remcos | 46c3cda4b6dbdae4d3347998364fa2981157c31d2cc8dfb765a5ecf1098484ea

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2023, 19:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FERP 830_cln.exe
Size 788KB
Sample230111-xzzb2aea79
SHA256 46c3cda4b6dbdae4d3347998364fa2981157c31d2cc8dfb765a5ecf1098484ea
MD5 08d4b0143bc20bd5f2e49bdf37d91205
SHA1 d5cb5f56aa571dc561508736e8838f0de8167815
SHA512 d3f6deb62924855e2cd97704dde446cd47f130de1358440e7899b45fa76d65144cf69962f8add94a3a9a75c7835c1f090f59a9e011a1631373880ce3e0630164
SSDEEP 12288:BAf472UHjw/UUp0X3y2pN5r2ZvauqfnrLuYR6C78sY3H4iDACu:eGoUUp0nJ7iZSBfnOYQCghH4iDAC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos carro rat

Malware Config

Extracted

Family

remcos

Botnet

CARRO

nuevocarro.con-ip.com:7770

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Car-90CQK6
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
3692	stle.exe
1312	stle.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4460 set thread context of 2684	4460	FERP 830_cln.exe	79
PID 3692 set thread context of 2500	3692	stle.exe	95
PID 1312 set thread context of 724	1312	stle.exe	104

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4228	schtasks.exe
932	schtasks.exe
4316	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2684	csc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 2684	4460	FERP 830_cln.exe	79
PID 4460 wrote to memory of 2684	4460	FERP 830_cln.exe	79
PID 4460 wrote to memory of 2684	4460	FERP 830_cln.exe	79
PID 4460 wrote to memory of 2684	4460	FERP 830_cln.exe	79
PID 4460 wrote to memory of 2684	4460	FERP 830_cln.exe	79
PID 4460 wrote to memory of 2684	4460	FERP 830_cln.exe	79
PID 4460 wrote to memory of 2684	4460	FERP 830_cln.exe	79
PID 4460 wrote to memory of 2684	4460	FERP 830_cln.exe	79
PID 4460 wrote to memory of 2684	4460	FERP 830_cln.exe	79
PID 4460 wrote to memory of 2684	4460	FERP 830_cln.exe	79
PID 4460 wrote to memory of 2684	4460	FERP 830_cln.exe	79
PID 4460 wrote to memory of 2684	4460	FERP 830_cln.exe	79
PID 4460 wrote to memory of 4764	4460	FERP 830_cln.exe	80
PID 4460 wrote to memory of 4764	4460	FERP 830_cln.exe	80
PID 4460 wrote to memory of 4764	4460	FERP 830_cln.exe	80
PID 4460 wrote to memory of 4632	4460	FERP 830_cln.exe	82
PID 4460 wrote to memory of 4632	4460	FERP 830_cln.exe	82
PID 4460 wrote to memory of 4632	4460	FERP 830_cln.exe	82
PID 4460 wrote to memory of 4368	4460	FERP 830_cln.exe	84
PID 4460 wrote to memory of 4368	4460	FERP 830_cln.exe	84
PID 4460 wrote to memory of 4368	4460	FERP 830_cln.exe	84
PID 4632 wrote to memory of 4228	4632	cmd.exe	86
PID 4632 wrote to memory of 4228	4632	cmd.exe	86
PID 4632 wrote to memory of 4228	4632	cmd.exe	86
PID 3692 wrote to memory of 2500	3692	stle.exe	95
PID 3692 wrote to memory of 2500	3692	stle.exe	95
PID 3692 wrote to memory of 2500	3692	stle.exe	95
PID 3692 wrote to memory of 2500	3692	stle.exe	95
PID 3692 wrote to memory of 2500	3692	stle.exe	95
PID 3692 wrote to memory of 2500	3692	stle.exe	95
PID 3692 wrote to memory of 2500	3692	stle.exe	95
PID 3692 wrote to memory of 2500	3692	stle.exe	95
PID 3692 wrote to memory of 2500	3692	stle.exe	95
PID 3692 wrote to memory of 2500	3692	stle.exe	95
PID 3692 wrote to memory of 2500	3692	stle.exe	95
PID 3692 wrote to memory of 2500	3692	stle.exe	95
PID 3692 wrote to memory of 3572	3692	stle.exe	96
PID 3692 wrote to memory of 3572	3692	stle.exe	96
PID 3692 wrote to memory of 3572	3692	stle.exe	96
PID 3692 wrote to memory of 4420	3692	stle.exe	97
PID 3692 wrote to memory of 4420	3692	stle.exe	97
PID 3692 wrote to memory of 4420	3692	stle.exe	97
PID 3692 wrote to memory of 1136	3692	stle.exe	100
PID 3692 wrote to memory of 1136	3692	stle.exe	100
PID 3692 wrote to memory of 1136	3692	stle.exe	100
PID 4420 wrote to memory of 932	4420	cmd.exe	102
PID 4420 wrote to memory of 932	4420	cmd.exe	102
PID 4420 wrote to memory of 932	4420	cmd.exe	102
PID 1312 wrote to memory of 724	1312	stle.exe	104
PID 1312 wrote to memory of 724	1312	stle.exe	104
PID 1312 wrote to memory of 724	1312	stle.exe	104
PID 1312 wrote to memory of 724	1312	stle.exe	104
PID 1312 wrote to memory of 724	1312	stle.exe	104
PID 1312 wrote to memory of 724	1312	stle.exe	104
PID 1312 wrote to memory of 724	1312	stle.exe	104
PID 1312 wrote to memory of 724	1312	stle.exe	104
PID 1312 wrote to memory of 724	1312	stle.exe	104
PID 1312 wrote to memory of 724	1312	stle.exe	104
PID 1312 wrote to memory of 724	1312	stle.exe	104
PID 1312 wrote to memory of 724	1312	stle.exe	104
PID 1312 wrote to memory of 2660	1312	stle.exe	105
PID 1312 wrote to memory of 2660	1312	stle.exe	105
PID 1312 wrote to memory of 2660	1312	stle.exe	105
PID 1312 wrote to memory of 1640	1312	stle.exe	106

C:\Users\Admin\AppData\Local\Temp\FERP 830_cln.exe
"C:\Users\Admin\AppData\Local\Temp\FERP 830_cln.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2684
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\stle"
  2⤵
  PID:4764
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\stle\stle.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\stle\stle.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:4228
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\FERP 830_cln.exe" "C:\Users\Admin\AppData\Roaming\stle\stle.exe"
  2⤵
  PID:4368

C:\Users\Admin\AppData\Roaming\stle\stle.exe
C:\Users\Admin\AppData\Roaming\stle\stle.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:2500
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\stle"
  2⤵
  PID:3572
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\stle\stle.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\stle\stle.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:932
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Roaming\stle\stle.exe" "C:\Users\Admin\AppData\Roaming\stle\stle.exe"
  2⤵
  PID:1136

C:\Users\Admin\AppData\Roaming\stle\stle.exe
C:\Users\Admin\AppData\Roaming\stle\stle.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:724
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\stle"
  2⤵
  PID:2660
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\stle\stle.exe'" /f
  2⤵
  PID:1640
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\stle\stle.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:4316
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Roaming\stle\stle.exe" "C:\Users\Admin\AppData\Roaming\stle\stle.exe"
  2⤵
  PID:4220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

stle.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\stle.exe.log
Size 701B
SHA256 d9d92cd6e7a4507912965138b8d1eabb3f188f4dfcb61115ee99dc2c0fd43a92
MD5 5de8527438c860bfa3140dc420a03e52
SHA1 235af682986b3292f20d8d71a8671353f5d6e16d
SHA512 77c3a774a2235c55ad520f1bf0c71fa3d3f0e7cf478a78e0d4dd6d253ee12a9859acc9ee822664467387788a2655a18373c8fcf08ea0d001549d3d4391b00bf8
MD5 SHA1 SHA512

Submit Download

stle.exe

Path C:\Users\Admin\AppData\Roaming\stle\stle.exe
Size 788KB
SHA256 46c3cda4b6dbdae4d3347998364fa2981157c31d2cc8dfb765a5ecf1098484ea
MD5 08d4b0143bc20bd5f2e49bdf37d91205
SHA1 d5cb5f56aa571dc561508736e8838f0de8167815
SHA512 d3f6deb62924855e2cd97704dde446cd47f130de1358440e7899b45fa76d65144cf69962f8add94a3a9a75c7835c1f090f59a9e011a1631373880ce3e0630164
SSDEEP 12288:BAf472UHjw/UUp0X3y2pN5r2ZvauqfnrLuYR6C78sY3H4iDACu:eGoUUp0nJ7iZSBfnOYQCghH4iDAC
MD5 SHA1 SHA512 SSDEEP

Submit Download

stle.exe

Path C:\Users\Admin\AppData\Roaming\stle\stle.exe
Size 788KB
SHA256 46c3cda4b6dbdae4d3347998364fa2981157c31d2cc8dfb765a5ecf1098484ea
MD5 08d4b0143bc20bd5f2e49bdf37d91205
SHA1 d5cb5f56aa571dc561508736e8838f0de8167815
SHA512 d3f6deb62924855e2cd97704dde446cd47f130de1358440e7899b45fa76d65144cf69962f8add94a3a9a75c7835c1f090f59a9e011a1631373880ce3e0630164
SSDEEP 12288:BAf472UHjw/UUp0X3y2pN5r2ZvauqfnrLuYR6C78sY3H4iDACu:eGoUUp0nJ7iZSBfnOYQCghH4iDAC
MD5 SHA1 SHA512 SSDEEP

Submit Download

stle.exe

Path C:\Users\Admin\AppData\Roaming\stle\stle.exe
Size 788KB
SHA256 46c3cda4b6dbdae4d3347998364fa2981157c31d2cc8dfb765a5ecf1098484ea
MD5 08d4b0143bc20bd5f2e49bdf37d91205
SHA1 d5cb5f56aa571dc561508736e8838f0de8167815
SHA512 d3f6deb62924855e2cd97704dde446cd47f130de1358440e7899b45fa76d65144cf69962f8add94a3a9a75c7835c1f090f59a9e011a1631373880ce3e0630164
SSDEEP 12288:BAf472UHjw/UUp0X3y2pN5r2ZvauqfnrLuYR6C78sY3H4iDACu:eGoUUp0nJ7iZSBfnOYQCghH4iDAC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/724-163-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/724-162-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/724-161-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2500-151-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2500-152-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2500-154-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2684-139-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2684-145-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2684-137-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2684-144-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2684-138-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4460-132-0x0000000000EB0000-0x0000000000F7A000-memory.dmp

Download

memory/4460-135-0x00000000059B0000-0x0000000005A16000-memory.dmp

Download

memory/4460-134-0x0000000005910000-0x00000000059A2000-memory.dmp

Download

memory/4460-133-0x0000000005DC0000-0x0000000006364000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads