remcos | fb0bca54f6a5b8aec9ae002bf53a942792fff4dc92ca4ecbd74fb625c1d604e0

Analysis

max time kernel
114s
max time network
88s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
11/01/2023, 20:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DOCUMENTO DE CONFIRMACION DE PSE_cln.exe
Size 788KB
Sample230111-y29ffsec24
SHA256 fb0bca54f6a5b8aec9ae002bf53a942792fff4dc92ca4ecbd74fb625c1d604e0
MD5 0e3c481a760c2f8a2bb17a53c997b7aa
SHA1 75f2d8c812568fc5f1b7ea3ef2396feadfd151eb
SHA512 29b1d51d4234071b54cf00ca7a18326d10dad719be5aed2de2c8137049ed3270b7b2f72145ffb1fb45390ecd846036380e0871e59e8bb6a688da6f7823576b7e
SSDEEP 12288:PPfJbrevVrdrPSxdz68wxQbuxlIaUqDIoKehdBgKqroMrZr5ACu:3xeJdrgYdUqUxkyZrr5AC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

voeurhfvjsdvsd.con-ip.com:1883

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-J17SBC
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
1996	stles.exe
1844	stles.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1616 set thread context of 1516	1616	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	28
PID 1996 set thread context of 1588	1996	stles.exe	40

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	csc.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1572	schtasks.exe
748	schtasks.exe
1720	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1516	csc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 1516	1616	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	28
PID 1616 wrote to memory of 1516	1616	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	28
PID 1616 wrote to memory of 1516	1616	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	28
PID 1616 wrote to memory of 1516	1616	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	28
PID 1616 wrote to memory of 1516	1616	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	28
PID 1616 wrote to memory of 1516	1616	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	28
PID 1616 wrote to memory of 1516	1616	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	28
PID 1616 wrote to memory of 1516	1616	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	28
PID 1616 wrote to memory of 1516	1616	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	28
PID 1616 wrote to memory of 1516	1616	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	28
PID 1616 wrote to memory of 1516	1616	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	28
PID 1616 wrote to memory of 1516	1616	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	28
PID 1616 wrote to memory of 1516	1616	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	28
PID 1616 wrote to memory of 680	1616	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	32
PID 1616 wrote to memory of 680	1616	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	32
PID 1616 wrote to memory of 680	1616	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	32
PID 1616 wrote to memory of 680	1616	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	32
PID 1616 wrote to memory of 760	1616	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	30
PID 1616 wrote to memory of 760	1616	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	30
PID 1616 wrote to memory of 760	1616	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	30
PID 1616 wrote to memory of 760	1616	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	30
PID 1616 wrote to memory of 876	1616	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	31
PID 1616 wrote to memory of 876	1616	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	31
PID 1616 wrote to memory of 876	1616	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	31
PID 1616 wrote to memory of 876	1616	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	31
PID 760 wrote to memory of 1572	760	cmd.exe	35
PID 760 wrote to memory of 1572	760	cmd.exe	35
PID 760 wrote to memory of 1572	760	cmd.exe	35
PID 760 wrote to memory of 1572	760	cmd.exe	35
PID 1008 wrote to memory of 1996	1008	taskeng.exe	39
PID 1008 wrote to memory of 1996	1008	taskeng.exe	39
PID 1008 wrote to memory of 1996	1008	taskeng.exe	39
PID 1008 wrote to memory of 1996	1008	taskeng.exe	39
PID 1996 wrote to memory of 1588	1996	stles.exe	40
PID 1996 wrote to memory of 1588	1996	stles.exe	40
PID 1996 wrote to memory of 1588	1996	stles.exe	40
PID 1996 wrote to memory of 1588	1996	stles.exe	40
PID 1996 wrote to memory of 1588	1996	stles.exe	40
PID 1996 wrote to memory of 1588	1996	stles.exe	40
PID 1996 wrote to memory of 1588	1996	stles.exe	40
PID 1996 wrote to memory of 1588	1996	stles.exe	40
PID 1996 wrote to memory of 1588	1996	stles.exe	40
PID 1996 wrote to memory of 1588	1996	stles.exe	40
PID 1996 wrote to memory of 1588	1996	stles.exe	40
PID 1996 wrote to memory of 1588	1996	stles.exe	40
PID 1996 wrote to memory of 1588	1996	stles.exe	40
PID 1996 wrote to memory of 1600	1996	stles.exe	41
PID 1996 wrote to memory of 1600	1996	stles.exe	41
PID 1996 wrote to memory of 1600	1996	stles.exe	41
PID 1996 wrote to memory of 1600	1996	stles.exe	41
PID 1996 wrote to memory of 1192	1996	stles.exe	43
PID 1996 wrote to memory of 1192	1996	stles.exe	43
PID 1996 wrote to memory of 1192	1996	stles.exe	43
PID 1996 wrote to memory of 1192	1996	stles.exe	43
PID 1996 wrote to memory of 1608	1996	stles.exe	44
PID 1996 wrote to memory of 1608	1996	stles.exe	44
PID 1996 wrote to memory of 1608	1996	stles.exe	44
PID 1996 wrote to memory of 1608	1996	stles.exe	44
PID 1192 wrote to memory of 748	1192	cmd.exe	47
PID 1192 wrote to memory of 748	1192	cmd.exe	47
PID 1192 wrote to memory of 748	1192	cmd.exe	47
PID 1192 wrote to memory of 748	1192	cmd.exe	47
PID 1516 wrote to memory of 1692	1516	csc.exe	48
PID 1516 wrote to memory of 1692	1516	csc.exe	48

C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE CONFIRMACION DE PSE_cln.exe
"C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE CONFIRMACION DE PSE_cln.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\xeehrwfvn.vbs"
    3⤵
    PID:1692
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\stles\stles.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\stles\stles.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:1572
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE CONFIRMACION DE PSE_cln.exe" "C:\Users\Admin\AppData\Roaming\stles\stles.exe"
  2⤵
  PID:876
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\stles"
  2⤵
  PID:680

C:\Windows\system32\taskeng.exe
taskeng.exe {324F5E3F-0EEA-411B-AEB0-603CF7F5D339} S-1-5-21-3385717845-2518323428-350143044-1000:SABDUHNY\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Users\Admin\AppData\Roaming\stles\stles.exe
  C:\Users\Admin\AppData\Roaming\stles\stles.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
    3⤵
    PID:1588
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\stles"
    3⤵
    PID:1600
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\stles\stles.exe'" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1192
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\stles\stles.exe'" /f
      4⤵
      Creates scheduled task(s)
      PID:748
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c copy "C:\Users\Admin\AppData\Roaming\stles\stles.exe" "C:\Users\Admin\AppData\Roaming\stles\stles.exe"
    3⤵
    PID:1608
- C:\Users\Admin\AppData\Roaming\stles\stles.exe
  C:\Users\Admin\AppData\Roaming\stles\stles.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\stles"
    3⤵
    PID:1524
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\stles\stles.exe'" /f
    3⤵
    PID:988
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\stles\stles.exe'" /f
      4⤵
      Creates scheduled task(s)
      PID:1720
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c copy "C:\Users\Admin\AppData\Roaming\stles\stles.exe" "C:\Users\Admin\AppData\Roaming\stles\stles.exe"
    3⤵
    PID:1680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

xeehrwfvn.vbs

Path C:\Users\Admin\AppData\Local\Temp\xeehrwfvn.vbs
Size 532B
SHA256 6dc82329eae51ba65e0a80d42f6a2d5d7e893e3da1b6062b5fccb2697b180694
MD5 d61cd1d5406b2973e76f71f54b437a9c
SHA1 cf2ba0989dad5e4f4627069d62f2db306ead755d
SHA512 1b20e87a3198cc9dab20fb6e6d5dd5d6b4b81e544ba998d206c412cce91411cbcae419824a5ffd85c84b72974f948f14ac66a2a4cfac19158686701597be5588
MD5 SHA1 SHA512

Submit Download

stles.exe

Path C:\Users\Admin\AppData\Roaming\stles\stles.exe
Size 788KB
SHA256 fb0bca54f6a5b8aec9ae002bf53a942792fff4dc92ca4ecbd74fb625c1d604e0
MD5 0e3c481a760c2f8a2bb17a53c997b7aa
SHA1 75f2d8c812568fc5f1b7ea3ef2396feadfd151eb
SHA512 29b1d51d4234071b54cf00ca7a18326d10dad719be5aed2de2c8137049ed3270b7b2f72145ffb1fb45390ecd846036380e0871e59e8bb6a688da6f7823576b7e
SSDEEP 12288:PPfJbrevVrdrPSxdz68wxQbuxlIaUqDIoKehdBgKqroMrZr5ACu:3xeJdrgYdUqUxkyZrr5AC
MD5 SHA1 SHA512 SSDEEP

Submit Download

stles.exe

Path C:\Users\Admin\AppData\Roaming\stles\stles.exe
Size 788KB
SHA256 fb0bca54f6a5b8aec9ae002bf53a942792fff4dc92ca4ecbd74fb625c1d604e0
MD5 0e3c481a760c2f8a2bb17a53c997b7aa
SHA1 75f2d8c812568fc5f1b7ea3ef2396feadfd151eb
SHA512 29b1d51d4234071b54cf00ca7a18326d10dad719be5aed2de2c8137049ed3270b7b2f72145ffb1fb45390ecd846036380e0871e59e8bb6a688da6f7823576b7e
SSDEEP 12288:PPfJbrevVrdrPSxdz68wxQbuxlIaUqDIoKehdBgKqroMrZr5ACu:3xeJdrgYdUqUxkyZrr5AC
MD5 SHA1 SHA512 SSDEEP

Submit Download

stles.exe

Path C:\Users\Admin\AppData\Roaming\stles\stles.exe
Size 788KB
SHA256 fb0bca54f6a5b8aec9ae002bf53a942792fff4dc92ca4ecbd74fb625c1d604e0
MD5 0e3c481a760c2f8a2bb17a53c997b7aa
SHA1 75f2d8c812568fc5f1b7ea3ef2396feadfd151eb
SHA512 29b1d51d4234071b54cf00ca7a18326d10dad719be5aed2de2c8137049ed3270b7b2f72145ffb1fb45390ecd846036380e0871e59e8bb6a688da6f7823576b7e
SSDEEP 12288:PPfJbrevVrdrPSxdz68wxQbuxlIaUqDIoKehdBgKqroMrZr5ACu:3xeJdrgYdUqUxkyZrr5AC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1516-66-0x0000000000080000-0x00000000000FF000-memory.dmp

Download

memory/1516-85-0x0000000000080000-0x00000000000FF000-memory.dmp

Download

memory/1516-70-0x0000000000080000-0x00000000000FF000-memory.dmp

Download

memory/1516-75-0x0000000000080000-0x00000000000FF000-memory.dmp

Download

memory/1516-64-0x0000000000080000-0x00000000000FF000-memory.dmp

Download

memory/1516-59-0x0000000000080000-0x00000000000FF000-memory.dmp

Download

memory/1516-61-0x0000000000080000-0x00000000000FF000-memory.dmp

Download

memory/1516-63-0x0000000000080000-0x00000000000FF000-memory.dmp

Download

memory/1516-62-0x0000000000080000-0x00000000000FF000-memory.dmp

Download

memory/1516-56-0x0000000000080000-0x00000000000FF000-memory.dmp

Download

memory/1516-57-0x0000000000080000-0x00000000000FF000-memory.dmp

Download

memory/1588-109-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1588-111-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1616-54-0x0000000000DA0000-0x0000000000E6A000-memory.dmp

Download

memory/1616-55-0x0000000075C81000-0x0000000075C83000-memory.dmp

Download

memory/1844-118-0x0000000000E50000-0x0000000000F1A000-memory.dmp

Download

memory/1996-89-0x00000000003B0000-0x000000000047A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads