remcos | c99b050645ebbc138018a9dcb4c3029bc1a9aa9376e7541c1011e815942948e1

Resubmissions

01-02-2023 17:02

230201-vj6p3aah39 10

01-02-2023 17:00

230201-vjf5eacg4s 10

01-02-2023 16:57

230201-vgbrxacg2y 10

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-02-2023 16:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ORDER INQUIRY 20230201.exe
Size

1.1MB
MD5

4bc918bf6311c5b753c353efd306547e
SHA1

9b7301fc448a6d9564e6b984363190ffa88ab891
SHA256

89f4203e055ad6d3b40b74d683ed1ca0436ad4df41c3456f23134c4a15eb6c13
SHA512

0d9b575c93cb73de5cfc175335f72cefb8b9d3f5d5e90ab1353b0362fbde0bbcfc288fa5039759fb92ad0154e836c3cefb9636e7a108d5706023611e1ac93cfe
SSDEEP

24576:peOaJr8zw6RgDlCwwWbYqhseWy97+3A3Me83RAiTH/qc4N34:pAJr8zgDlCww6YqhsOY3OKhAiT

Score

10^/10

remcos new rem stub collection rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

NEW REM STUB

onyem.duckdns.org:5050

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-HFP2Q6
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral18/memory/4484-155-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral18/memory/4336-157-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral18/memory/4336-158-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 4 IoCs

resource	yara_rule
behavioral18/memory/4484-155-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral18/memory/4336-157-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral18/memory/3492-156-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral18/memory/4336-158-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	ORDER INQUIRY 20230201.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	ORDER INQUIRY 20230201.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 5000 set thread context of 2552	5000	ORDER INQUIRY 20230201.exe	96
PID 2552 set thread context of 4336	2552	ORDER INQUIRY 20230201.exe	97
PID 2552 set thread context of 4484	2552	ORDER INQUIRY 20230201.exe	99
PID 2552 set thread context of 3492	2552	ORDER INQUIRY 20230201.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3608	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
5000	ORDER INQUIRY 20230201.exe
5000	ORDER INQUIRY 20230201.exe
5000	ORDER INQUIRY 20230201.exe
5000	ORDER INQUIRY 20230201.exe
5000	ORDER INQUIRY 20230201.exe
5000	ORDER INQUIRY 20230201.exe
5000	ORDER INQUIRY 20230201.exe
396	powershell.exe
396	powershell.exe
4336	ORDER INQUIRY 20230201.exe
4336	ORDER INQUIRY 20230201.exe
3492	ORDER INQUIRY 20230201.exe
3492	ORDER INQUIRY 20230201.exe
4336	ORDER INQUIRY 20230201.exe
4336	ORDER INQUIRY 20230201.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2552	ORDER INQUIRY 20230201.exe
2552	ORDER INQUIRY 20230201.exe
2552	ORDER INQUIRY 20230201.exe
2552	ORDER INQUIRY 20230201.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5000	ORDER INQUIRY 20230201.exe
Token: SeDebugPrivilege	396	powershell.exe
Token: SeDebugPrivilege	3492	ORDER INQUIRY 20230201.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2552	ORDER INQUIRY 20230201.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 396	5000	ORDER INQUIRY 20230201.exe	92
PID 5000 wrote to memory of 396	5000	ORDER INQUIRY 20230201.exe	92
PID 5000 wrote to memory of 396	5000	ORDER INQUIRY 20230201.exe	92
PID 5000 wrote to memory of 3608	5000	ORDER INQUIRY 20230201.exe	94
PID 5000 wrote to memory of 3608	5000	ORDER INQUIRY 20230201.exe	94
PID 5000 wrote to memory of 3608	5000	ORDER INQUIRY 20230201.exe	94
PID 5000 wrote to memory of 2552	5000	ORDER INQUIRY 20230201.exe	96
PID 5000 wrote to memory of 2552	5000	ORDER INQUIRY 20230201.exe	96
PID 5000 wrote to memory of 2552	5000	ORDER INQUIRY 20230201.exe	96
PID 5000 wrote to memory of 2552	5000	ORDER INQUIRY 20230201.exe	96
PID 5000 wrote to memory of 2552	5000	ORDER INQUIRY 20230201.exe	96
PID 5000 wrote to memory of 2552	5000	ORDER INQUIRY 20230201.exe	96
PID 5000 wrote to memory of 2552	5000	ORDER INQUIRY 20230201.exe	96
PID 5000 wrote to memory of 2552	5000	ORDER INQUIRY 20230201.exe	96
PID 5000 wrote to memory of 2552	5000	ORDER INQUIRY 20230201.exe	96
PID 5000 wrote to memory of 2552	5000	ORDER INQUIRY 20230201.exe	96
PID 5000 wrote to memory of 2552	5000	ORDER INQUIRY 20230201.exe	96
PID 5000 wrote to memory of 2552	5000	ORDER INQUIRY 20230201.exe	96
PID 2552 wrote to memory of 4336	2552	ORDER INQUIRY 20230201.exe	97
PID 2552 wrote to memory of 4336	2552	ORDER INQUIRY 20230201.exe	97
PID 2552 wrote to memory of 4336	2552	ORDER INQUIRY 20230201.exe	97
PID 2552 wrote to memory of 4336	2552	ORDER INQUIRY 20230201.exe	97
PID 2552 wrote to memory of 4300	2552	ORDER INQUIRY 20230201.exe	98
PID 2552 wrote to memory of 4300	2552	ORDER INQUIRY 20230201.exe	98
PID 2552 wrote to memory of 4300	2552	ORDER INQUIRY 20230201.exe	98
PID 2552 wrote to memory of 4484	2552	ORDER INQUIRY 20230201.exe	99
PID 2552 wrote to memory of 4484	2552	ORDER INQUIRY 20230201.exe	99
PID 2552 wrote to memory of 4484	2552	ORDER INQUIRY 20230201.exe	99
PID 2552 wrote to memory of 4484	2552	ORDER INQUIRY 20230201.exe	99
PID 2552 wrote to memory of 3492	2552	ORDER INQUIRY 20230201.exe	100
PID 2552 wrote to memory of 3492	2552	ORDER INQUIRY 20230201.exe	100
PID 2552 wrote to memory of 3492	2552	ORDER INQUIRY 20230201.exe	100
PID 2552 wrote to memory of 3492	2552	ORDER INQUIRY 20230201.exe	100

C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\VlANzLOhprFUhQ.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:396
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VlANzLOhprFUhQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3885.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3608
- C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe
  "C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe
    "C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe" /stext "C:\Users\Admin\AppData\Local\Temp\carnwhroylatfxsrhcgxtsgvu"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4336
- - C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe
    "C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ecwfxzchutsgidhdqftyefbedrcgh"
    3⤵
    PID:4300
- - C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe
    "C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ecwfxzchutsgidhdqftyefbedrcgh"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:4484
- - C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe
    "C:\Users\Admin\AppData\Local\Temp\ORDER INQUIRY 20230201.exe" /stext "C:\Users\Admin\AppData\Local\Temp\owjyysnjibklsrdhhqfspkwvlxupizun"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\carnwhroylatfxsrhcgxtsgvu

Filesize
4KB

MD5
07c14121728256ad56b1ef039a28e4a6

SHA1
0f39e1e02cd5e2b1b22d9e5470757ae13fe96738

SHA256
8d46702077d776b04085cbe5ce2f0e5971595ea4e11b025a215c4379e7fc18f8

SHA512
03d9113095e7b6143c4f99b131462fa451a9c2d7e841461603dace64bd6d525cb63d074384d2b3ff285a7183116f1715138beeb756fced9a6b1ad6fde36d4789

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3885.tmp

Filesize
1KB

MD5
fbefb24302b650482804be46d0293e48

SHA1
1b50f42085c309779dedee87eb891a70c3c36195

SHA256
2365300a31ece71f929c5c597d9245ec796c6400d4d788ff05c026bc7c08c3d5

SHA512
b3b154c5c7967f9407bb8db3549654605e5d5f0889718ab82641a98ff26b03c08a003c4c3a59f84eb2714b32cf1f8e35c4669a4a7b660920da876d360de24bf7

Download Submit
memory/396-141-0x0000000004D80000-0x00000000053A8000-memory.dmp

Filesize
6.2MB

Download
memory/396-162-0x00000000060F0000-0x000000000610E000-memory.dmp

Filesize
120KB

Download
memory/396-168-0x0000000007200000-0x000000000721A000-memory.dmp

Filesize
104KB

Download
memory/396-153-0x0000000005B40000-0x0000000005B5E000-memory.dmp

Filesize
120KB

Download
memory/396-167-0x00000000070F0000-0x00000000070FE000-memory.dmp

Filesize
56KB

Download
memory/396-139-0x0000000002200000-0x0000000002236000-memory.dmp

Filesize
216KB

Download
memory/396-166-0x0000000007140000-0x00000000071D6000-memory.dmp

Filesize
600KB

Download
memory/396-165-0x0000000006F30000-0x0000000006F3A000-memory.dmp

Filesize
40KB

Download
memory/396-164-0x0000000006EC0000-0x0000000006EDA000-memory.dmp

Filesize
104KB

Download
memory/396-163-0x0000000007510000-0x0000000007B8A000-memory.dmp

Filesize
6.5MB

Download
memory/396-161-0x0000000070EE0000-0x0000000070F2C000-memory.dmp

Filesize
304KB

Download
memory/396-145-0x0000000004B70000-0x0000000004B92000-memory.dmp

Filesize
136KB

Download
memory/396-160-0x0000000006110000-0x0000000006142000-memory.dmp

Filesize
200KB

Download
memory/396-148-0x0000000005510000-0x0000000005576000-memory.dmp

Filesize
408KB

Download
memory/396-147-0x00000000054A0000-0x0000000005506000-memory.dmp

Filesize
408KB

Download
memory/396-169-0x00000000071E0000-0x00000000071E8000-memory.dmp

Filesize
32KB

Download
memory/2552-146-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2552-170-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2552-144-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2552-143-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2552-149-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3492-156-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4336-158-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4336-157-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/4484-155-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5000-132-0x0000000000190000-0x00000000002A6000-memory.dmp

Filesize
1.1MB

Download
memory/5000-134-0x0000000004C90000-0x0000000004D22000-memory.dmp

Filesize
584KB

Download
memory/5000-133-0x0000000005370000-0x0000000005914000-memory.dmp

Filesize
5.6MB

Download
memory/5000-136-0x0000000008800000-0x000000000889C000-memory.dmp

Filesize
624KB

Download
memory/5000-135-0x0000000004C40000-0x0000000004C4A000-memory.dmp

Filesize
40KB

Download