d4553e017cb215da4b5e68
SSDEEP 96:/wlDWr5PYwMrAobmeXEV2rYvyIohMjZjVtokjr1Zw6kU+nzz1YdaKNp6Ny3EKzNF:4D+PYwMrzEfKm1VtoEsHU+nzHZy5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost collection persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

obologs.work.gd:4044

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-E9KXT7
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/372-154-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/316-156-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/316-157-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 4 IoCs

resource	yara_rule
behavioral2/memory/372-154-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/228-155-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/316-156-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/316-157-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	INV20230104-BR.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	aspnet_compiler.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Afyxoxgok = "\"C:\\Users\\Admin\\AppData\\Roaming\\Crcvc\\Afyxoxgok.exe\""	INV20230104-BR.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 5076 set thread context of 4308	5076	INV20230104-BR.exe	87
PID 4308 set thread context of 316	4308	aspnet_compiler.exe	88
PID 4308 set thread context of 372	4308	aspnet_compiler.exe	89
PID 4308 set thread context of 228	4308	aspnet_compiler.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3600	powershell.exe
3600	powershell.exe
316	aspnet_compiler.exe
316	aspnet_compiler.exe
228	aspnet_compiler.exe
228	aspnet_compiler.exe
316	aspnet_compiler.exe
316	aspnet_compiler.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
4308	aspnet_compiler.exe
4308	aspnet_compiler.exe
4308	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5076	INV20230104-BR.exe
Token: SeDebugPrivilege	3600	powershell.exe
Token: SeDebugPrivilege	228	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 3600	5076	INV20230104-BR.exe	77
PID 5076 wrote to memory of 3600	5076	INV20230104-BR.exe	77
PID 5076 wrote to memory of 3600	5076	INV20230104-BR.exe	77
PID 5076 wrote to memory of 4308	5076	INV20230104-BR.exe	87
PID 5076 wrote to memory of 4308	5076	INV20230104-BR.exe	87
PID 5076 wrote to memory of 4308	5076	INV20230104-BR.exe	87
PID 5076 wrote to memory of 4308	5076	INV20230104-BR.exe	87
PID 5076 wrote to memory of 4308	5076	INV20230104-BR.exe	87
PID 5076 wrote to memory of 4308	5076	INV20230104-BR.exe	87
PID 5076 wrote to memory of 4308	5076	INV20230104-BR.exe	87
PID 5076 wrote to memory of 4308	5076	INV20230104-BR.exe	87
PID 5076 wrote to memory of 4308	5076	INV20230104-BR.exe	87
PID 5076 wrote to memory of 4308	5076	INV20230104-BR.exe	87
PID 5076 wrote to memory of 4308	5076	INV20230104-BR.exe	87
PID 5076 wrote to memory of 4308	5076	INV20230104-BR.exe	87
PID 4308 wrote to memory of 316	4308	aspnet_compiler.exe	88
PID 4308 wrote to memory of 316	4308	aspnet_compiler.exe	88
PID 4308 wrote to memory of 316	4308	aspnet_compiler.exe	88
PID 4308 wrote to memory of 316	4308	aspnet_compiler.exe	88
PID 4308 wrote to memory of 372	4308	aspnet_compiler.exe	89
PID 4308 wrote to memory of 372	4308	aspnet_compiler.exe	89
PID 4308 wrote to memory of 372	4308	aspnet_compiler.exe	89
PID 4308 wrote to memory of 372	4308	aspnet_compiler.exe	89
PID 4308 wrote to memory of 228	4308	aspnet_compiler.exe	90
PID 4308 wrote to memory of 228	4308	aspnet_compiler.exe	90
PID 4308 wrote to memory of 228	4308	aspnet_compiler.exe	90
PID 4308 wrote to memory of 228	4308	aspnet_compiler.exe	90

C:\Users\Admin\AppData\Local\Temp\INV20230104-BR.exe
"C:\Users\Admin\AppData\Local\Temp\INV20230104-BR.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3600
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\fjonfdklrdlfshrxsggicodgjuiak"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:316
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\qdcggvvfnldsdwnbbrbkebxpsbajlbcb"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:372
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe /stext "C:\Users\Admin\AppData\Local\Temp\sxhy"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fjonfdklrdlfshrxsggicodgjuiak

Path C:\Users\Admin\AppData\Local\Temp\fjonfdklrdlfshrxsggicodgjuiak
Size 4KB
SHA256 0c9e16830ccc6495def187adde2137ac07a566e1534e5714f626dcd68d28094c
MD5 d06ebab8b0513f602e535079a9ebbeea
SHA1 d29472e6eb5a72f0353d70b97a33337b255b487e
SHA512 002df6f401950fd24d5976a47c58e9e2c58cef7d4fdec69f815fb6a00fb1e1a8963a4a7bf52056e61d6f6875edec393c466742c3031dd5f88802b45ddadca209
SSDEEP 48:wvvv0OxfvvcOxfdvv0OxBvv0Oxakvv0O7:mvrxvTp1vrPvrbvr7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/228-155-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/316-157-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/316-156-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/372-154-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/3600-140-0x00000000057A0000-0x0000000005DC8000-memory.dmp

Download

memory/3600-141-0x0000000005EE0000-0x0000000005F46000-memory.dmp

Download

memory/3600-143-0x00000000065F0000-0x000000000660E000-memory.dmp

Download

memory/3600-144-0x0000000007E30000-0x00000000084AA000-memory.dmp

Download

memory/3600-145-0x0000000006B00000-0x0000000006B1A000-memory.dmp

Download

memory/3600-139-0x0000000003000000-0x0000000003036000-memory.dmp

Download

memory/3600-142-0x0000000005FC0000-0x0000000006026000-memory.dmp

Download

memory/4308-148-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4308-149-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4308-150-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4308-147-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4308-159-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/4308-165-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4308-164-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/4308-162-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/4308-163-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/5076-132-0x0000000000790000-0x0000000000798000-memory.dmp

Download

memory/5076-133-0x0000000006190000-0x0000000006734000-memory.dmp

Download

memory/5076-134-0x0000000005CF0000-0x0000000005D82000-memory.dmp

Download

memory/5076-135-0x0000000005E50000-0x0000000005F02000-memory.dmp

Download

memory/5076-136-0x0000000005D90000-0x0000000005DE0000-memory.dmp

Download

memory/5076-137-0x0000000006010000-0x0000000006032000-memory.dmp

Download