remcos | c99b050645ebbc138018a9dcb4c3029bc1a9aa9376e7541c1011e815942948e1

Resubmissions

01-02-2023 17:02

230201-vj6p3aah39 10

01-02-2023 17:00

230201-vjf5eacg4s 10

01-02-2023 16:57

230201-vgbrxacg2y 10

Analysis

max time kernel
151s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
01-02-2023 16:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DHL SHIPPING DOC PDF.exe
Size

1.0MB
MD5

6d452842eeb2efa505763049d59c553a
SHA1

e13f2202155e12573a985b5df24319e5320f588e
SHA256

52e2a0d6ec4940ac71db48d62f8de4fa9ea7ea4a0abfaff91175ea2e0ec0d998
SHA512

c37faf01a77690351e6cd47196821dddca39a3df07a9286b17e2916fc107429ddadc5dc9fa695bfb52ab8105a1e41b1367c6d68472dac64ecb47f9a9be4add54
SSDEEP

24576:uL5mA6W5L4EAyxtiH5wkm99RtPK7TQXQyRU5JqG4yPa:eJ41OtiH5wbbRucXQyRU8

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

51.75.209.245:2406

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-52YOYG
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

DHL SHIPPING DOC PDF.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	DHL SHIPPING DOC PDF.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

DHL SHIPPING DOC PDF.exe

description pid process target process

PID 3728 set thread context of 4312 3728 DHL SHIPPING DOC PDF.exe DHL SHIPPING DOC PDF.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4256 schtasks.exe

description	pid	process	target process
PID 3728 set thread context of 4312	3728	DHL SHIPPING DOC PDF.exe	DHL SHIPPING DOC PDF.exe

pid	process
4256	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

DHL SHIPPING DOC PDF.exepowershell.exepowershell.exe

pid	process
3728	DHL SHIPPING DOC PDF.exe
3728	DHL SHIPPING DOC PDF.exe
3728	DHL SHIPPING DOC PDF.exe
3728	DHL SHIPPING DOC PDF.exe
3728	DHL SHIPPING DOC PDF.exe
3728	DHL SHIPPING DOC PDF.exe
4788	powershell.exe
4580	powershell.exe
3728	DHL SHIPPING DOC PDF.exe
4788	powershell.exe
4580	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

DHL SHIPPING DOC PDF.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3728	DHL SHIPPING DOC PDF.exe
Token: SeDebugPrivilege	4580	powershell.exe
Token: SeDebugPrivilege	4788	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

DHL SHIPPING DOC PDF.exe

pid process

4312 DHL SHIPPING DOC PDF.exe

pid	process
4312	DHL SHIPPING DOC PDF.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

DHL SHIPPING DOC PDF.exe

description	pid	process	target process
PID 3728 wrote to memory of 4788	3728	DHL SHIPPING DOC PDF.exe	powershell.exe
PID 3728 wrote to memory of 4788	3728	DHL SHIPPING DOC PDF.exe	powershell.exe
PID 3728 wrote to memory of 4788	3728	DHL SHIPPING DOC PDF.exe	powershell.exe
PID 3728 wrote to memory of 4580	3728	DHL SHIPPING DOC PDF.exe	powershell.exe
PID 3728 wrote to memory of 4580	3728	DHL SHIPPING DOC PDF.exe	powershell.exe
PID 3728 wrote to memory of 4580	3728	DHL SHIPPING DOC PDF.exe	powershell.exe
PID 3728 wrote to memory of 4256	3728	DHL SHIPPING DOC PDF.exe	schtasks.exe
PID 3728 wrote to memory of 4256	3728	DHL SHIPPING DOC PDF.exe	schtasks.exe
PID 3728 wrote to memory of 4256	3728	DHL SHIPPING DOC PDF.exe	schtasks.exe
PID 3728 wrote to memory of 4312	3728	DHL SHIPPING DOC PDF.exe	DHL SHIPPING DOC PDF.exe
PID 3728 wrote to memory of 4312	3728	DHL SHIPPING DOC PDF.exe	DHL SHIPPING DOC PDF.exe
PID 3728 wrote to memory of 4312	3728	DHL SHIPPING DOC PDF.exe	DHL SHIPPING DOC PDF.exe
PID 3728 wrote to memory of 4312	3728	DHL SHIPPING DOC PDF.exe	DHL SHIPPING DOC PDF.exe
PID 3728 wrote to memory of 4312	3728	DHL SHIPPING DOC PDF.exe	DHL SHIPPING DOC PDF.exe
PID 3728 wrote to memory of 4312	3728	DHL SHIPPING DOC PDF.exe	DHL SHIPPING DOC PDF.exe
PID 3728 wrote to memory of 4312	3728	DHL SHIPPING DOC PDF.exe	DHL SHIPPING DOC PDF.exe
PID 3728 wrote to memory of 4312	3728	DHL SHIPPING DOC PDF.exe	DHL SHIPPING DOC PDF.exe
PID 3728 wrote to memory of 4312	3728	DHL SHIPPING DOC PDF.exe	DHL SHIPPING DOC PDF.exe
PID 3728 wrote to memory of 4312	3728	DHL SHIPPING DOC PDF.exe	DHL SHIPPING DOC PDF.exe
PID 3728 wrote to memory of 4312	3728	DHL SHIPPING DOC PDF.exe	DHL SHIPPING DOC PDF.exe
PID 3728 wrote to memory of 4312	3728	DHL SHIPPING DOC PDF.exe	DHL SHIPPING DOC PDF.exe

C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe
"C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3728

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4788

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gpnAwW.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4580

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gpnAwW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9A8A.tmp"
2⤵
- Creates scheduled task(s)
PID:4256

C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe
"C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:4312

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
375a01de572727008c9b3514842fa011

SHA1
d6549314d5992400ee44213b9f11748a0b26fff6

SHA256
2e17d15658d8f45d517cfb543a42e40a51c0425d5dbb0e0000e379ef60149628

SHA512
b775320adeb4e7c180939162ec4cdedc4e91d2e1bf266cdff45ec572b4bbbc874bbd18f470f6a352bfa3d16303c66a1948477dd0327bff2e541b93724cddf0a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9A8A.tmp
Filesize
1KB

MD5
4ac184107864d7680f5b49f1557815c5

SHA1
b11f395985df173b3a8a158e8055561f8a19ebaf

SHA256
5673882ecc992d0914d928b6080e4bb9837639cbea9ece12fa571b1d7c39756f

SHA512
36cfcf9a3eced9b496e995771e00fee31b29fe08ef6e00c029895a140211f3e77d2dce01132c56c7b334649c79e9ca9e35e1f2432a512fe78cdd7bab783d2f98

Download Submit
memory/3728-135-0x00000000054C0000-0x00000000054CA000-memory.dmp

Filesize
40KB

Download
memory/3728-136-0x0000000008E50000-0x0000000008EEC000-memory.dmp

Filesize
624KB

Download
memory/3728-134-0x0000000005410000-0x00000000054A2000-memory.dmp

Filesize
584KB

Download
memory/3728-132-0x0000000000980000-0x0000000000A88000-memory.dmp

Filesize
1.0MB

Download
memory/3728-133-0x0000000005AB0000-0x0000000006054000-memory.dmp

Filesize
5.6MB

Download
memory/4256-139-0x0000000000000000-mapping.dmp

Download
memory/4312-148-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4312-164-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4312-151-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4312-144-0x0000000000000000-mapping.dmp

Download
memory/4312-149-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4312-147-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4580-156-0x0000000007910000-0x0000000007F8A000-memory.dmp

Filesize
6.5MB

Download
memory/4580-145-0x00000000051B0000-0x0000000005216000-memory.dmp

Filesize
408KB

Download
memory/4580-138-0x0000000000000000-mapping.dmp

Download
memory/4580-161-0x0000000007610000-0x000000000762A000-memory.dmp

Filesize
104KB

Download
memory/4580-160-0x0000000007500000-0x000000000750E000-memory.dmp

Filesize
56KB

Download
memory/4580-142-0x0000000005340000-0x0000000005968000-memory.dmp

Filesize
6.2MB

Download
memory/4580-158-0x0000000007340000-0x000000000734A000-memory.dmp

Filesize
40KB

Download
memory/4580-153-0x0000000073DE0000-0x0000000073E2C000-memory.dmp

Filesize
304KB

Download
memory/4788-155-0x0000000006140000-0x000000000615E000-memory.dmp

Filesize
120KB

Download
memory/4788-154-0x0000000073DE0000-0x0000000073E2C000-memory.dmp

Filesize
304KB

Download
memory/4788-140-0x0000000002280000-0x00000000022B6000-memory.dmp

Filesize
216KB

Download
memory/4788-157-0x0000000006EA0000-0x0000000006EBA000-memory.dmp

Filesize
104KB

Download
memory/4788-152-0x0000000006180000-0x00000000061B2000-memory.dmp

Filesize
200KB

Download
memory/4788-159-0x0000000007120000-0x00000000071B6000-memory.dmp

Filesize
600KB

Download
memory/4788-150-0x0000000005B90000-0x0000000005BAE000-memory.dmp

Filesize
120KB

Download
memory/4788-146-0x0000000005520000-0x0000000005586000-memory.dmp

Filesize
408KB

Download
memory/4788-162-0x00000000071C0000-0x00000000071C8000-memory.dmp

Filesize
32KB

Download
memory/4788-143-0x0000000004AC0000-0x0000000004AE2000-memory.dmp

Filesize
136KB

Download
memory/4788-137-0x0000000000000000-mapping.dmp

Download