remcos | fb0bca54f6a5b8aec9ae002bf53a942792fff4dc92ca4ecbd74fb625c1d604e0

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2023, 20:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DOCUMENTO DE CONFIRMACION DE PSE_cln.exe
Size 788KB
Sample230111-y29ffsec24
SHA256 fb0bca54f6a5b8aec9ae002bf53a942792fff4dc92ca4ecbd74fb625c1d604e0
MD5 0e3c481a760c2f8a2bb17a53c997b7aa
SHA1 75f2d8c812568fc5f1b7ea3ef2396feadfd151eb
SHA512 29b1d51d4234071b54cf00ca7a18326d10dad719be5aed2de2c8137049ed3270b7b2f72145ffb1fb45390ecd846036380e0871e59e8bb6a688da6f7823576b7e
SSDEEP 12288:PPfJbrevVrdrPSxdz68wxQbuxlIaUqDIoKehdBgKqroMrZr5ACu:3xeJdrgYdUqUxkyZrr5AC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

voeurhfvjsdvsd.con-ip.com:1883

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-J17SBC
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
772	stles.exe
4008	stles.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2268 set thread context of 4424	2268	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	80
PID 772 set thread context of 760	772	stles.exe	95
PID 4008 set thread context of 4820	4008	stles.exe	109

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4376	4424	WerFault.exe	80
1876	760	WerFault.exe	95
4472	4820	WerFault.exe	109

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1644	schtasks.exe
684	schtasks.exe
4236	schtasks.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 4424	2268	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	80
PID 2268 wrote to memory of 4424	2268	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	80
PID 2268 wrote to memory of 4424	2268	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	80
PID 2268 wrote to memory of 4424	2268	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	80
PID 2268 wrote to memory of 4424	2268	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	80
PID 2268 wrote to memory of 4424	2268	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	80
PID 2268 wrote to memory of 4424	2268	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	80
PID 2268 wrote to memory of 4424	2268	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	80
PID 2268 wrote to memory of 4424	2268	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	80
PID 2268 wrote to memory of 4424	2268	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	80
PID 2268 wrote to memory of 4424	2268	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	80
PID 2268 wrote to memory of 4424	2268	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	80
PID 2268 wrote to memory of 4864	2268	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	81
PID 2268 wrote to memory of 4864	2268	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	81
PID 2268 wrote to memory of 4864	2268	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	81
PID 2268 wrote to memory of 5076	2268	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	83
PID 2268 wrote to memory of 5076	2268	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	83
PID 2268 wrote to memory of 5076	2268	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	83
PID 2268 wrote to memory of 4448	2268	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	84
PID 2268 wrote to memory of 4448	2268	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	84
PID 2268 wrote to memory of 4448	2268	DOCUMENTO DE CONFIRMACION DE PSE_cln.exe	84
PID 5076 wrote to memory of 1644	5076	cmd.exe	87
PID 5076 wrote to memory of 1644	5076	cmd.exe	87
PID 5076 wrote to memory of 1644	5076	cmd.exe	87
PID 772 wrote to memory of 760	772	stles.exe	95
PID 772 wrote to memory of 760	772	stles.exe	95
PID 772 wrote to memory of 760	772	stles.exe	95
PID 772 wrote to memory of 760	772	stles.exe	95
PID 772 wrote to memory of 760	772	stles.exe	95
PID 772 wrote to memory of 760	772	stles.exe	95
PID 772 wrote to memory of 760	772	stles.exe	95
PID 772 wrote to memory of 760	772	stles.exe	95
PID 772 wrote to memory of 760	772	stles.exe	95
PID 772 wrote to memory of 760	772	stles.exe	95
PID 772 wrote to memory of 760	772	stles.exe	95
PID 772 wrote to memory of 760	772	stles.exe	95
PID 772 wrote to memory of 2368	772	stles.exe	96
PID 772 wrote to memory of 2368	772	stles.exe	96
PID 772 wrote to memory of 2368	772	stles.exe	96
PID 772 wrote to memory of 3156	772	stles.exe	98
PID 772 wrote to memory of 3156	772	stles.exe	98
PID 772 wrote to memory of 3156	772	stles.exe	98
PID 772 wrote to memory of 1160	772	stles.exe	101
PID 772 wrote to memory of 1160	772	stles.exe	101
PID 772 wrote to memory of 1160	772	stles.exe	101
PID 3156 wrote to memory of 684	3156	cmd.exe	104
PID 3156 wrote to memory of 684	3156	cmd.exe	104
PID 3156 wrote to memory of 684	3156	cmd.exe	104
PID 4008 wrote to memory of 4820	4008	stles.exe	109
PID 4008 wrote to memory of 4820	4008	stles.exe	109
PID 4008 wrote to memory of 4820	4008	stles.exe	109
PID 4008 wrote to memory of 4820	4008	stles.exe	109
PID 4008 wrote to memory of 4820	4008	stles.exe	109
PID 4008 wrote to memory of 4820	4008	stles.exe	109
PID 4008 wrote to memory of 4820	4008	stles.exe	109
PID 4008 wrote to memory of 4820	4008	stles.exe	109
PID 4008 wrote to memory of 4820	4008	stles.exe	109
PID 4008 wrote to memory of 4820	4008	stles.exe	109
PID 4008 wrote to memory of 4820	4008	stles.exe	109
PID 4008 wrote to memory of 4820	4008	stles.exe	109
PID 4008 wrote to memory of 4816	4008	stles.exe	110
PID 4008 wrote to memory of 4816	4008	stles.exe	110
PID 4008 wrote to memory of 4816	4008	stles.exe	110
PID 4008 wrote to memory of 4960	4008	stles.exe	112

C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE CONFIRMACION DE PSE_cln.exe
"C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE CONFIRMACION DE PSE_cln.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:4424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 500
    3⤵
    - Program crash
    PID:4376
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\stles"
  2⤵
  PID:4864
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\stles\stles.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\stles\stles.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:1644
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\DOCUMENTO DE CONFIRMACION DE PSE_cln.exe" "C:\Users\Admin\AppData\Roaming\stles\stles.exe"
  2⤵
  PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4424 -ip 4424
1⤵
PID:1192

C:\Users\Admin\AppData\Roaming\stles\stles.exe
C:\Users\Admin\AppData\Roaming\stles\stles.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:772
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 500
    3⤵
    - Program crash
    PID:1876
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\stles"
  2⤵
  PID:2368
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\stles\stles.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\stles\stles.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:684
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Roaming\stles\stles.exe" "C:\Users\Admin\AppData\Roaming\stles\stles.exe"
  2⤵
  PID:1160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 760 -ip 760
1⤵
PID:5104

C:\Users\Admin\AppData\Roaming\stles\stles.exe
C:\Users\Admin\AppData\Roaming\stles\stles.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:4820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 500
    3⤵
    - Program crash
    PID:4472
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\stles"
  2⤵
  PID:4816
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\stles\stles.exe'" /f
  2⤵
  PID:4960
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\stles\stles.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:4236
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Roaming\stles\stles.exe" "C:\Users\Admin\AppData\Roaming\stles\stles.exe"
  2⤵
  PID:1056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4820 -ip 4820
1⤵
PID:4760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

stles.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\stles.exe.log
Size 701B
SHA256 d9d92cd6e7a4507912965138b8d1eabb3f188f4dfcb61115ee99dc2c0fd43a92
MD5 5de8527438c860bfa3140dc420a03e52
SHA1 235af682986b3292f20d8d71a8671353f5d6e16d
SHA512 77c3a774a2235c55ad520f1bf0c71fa3d3f0e7cf478a78e0d4dd6d253ee12a9859acc9ee822664467387788a2655a18373c8fcf08ea0d001549d3d4391b00bf8
MD5 SHA1 SHA512

Submit Download

stles.exe

Path C:\Users\Admin\AppData\Roaming\stles\stles.exe
Size 788KB
SHA256 fb0bca54f6a5b8aec9ae002bf53a942792fff4dc92ca4ecbd74fb625c1d604e0
MD5 0e3c481a760c2f8a2bb17a53c997b7aa
SHA1 75f2d8c812568fc5f1b7ea3ef2396feadfd151eb
SHA512 29b1d51d4234071b54cf00ca7a18326d10dad719be5aed2de2c8137049ed3270b7b2f72145ffb1fb45390ecd846036380e0871e59e8bb6a688da6f7823576b7e
SSDEEP 12288:PPfJbrevVrdrPSxdz68wxQbuxlIaUqDIoKehdBgKqroMrZr5ACu:3xeJdrgYdUqUxkyZrr5AC
MD5 SHA1 SHA512 SSDEEP

Submit Download

stles.exe

Path C:\Users\Admin\AppData\Roaming\stles\stles.exe
Size 788KB
SHA256 fb0bca54f6a5b8aec9ae002bf53a942792fff4dc92ca4ecbd74fb625c1d604e0
MD5 0e3c481a760c2f8a2bb17a53c997b7aa
SHA1 75f2d8c812568fc5f1b7ea3ef2396feadfd151eb
SHA512 29b1d51d4234071b54cf00ca7a18326d10dad719be5aed2de2c8137049ed3270b7b2f72145ffb1fb45390ecd846036380e0871e59e8bb6a688da6f7823576b7e
SSDEEP 12288:PPfJbrevVrdrPSxdz68wxQbuxlIaUqDIoKehdBgKqroMrZr5ACu:3xeJdrgYdUqUxkyZrr5AC
MD5 SHA1 SHA512 SSDEEP

Submit Download

stles.exe

Path C:\Users\Admin\AppData\Roaming\stles\stles.exe
Size 788KB
SHA256 fb0bca54f6a5b8aec9ae002bf53a942792fff4dc92ca4ecbd74fb625c1d604e0
MD5 0e3c481a760c2f8a2bb17a53c997b7aa
SHA1 75f2d8c812568fc5f1b7ea3ef2396feadfd151eb
SHA512 29b1d51d4234071b54cf00ca7a18326d10dad719be5aed2de2c8137049ed3270b7b2f72145ffb1fb45390ecd846036380e0871e59e8bb6a688da6f7823576b7e
SSDEEP 12288:PPfJbrevVrdrPSxdz68wxQbuxlIaUqDIoKehdBgKqroMrZr5ACu:3xeJdrgYdUqUxkyZrr5AC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/760-167-0x0000000000710000-0x000000000078F000-memory.dmp

Download

memory/760-162-0x0000000000710000-0x000000000078F000-memory.dmp

Download

memory/2268-133-0x0000000005D20000-0x00000000062C4000-memory.dmp

Download

memory/2268-134-0x0000000005820000-0x00000000058B2000-memory.dmp

Download

memory/2268-135-0x00000000058C0000-0x0000000005926000-memory.dmp

Download

memory/2268-132-0x0000000000DB0000-0x0000000000E7A000-memory.dmp

Download

memory/4424-144-0x0000000001200000-0x000000000127F000-memory.dmp

Download

memory/4424-151-0x0000000001200000-0x000000000127F000-memory.dmp

Download

memory/4424-138-0x0000000001200000-0x000000000127F000-memory.dmp

Download

memory/4820-181-0x0000000000360000-0x00000000003DF000-memory.dmp

Download

memory/4820-186-0x0000000000360000-0x00000000003DF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads