remcos | 490f282d4fd00248b4f2c3ee4b5586d7af9b8cef6702f035abfee65482289d99

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2023, 10:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ 80380 N 2023 JANUARY 04606.gz.exe
Size 864KB
Sample230123-mch2esch37
SHA256 490f282d4fd00248b4f2c3ee4b5586d7af9b8cef6702f035abfee65482289d99
MD5 909588e87fae1849fbe46e446776ed1a
SHA1 f59fdf850bdfd1a83f81b451d7ce7e7d8a17a976
SHA512 3219a9f72dc45b2ff07558f551a368652eb9cb24bd629db5c528b2df83a10cf20ce4c7d84eb0cebcfb921cc1f64b215a5b37798ae3cb105a627983c28b132dec
SSDEEP 24576:GmVXplzJdNDxd0kPPwa2lLtgAl2BoKruMwD+:d9plzJPDxd0kPPwRlqAl2BohMwi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

45.139.105.174:6320

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-F4ZT0S
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
1
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
848	remcos.exe
1696	remcos.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	RFQ 80380 N 2023 JANUARY 04606.gz.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	RFQ 80380 N 2023 JANUARY 04606.gz.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	remcos.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	RFQ 80380 N 2023 JANUARY 04606.gz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	RFQ 80380 N 2023 JANUARY 04606.gz.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	RFQ 80380 N 2023 JANUARY 04606.gz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	RFQ 80380 N 2023 JANUARY 04606.gz.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	remcos.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3812 set thread context of 3800	3812	RFQ 80380 N 2023 JANUARY 04606.gz.exe	95
PID 848 set thread context of 1696	848	remcos.exe	104

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4224	schtasks.exe
4684	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	RFQ 80380 N 2023 JANUARY 04606.gz.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3812	RFQ 80380 N 2023 JANUARY 04606.gz.exe
3812	RFQ 80380 N 2023 JANUARY 04606.gz.exe
2400	powershell.exe
2400	powershell.exe
848	remcos.exe
3764	powershell.exe
848	remcos.exe
3764	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3812	RFQ 80380 N 2023 JANUARY 04606.gz.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	848	remcos.exe
Token: SeDebugPrivilege	3764	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1696	remcos.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 2400	3812	RFQ 80380 N 2023 JANUARY 04606.gz.exe	91
PID 3812 wrote to memory of 2400	3812	RFQ 80380 N 2023 JANUARY 04606.gz.exe	91
PID 3812 wrote to memory of 2400	3812	RFQ 80380 N 2023 JANUARY 04606.gz.exe	91
PID 3812 wrote to memory of 4224	3812	RFQ 80380 N 2023 JANUARY 04606.gz.exe	93
PID 3812 wrote to memory of 4224	3812	RFQ 80380 N 2023 JANUARY 04606.gz.exe	93
PID 3812 wrote to memory of 4224	3812	RFQ 80380 N 2023 JANUARY 04606.gz.exe	93
PID 3812 wrote to memory of 3800	3812	RFQ 80380 N 2023 JANUARY 04606.gz.exe	95
PID 3812 wrote to memory of 3800	3812	RFQ 80380 N 2023 JANUARY 04606.gz.exe	95
PID 3812 wrote to memory of 3800	3812	RFQ 80380 N 2023 JANUARY 04606.gz.exe	95
PID 3812 wrote to memory of 3800	3812	RFQ 80380 N 2023 JANUARY 04606.gz.exe	95
PID 3812 wrote to memory of 3800	3812	RFQ 80380 N 2023 JANUARY 04606.gz.exe	95
PID 3812 wrote to memory of 3800	3812	RFQ 80380 N 2023 JANUARY 04606.gz.exe	95
PID 3812 wrote to memory of 3800	3812	RFQ 80380 N 2023 JANUARY 04606.gz.exe	95
PID 3812 wrote to memory of 3800	3812	RFQ 80380 N 2023 JANUARY 04606.gz.exe	95
PID 3812 wrote to memory of 3800	3812	RFQ 80380 N 2023 JANUARY 04606.gz.exe	95
PID 3812 wrote to memory of 3800	3812	RFQ 80380 N 2023 JANUARY 04606.gz.exe	95
PID 3812 wrote to memory of 3800	3812	RFQ 80380 N 2023 JANUARY 04606.gz.exe	95
PID 3812 wrote to memory of 3800	3812	RFQ 80380 N 2023 JANUARY 04606.gz.exe	95
PID 3800 wrote to memory of 2752	3800	RFQ 80380 N 2023 JANUARY 04606.gz.exe	96
PID 3800 wrote to memory of 2752	3800	RFQ 80380 N 2023 JANUARY 04606.gz.exe	96
PID 3800 wrote to memory of 2752	3800	RFQ 80380 N 2023 JANUARY 04606.gz.exe	96
PID 2752 wrote to memory of 1176	2752	WScript.exe	97
PID 2752 wrote to memory of 1176	2752	WScript.exe	97
PID 2752 wrote to memory of 1176	2752	WScript.exe	97
PID 1176 wrote to memory of 848	1176	cmd.exe	99
PID 1176 wrote to memory of 848	1176	cmd.exe	99
PID 1176 wrote to memory of 848	1176	cmd.exe	99
PID 848 wrote to memory of 3764	848	remcos.exe	100
PID 848 wrote to memory of 3764	848	remcos.exe	100
PID 848 wrote to memory of 3764	848	remcos.exe	100
PID 848 wrote to memory of 4684	848	remcos.exe	102
PID 848 wrote to memory of 4684	848	remcos.exe	102
PID 848 wrote to memory of 4684	848	remcos.exe	102
PID 848 wrote to memory of 1696	848	remcos.exe	104
PID 848 wrote to memory of 1696	848	remcos.exe	104
PID 848 wrote to memory of 1696	848	remcos.exe	104
PID 848 wrote to memory of 1696	848	remcos.exe	104
PID 848 wrote to memory of 1696	848	remcos.exe	104
PID 848 wrote to memory of 1696	848	remcos.exe	104
PID 848 wrote to memory of 1696	848	remcos.exe	104
PID 848 wrote to memory of 1696	848	remcos.exe	104
PID 848 wrote to memory of 1696	848	remcos.exe	104
PID 848 wrote to memory of 1696	848	remcos.exe	104
PID 848 wrote to memory of 1696	848	remcos.exe	104
PID 848 wrote to memory of 1696	848	remcos.exe	104

C:\Users\Admin\AppData\Local\Temp\RFQ 80380 N 2023 JANUARY 04606.gz.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ 80380 N 2023 JANUARY 04606.gz.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gwUgywwXAo.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2400
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gwUgywwXAo" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1155.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4224
- C:\Users\Admin\AppData\Local\Temp\RFQ 80380 N 2023 JANUARY 04606.gz.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ 80380 N 2023 JANUARY 04606.gz.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fvkgiplfzqpbxpvqywvyjyjskunzgxlptn.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1176
    - - C:\ProgramData\Remcos\remcos.exe
        
        C:\ProgramData\Remcos\remcos.exe
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:848
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gwUgywwXAo.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3764
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gwUgywwXAo" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB074.tmp"
        6⤵
        Creates scheduled task(s)
        
        PID:4684
      - C:\ProgramData\Remcos\remcos.exe
        
        "C:\ProgramData\Remcos\remcos.exe"
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:1696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

remcos.exe

Path C:\ProgramData\Remcos\remcos.exe
Size 864KB
SHA256 490f282d4fd00248b4f2c3ee4b5586d7af9b8cef6702f035abfee65482289d99
MD5 909588e87fae1849fbe46e446776ed1a
SHA1 f59fdf850bdfd1a83f81b451d7ce7e7d8a17a976
SHA512 3219a9f72dc45b2ff07558f551a368652eb9cb24bd629db5c528b2df83a10cf20ce4c7d84eb0cebcfb921cc1f64b215a5b37798ae3cb105a627983c28b132dec
SSDEEP 24576:GmVXplzJdNDxd0kPPwa2lLtgAl2BoKruMwD+:d9plzJPDxd0kPPwRlqAl2BohMwi
MD5 SHA1 SHA512 SSDEEP

Submit Download

remcos.exe

Path C:\ProgramData\Remcos\remcos.exe
Size 864KB
SHA256 490f282d4fd00248b4f2c3ee4b5586d7af9b8cef6702f035abfee65482289d99
MD5 909588e87fae1849fbe46e446776ed1a
SHA1 f59fdf850bdfd1a83f81b451d7ce7e7d8a17a976
SHA512 3219a9f72dc45b2ff07558f551a368652eb9cb24bd629db5c528b2df83a10cf20ce4c7d84eb0cebcfb921cc1f64b215a5b37798ae3cb105a627983c28b132dec
SSDEEP 24576:GmVXplzJdNDxd0kPPwa2lLtgAl2BoKruMwD+:d9plzJPDxd0kPPwRlqAl2BohMwi
MD5 SHA1 SHA512 SSDEEP

Submit Download

remcos.exe

Path C:\ProgramData\Remcos\remcos.exe
Size 864KB
SHA256 490f282d4fd00248b4f2c3ee4b5586d7af9b8cef6702f035abfee65482289d99
MD5 909588e87fae1849fbe46e446776ed1a
SHA1 f59fdf850bdfd1a83f81b451d7ce7e7d8a17a976
SHA512 3219a9f72dc45b2ff07558f551a368652eb9cb24bd629db5c528b2df83a10cf20ce4c7d84eb0cebcfb921cc1f64b215a5b37798ae3cb105a627983c28b132dec
SSDEEP 24576:GmVXplzJdNDxd0kPPwa2lLtgAl2BoKruMwD+:d9plzJPDxd0kPPwRlqAl2BohMwi
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 18cf83267604d6f5a3b3f0e4e03cd9cfd8a213e992a6d5e7f2484b568da453d4
MD5 72a8460b38441aa99ed929cf7ff13930
SHA1 38a5381b64a3a28a2d96ac546aa710b8fb209248
SHA512 7bcddd91e639c0e41162982469e607c5e1acbe239dcafef2f23d6d2138a0f3131287f218d995d063095f43a0d5565e7911b90fae9b97cb857e865beea33afe2f
SSDEEP 384:3sf+BC9i+75qe5nB5sJk+o9o2ThK6seYLME/N03SoZ6fYSgcjEDkyQ0gdEtkKhD:cfPkeRHdjo2ThNgrWS1WCED/Ce3
MD5 SHA1 SHA512 SSDEEP

Submit Download

fvkgiplfzqpbxpvqywvyjyjskunzgxlptn.vbs

Path C:\Users\Admin\AppData\Local\Temp\fvkgiplfzqpbxpvqywvyjyjskunzgxlptn.vbs
Size 386B
SHA256 6efdc40f9eb217f879607614e928b65bff759e424f3efb31faceb2a043c32dc2
MD5 1ec6289c6fd4c2ded6b2836ed28cbeb5
SHA1 c4e08195e6c640eb8860acc03fda1d649b4fe070
SHA512 20bc46f4dee22f75f15c402c7c2eaee60fff7dd92548050585571dcbefd59485cc249c06bc3f1aac7a138e5ae67c0c3918b46ffa24c8b0f1b092e2f6b6e21288
MD5 SHA1 SHA512

Submit Download

tmp1155.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp1155.tmp
Size 1KB
SHA256 e7b08b6a75a5f9dbbe751879244bb1d68a6d84c5a1165a981fafbd2e9d057cc0
MD5 bb51dd59af3f4c69c90d6bb3cae15bb5
SHA1 5798872a05e17726d2ac056ce143c4269f6f008c
SHA512 b3fd257bf8cf83b61958c0d6eed5746be9f78c5dfd712e5d166fbb3237876cc53e2687fe788ec86644dd7cc555923185a7749313bfca13e5b71b4bc198347bf3
MD5 SHA1 SHA512

Submit Download

tmpB074.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpB074.tmp
Size 1KB
SHA256 e7b08b6a75a5f9dbbe751879244bb1d68a6d84c5a1165a981fafbd2e9d057cc0
MD5 bb51dd59af3f4c69c90d6bb3cae15bb5
SHA1 5798872a05e17726d2ac056ce143c4269f6f008c
SHA512 b3fd257bf8cf83b61958c0d6eed5746be9f78c5dfd712e5d166fbb3237876cc53e2687fe788ec86644dd7cc555923185a7749313bfca13e5b71b4bc198347bf3
MD5 SHA1 SHA512

Submit Download

memory/1696-175-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1696-176-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1696-177-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1696-179-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2400-165-0x00000000071A0000-0x00000000071BA000-memory.dmp

Download

memory/2400-139-0x0000000000DB0000-0x0000000000DE6000-memory.dmp

Download

memory/2400-166-0x0000000007180000-0x0000000007188000-memory.dmp

Download

memory/2400-142-0x0000000004DF0000-0x0000000005418000-memory.dmp

Download

memory/2400-147-0x0000000005490000-0x00000000054F6000-memory.dmp

Download

memory/2400-152-0x0000000005B60000-0x0000000005B7E000-memory.dmp

Download

memory/2400-146-0x0000000004B90000-0x0000000004BB2000-memory.dmp

Download

memory/2400-148-0x0000000005570000-0x00000000055D6000-memory.dmp

Download

memory/2400-164-0x0000000007090000-0x000000000709E000-memory.dmp

Download

memory/2400-157-0x0000000006120000-0x0000000006152000-memory.dmp

Download

memory/2400-158-0x00000000712A0000-0x00000000712EC000-memory.dmp

Download

memory/2400-159-0x0000000006100000-0x000000000611E000-memory.dmp

Download

memory/2400-160-0x00000000074A0000-0x0000000007B1A000-memory.dmp

Download

memory/2400-161-0x0000000006E60000-0x0000000006E7A000-memory.dmp

Download

memory/2400-162-0x0000000006ED0000-0x0000000006EDA000-memory.dmp

Download

memory/2400-163-0x00000000070E0000-0x0000000007176000-memory.dmp

Download

memory/3764-178-0x0000000071740000-0x000000007178C000-memory.dmp

Download

memory/3800-144-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3800-143-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3800-145-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3800-150-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3812-132-0x0000000000A10000-0x0000000000AEC000-memory.dmp

Download

memory/3812-136-0x0000000007E10000-0x0000000007EAC000-memory.dmp

Download

memory/3812-135-0x0000000005490000-0x000000000549A000-memory.dmp

Download

memory/3812-134-0x0000000005510000-0x00000000055A2000-memory.dmp

Download

memory/3812-133-0x0000000005AC0000-0x0000000006064000-memory.dmp

Download