remcos | 03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
31-01-2023 13:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

2.7MB
MD5

21605edd439a91f69b7c2584413ae3f5
SHA1

76353ff45df865cee24b8802c2332c8f07590df6
SHA256

03541b2cf3bf022eda584b9ead6b6edeb7a47e8ccaa99b2415ee56694c9868cb
SHA512

df4248687d7a92389a3aab90dd0ccc8ea7236e8b71555bd835c33816a6e27b9a147d10fe693b57a693698c0d7c3fdbd99a3587cbfba08929c0d0fc4f34efb128
SSDEEP

49152:Q61jlIn2e7zgWTSOa7Q4hVBP35NxVg1DHeTz0CTssEORTdQRYdN+1rHzE42i9:Q6FynB7JTSOWBBNxVg1zen0CLEOhdQTl

Score

10^/10

remcos nigeria collection rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

nigeria

198.46.173.141:50482

198.46.173.141:50484

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-6CYNGG
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4648-153-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView
behavioral2/memory/4648-162-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView
behavioral2/memory/2568-169-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4228-154-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/4228-155-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/2576-167-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 7 IoCs

resource	yara_rule
behavioral2/memory/4648-153-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/4228-154-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4228-155-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4648-162-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/2568-169-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/2660-170-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/2576-167-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	tmp.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	tmp.exe
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	tmp.exe

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 4732 set thread context of 1860	4732	tmp.exe	91
PID 1860 set thread context of 4228	1860	tmp.exe	93
PID 1860 set thread context of 4648	1860	tmp.exe	94
PID 1860 set thread context of 3968	1860	tmp.exe	95
PID 1860 set thread context of 2576	1860	tmp.exe	98
PID 1860 set thread context of 2568	1860	tmp.exe	99
PID 1860 set thread context of 2660	1860	tmp.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2868	3968	WerFault.exe	95

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1628	powershell.exe
1628	powershell.exe
4732	tmp.exe
4732	tmp.exe
4732	tmp.exe
4732	tmp.exe
4228	tmp.exe
4228	tmp.exe
4228	tmp.exe
4228	tmp.exe
2576	tmp.exe
2576	tmp.exe
2576	tmp.exe
2576	tmp.exe
2660	tmp.exe
2660	tmp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1860	tmp.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
1860	tmp.exe
1860	tmp.exe
1860	tmp.exe
1860	tmp.exe
1860	tmp.exe
1860	tmp.exe
1860	tmp.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4732	tmp.exe
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeDebugPrivilege	2660	tmp.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1860	tmp.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3968	tmp.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4732 wrote to memory of 1628	4732	tmp.exe	81
PID 4732 wrote to memory of 1628	4732	tmp.exe	81
PID 4732 wrote to memory of 1628	4732	tmp.exe	81
PID 4732 wrote to memory of 3496	4732	tmp.exe	89
PID 4732 wrote to memory of 3496	4732	tmp.exe	89
PID 4732 wrote to memory of 3496	4732	tmp.exe	89
PID 4732 wrote to memory of 3768	4732	tmp.exe	90
PID 4732 wrote to memory of 3768	4732	tmp.exe	90
PID 4732 wrote to memory of 3768	4732	tmp.exe	90
PID 4732 wrote to memory of 1860	4732	tmp.exe	91
PID 4732 wrote to memory of 1860	4732	tmp.exe	91
PID 4732 wrote to memory of 1860	4732	tmp.exe	91
PID 4732 wrote to memory of 1860	4732	tmp.exe	91
PID 4732 wrote to memory of 1860	4732	tmp.exe	91
PID 4732 wrote to memory of 1860	4732	tmp.exe	91
PID 4732 wrote to memory of 1860	4732	tmp.exe	91
PID 4732 wrote to memory of 1860	4732	tmp.exe	91
PID 4732 wrote to memory of 1860	4732	tmp.exe	91
PID 4732 wrote to memory of 1860	4732	tmp.exe	91
PID 4732 wrote to memory of 1860	4732	tmp.exe	91
PID 4732 wrote to memory of 1860	4732	tmp.exe	91
PID 1860 wrote to memory of 4228	1860	tmp.exe	93
PID 1860 wrote to memory of 4228	1860	tmp.exe	93
PID 1860 wrote to memory of 4228	1860	tmp.exe	93
PID 1860 wrote to memory of 4228	1860	tmp.exe	93
PID 1860 wrote to memory of 4648	1860	tmp.exe	94
PID 1860 wrote to memory of 4648	1860	tmp.exe	94
PID 1860 wrote to memory of 4648	1860	tmp.exe	94
PID 1860 wrote to memory of 4648	1860	tmp.exe	94
PID 1860 wrote to memory of 3968	1860	tmp.exe	95
PID 1860 wrote to memory of 3968	1860	tmp.exe	95
PID 1860 wrote to memory of 3968	1860	tmp.exe	95
PID 1860 wrote to memory of 3968	1860	tmp.exe	95
PID 1860 wrote to memory of 2576	1860	tmp.exe	98
PID 1860 wrote to memory of 2576	1860	tmp.exe	98
PID 1860 wrote to memory of 2576	1860	tmp.exe	98
PID 1860 wrote to memory of 2576	1860	tmp.exe	98
PID 1860 wrote to memory of 2568	1860	tmp.exe	99
PID 1860 wrote to memory of 2568	1860	tmp.exe	99
PID 1860 wrote to memory of 2568	1860	tmp.exe	99
PID 1860 wrote to memory of 2568	1860	tmp.exe	99
PID 1860 wrote to memory of 540	1860	tmp.exe	100
PID 1860 wrote to memory of 540	1860	tmp.exe	100
PID 1860 wrote to memory of 540	1860	tmp.exe	100
PID 1860 wrote to memory of 2660	1860	tmp.exe	101
PID 1860 wrote to memory of 2660	1860	tmp.exe	101
PID 1860 wrote to memory of 2660	1860	tmp.exe	101
PID 1860 wrote to memory of 2660	1860	tmp.exe	101

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1628
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  C:\Users\Admin\AppData\Local\Temp\tmp.exe
  2⤵
  PID:3496
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  C:\Users\Admin\AppData\Local\Temp\tmp.exe
  2⤵
  PID:3768
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  C:\Users\Admin\AppData\Local\Temp\tmp.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Users\Admin\AppData\Local\Temp\tmp.exe
    C:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\kankhulpgevvooud"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4228
- - C:\Users\Admin\AppData\Local\Temp\tmp.exe
    C:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\vcsuimviunnaruqhmag"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:4648
- - C:\Users\Admin\AppData\Local\Temp\tmp.exe
    C:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\xwfnifgkivffbaelvlaotx"
    3⤵
    - Suspicious use of UnmapMainImage
    PID:3968
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 12
      4⤵
      Program crash
      PID:2868
- - C:\Users\Admin\AppData\Local\Temp\tmp.exe
    C:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\ghdnyjhtxkslddslroi"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2576
- - C:\Users\Admin\AppData\Local\Temp\tmp.exe
    C:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\rjqgybsmtskynjgojzvnzv"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:2568
- - C:\Users\Admin\AppData\Local\Temp\tmp.exe
    C:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\bewyzudogbccqxcssbiokazlvs"
    3⤵
    PID:540
- - C:\Users\Admin\AppData\Local\Temp\tmp.exe
    C:\Users\Admin\AppData\Local\Temp\tmp.exe /stext "C:\Users\Admin\AppData\Local\Temp\bewyzudogbccqxcssbiokazlvs"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3968 -ip 3968
1⤵
PID:3164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ghdnyjhtxkslddslroi

Filesize
4KB

MD5
9945b47a62f116c5707cfe39eba4e3a3

SHA1
3a891690b33791216df5ca70ff15c288b8ec3223

SHA256
bec9bca76621ea0f0db461945ca513d00aba466d4cf882a437a8de82075784f1

SHA512
7c0ba560d4332ca00c6b2e3e938c50e7006b0775ba2eec3ff287adf656de508795be097a6a12d9f3cb9a43ac63c0f52f2574ad1cdebe868fd4ac02e683687e48

Download Submit
C:\Users\Admin\AppData\Local\Temp\kankhulpgevvooud

Filesize
4KB

MD5
9945b47a62f116c5707cfe39eba4e3a3

SHA1
3a891690b33791216df5ca70ff15c288b8ec3223

SHA256
bec9bca76621ea0f0db461945ca513d00aba466d4cf882a437a8de82075784f1

SHA512
7c0ba560d4332ca00c6b2e3e938c50e7006b0775ba2eec3ff287adf656de508795be097a6a12d9f3cb9a43ac63c0f52f2574ad1cdebe868fd4ac02e683687e48

Download Submit
memory/1628-135-0x0000000004BC0000-0x0000000004BF6000-memory.dmp

Filesize
216KB

Download
memory/1628-136-0x0000000005230000-0x0000000005858000-memory.dmp

Filesize
6.2MB

Download
memory/1628-137-0x00000000058D0000-0x0000000005936000-memory.dmp

Filesize
408KB

Download
memory/1628-138-0x0000000005B30000-0x0000000005B96000-memory.dmp

Filesize
408KB

Download
memory/1628-139-0x0000000006170000-0x000000000618E000-memory.dmp

Filesize
120KB

Download
memory/1628-140-0x00000000077C0000-0x0000000007E3A000-memory.dmp

Filesize
6.5MB

Download
memory/1628-141-0x0000000006690000-0x00000000066AA000-memory.dmp

Filesize
104KB

Download
memory/1860-161-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/1860-145-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1860-146-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1860-147-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1860-148-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1860-149-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1860-160-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/1860-157-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2568-169-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2576-167-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2660-170-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4228-155-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4228-154-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4648-162-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4648-153-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4732-132-0x0000000000D10000-0x0000000000FC2000-memory.dmp

Filesize
2.7MB

Download
memory/4732-133-0x0000000005DA0000-0x0000000005DC2000-memory.dmp

Filesize
136KB

Download