remcos | c99b050645ebbc138018a9dcb4c3029bc1a9aa9376e7541c1011e815942948e1

Resubmissions

01-02-2023 17:02

230201-vj6p3aah39 10

01-02-2023 17:00

230201-vjf5eacg4s 10

01-02-2023 16:57

230201-vgbrxacg2y 10

Analysis

max time kernel
149s
max time network
131s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-02-2023 16:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DHL SHIPPING DOC PDF.exe
Size

1.0MB
MD5

6d452842eeb2efa505763049d59c553a
SHA1

e13f2202155e12573a985b5df24319e5320f588e
SHA256

52e2a0d6ec4940ac71db48d62f8de4fa9ea7ea4a0abfaff91175ea2e0ec0d998
SHA512

c37faf01a77690351e6cd47196821dddca39a3df07a9286b17e2916fc107429ddadc5dc9fa695bfb52ab8105a1e41b1367c6d68472dac64ecb47f9a9be4add54
SSDEEP

24576:uL5mA6W5L4EAyxtiH5wkm99RtPK7TQXQyRU5JqG4yPa:eJ41OtiH5wbbRucXQyRU8

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

51.75.209.245:2406

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-52YOYG
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 904 set thread context of 960	904	DHL SHIPPING DOC PDF.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
904	DHL SHIPPING DOC PDF.exe
904	DHL SHIPPING DOC PDF.exe
904	DHL SHIPPING DOC PDF.exe
904	DHL SHIPPING DOC PDF.exe
904	DHL SHIPPING DOC PDF.exe
860	powershell.exe
1216	powershell.exe
904	DHL SHIPPING DOC PDF.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	904	DHL SHIPPING DOC PDF.exe
Token: SeDebugPrivilege	860	powershell.exe
Token: SeDebugPrivilege	1216	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
960	DHL SHIPPING DOC PDF.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 860	904	DHL SHIPPING DOC PDF.exe	27
PID 904 wrote to memory of 860	904	DHL SHIPPING DOC PDF.exe	27
PID 904 wrote to memory of 860	904	DHL SHIPPING DOC PDF.exe	27
PID 904 wrote to memory of 860	904	DHL SHIPPING DOC PDF.exe	27
PID 904 wrote to memory of 1216	904	DHL SHIPPING DOC PDF.exe	29
PID 904 wrote to memory of 1216	904	DHL SHIPPING DOC PDF.exe	29
PID 904 wrote to memory of 1216	904	DHL SHIPPING DOC PDF.exe	29
PID 904 wrote to memory of 1216	904	DHL SHIPPING DOC PDF.exe	29
PID 904 wrote to memory of 1980	904	DHL SHIPPING DOC PDF.exe	31
PID 904 wrote to memory of 1980	904	DHL SHIPPING DOC PDF.exe	31
PID 904 wrote to memory of 1980	904	DHL SHIPPING DOC PDF.exe	31
PID 904 wrote to memory of 1980	904	DHL SHIPPING DOC PDF.exe	31
PID 904 wrote to memory of 960	904	DHL SHIPPING DOC PDF.exe	33
PID 904 wrote to memory of 960	904	DHL SHIPPING DOC PDF.exe	33
PID 904 wrote to memory of 960	904	DHL SHIPPING DOC PDF.exe	33
PID 904 wrote to memory of 960	904	DHL SHIPPING DOC PDF.exe	33
PID 904 wrote to memory of 960	904	DHL SHIPPING DOC PDF.exe	33
PID 904 wrote to memory of 960	904	DHL SHIPPING DOC PDF.exe	33
PID 904 wrote to memory of 960	904	DHL SHIPPING DOC PDF.exe	33
PID 904 wrote to memory of 960	904	DHL SHIPPING DOC PDF.exe	33
PID 904 wrote to memory of 960	904	DHL SHIPPING DOC PDF.exe	33
PID 904 wrote to memory of 960	904	DHL SHIPPING DOC PDF.exe	33
PID 904 wrote to memory of 960	904	DHL SHIPPING DOC PDF.exe	33
PID 904 wrote to memory of 960	904	DHL SHIPPING DOC PDF.exe	33
PID 904 wrote to memory of 960	904	DHL SHIPPING DOC PDF.exe	33

C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe
"C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:860
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gpnAwW.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1216
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gpnAwW" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCFFD.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1980
- C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpCFFD.tmp

Filesize
1KB

MD5
287bee001d261c79c63c237729c971a8

SHA1
3c29333b953da55fd1c1524878faadfa9f4bf637

SHA256
cbf917bef0caa224ae75f884a8db021a35f6723b4a8ad2ee561a43a2242f8605

SHA512
7ee23022628b77e8db72c0de4436760e0303c5cd1b907cd4a031a5bad50e93090d94067e6760749404cf9f63ff6d8f5291705d6307d9326e88d0569e9e1d7afe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
427d3fc62ff9b51950515dbc8b3d9b20

SHA1
f59f44f7cd9d22b39cff69cad4a39323466e0b7a

SHA256
cb49fd6a5e3d37e77f488e3ebc9dbb8444713ac6b7db2f0bccd1eff96563fdac

SHA512
a109c2b290d6fee61ed1987846fa723d207459c68fcff1d64d085fadd054f9027ade528f09669bcbb625b890baa92eacffcec6524606bb07c9e44670f071ab06

Download Submit
memory/860-86-0x000000006E3D0000-0x000000006E97B000-memory.dmp

Filesize
5.7MB

Download
memory/860-84-0x000000006E3D0000-0x000000006E97B000-memory.dmp

Filesize
5.7MB

Download
memory/904-54-0x00000000008C0000-0x00000000009C8000-memory.dmp

Filesize
1.0MB

Download
memory/904-55-0x0000000075E11000-0x0000000075E13000-memory.dmp

Filesize
8KB

Download
memory/904-56-0x0000000000390000-0x00000000003A4000-memory.dmp

Filesize
80KB

Download
memory/904-57-0x0000000000580000-0x000000000058A000-memory.dmp

Filesize
40KB

Download
memory/904-58-0x0000000007FD0000-0x0000000008082000-memory.dmp

Filesize
712KB

Download
memory/904-66-0x0000000008180000-0x00000000081FC000-memory.dmp

Filesize
496KB

Download
memory/960-83-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/960-70-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/960-72-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/960-73-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/960-74-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/960-75-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/960-77-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/960-79-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/960-68-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/960-67-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/960-89-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/960-88-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1216-87-0x000000006E3D0000-0x000000006E97B000-memory.dmp

Filesize
5.7MB

Download
memory/1216-85-0x000000006E3D0000-0x000000006E97B000-memory.dmp

Filesize
5.7MB

Download