remcos | c99b050645ebbc138018a9dcb4c3029bc1a9aa9376e7541c1011e815942948e1

Resubmissions

01-02-2023 17:02

230201-vj6p3aah39 10

01-02-2023 17:00

230201-vjf5eacg4s 10

01-02-2023 16:57

230201-vgbrxacg2y 10

Analysis

max time kernel
602s
max time network
606s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
01-02-2023 17:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DHL SHIPPING DOC PDF.exe
Size

1.0MB
MD5

6d452842eeb2efa505763049d59c553a
SHA1

e13f2202155e12573a985b5df24319e5320f588e
SHA256

52e2a0d6ec4940ac71db48d62f8de4fa9ea7ea4a0abfaff91175ea2e0ec0d998
SHA512

c37faf01a77690351e6cd47196821dddca39a3df07a9286b17e2916fc107429ddadc5dc9fa695bfb52ab8105a1e41b1367c6d68472dac64ecb47f9a9be4add54
SSDEEP

24576:uL5mA6W5L4EAyxtiH5wkm99RtPK7TQXQyRU5JqG4yPa:eJ41OtiH5wbbRucXQyRU8

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

51.75.209.245:2406

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-52YOYG
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	DHL SHIPPING DOC PDF.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4756 set thread context of 1048	4756	DHL SHIPPING DOC PDF.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4756	DHL SHIPPING DOC PDF.exe
4756	DHL SHIPPING DOC PDF.exe
4756	DHL SHIPPING DOC PDF.exe
4756	DHL SHIPPING DOC PDF.exe
4756	DHL SHIPPING DOC PDF.exe
4756	DHL SHIPPING DOC PDF.exe
1372	powershell.exe
1636	powershell.exe
4756	DHL SHIPPING DOC PDF.exe
1372	powershell.exe
1636	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4756	DHL SHIPPING DOC PDF.exe
Token: SeDebugPrivilege	1372	powershell.exe
Token: SeDebugPrivilege	1636	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1048	DHL SHIPPING DOC PDF.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 1372	4756	DHL SHIPPING DOC PDF.exe	84
PID 4756 wrote to memory of 1372	4756	DHL SHIPPING DOC PDF.exe	84
PID 4756 wrote to memory of 1372	4756	DHL SHIPPING DOC PDF.exe	84
PID 4756 wrote to memory of 1636	4756	DHL SHIPPING DOC PDF.exe	86
PID 4756 wrote to memory of 1636	4756	DHL SHIPPING DOC PDF.exe	86
PID 4756 wrote to memory of 1636	4756	DHL SHIPPING DOC PDF.exe	86
PID 4756 wrote to memory of 3664	4756	DHL SHIPPING DOC PDF.exe	88
PID 4756 wrote to memory of 3664	4756	DHL SHIPPING DOC PDF.exe	88
PID 4756 wrote to memory of 3664	4756	DHL SHIPPING DOC PDF.exe	88
PID 4756 wrote to memory of 1048	4756	DHL SHIPPING DOC PDF.exe	90
PID 4756 wrote to memory of 1048	4756	DHL SHIPPING DOC PDF.exe	90
PID 4756 wrote to memory of 1048	4756	DHL SHIPPING DOC PDF.exe	90
PID 4756 wrote to memory of 1048	4756	DHL SHIPPING DOC PDF.exe	90
PID 4756 wrote to memory of 1048	4756	DHL SHIPPING DOC PDF.exe	90
PID 4756 wrote to memory of 1048	4756	DHL SHIPPING DOC PDF.exe	90
PID 4756 wrote to memory of 1048	4756	DHL SHIPPING DOC PDF.exe	90
PID 4756 wrote to memory of 1048	4756	DHL SHIPPING DOC PDF.exe	90
PID 4756 wrote to memory of 1048	4756	DHL SHIPPING DOC PDF.exe	90
PID 4756 wrote to memory of 1048	4756	DHL SHIPPING DOC PDF.exe	90
PID 4756 wrote to memory of 1048	4756	DHL SHIPPING DOC PDF.exe	90
PID 4756 wrote to memory of 1048	4756	DHL SHIPPING DOC PDF.exe	90

C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe
"C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1372
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gpnAwW.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1636
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gpnAwW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6C18.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3664
- C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1048

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
05d2797c5ae85fe5f3e904def3b17728

SHA1
dbd89911834423f0c78e2b2f2a21c4ba5a9bb034

SHA256
6068d34d3338301cd43e750f13643ffa91b90161c92c34a7986ba6657142a3df

SHA512
ce0fd474b9086579791a13a961affcef8aa01c438ca8c96084a73bc4204fd101c166301b795266641265245cf8cb91a14ae812bba215ced51fe6bc78ebc0db8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6C18.tmp

Filesize
1KB

MD5
6478fd68cca69606cccd5cb4ee8f4ab5

SHA1
3a079fc5bb33d25ed8c5b3d96f3fe1600089e153

SHA256
4cd6cdeb0bd856e05d80cc27a574f67482192c0d01d1e865003c9e68488af2be

SHA512
ac19e3616292803c859f4ea9797c4ebc3c4941fcfe1e89e7fd935a5e29affa9f159dfb44da09fdbd0300a9c59230e60446762023b0eae47aedb5dd9f189257ac

Download Submit
memory/1048-165-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1048-151-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1048-149-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1048-147-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1048-148-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1372-142-0x0000000005340000-0x0000000005362000-memory.dmp

Filesize
136KB

Download
memory/1372-141-0x0000000005380000-0x00000000059A8000-memory.dmp

Filesize
6.2MB

Download
memory/1372-158-0x0000000007470000-0x000000000747A000-memory.dmp

Filesize
40KB

Download
memory/1372-145-0x0000000005B00000-0x0000000005B66000-memory.dmp

Filesize
408KB

Download
memory/1372-159-0x0000000007680000-0x0000000007716000-memory.dmp

Filesize
600KB

Download
memory/1372-139-0x00000000027B0000-0x00000000027E6000-memory.dmp

Filesize
216KB

Download
memory/1372-160-0x0000000007630000-0x000000000763E000-memory.dmp

Filesize
56KB

Download
memory/1372-154-0x0000000074DA0000-0x0000000074DEC000-memory.dmp

Filesize
304KB

Download
memory/1372-150-0x00000000060F0000-0x000000000610E000-memory.dmp

Filesize
120KB

Download
memory/1372-162-0x0000000007720000-0x0000000007728000-memory.dmp

Filesize
32KB

Download
memory/1372-152-0x00000000066B0000-0x00000000066E2000-memory.dmp

Filesize
200KB

Download
memory/1372-157-0x0000000007410000-0x000000000742A000-memory.dmp

Filesize
104KB

Download
memory/1636-156-0x00000000078A0000-0x0000000007F1A000-memory.dmp

Filesize
6.5MB

Download
memory/1636-155-0x0000000006510000-0x000000000652E000-memory.dmp

Filesize
120KB

Download
memory/1636-153-0x0000000074DA0000-0x0000000074DEC000-memory.dmp

Filesize
304KB

Download
memory/1636-144-0x0000000005760000-0x00000000057C6000-memory.dmp

Filesize
408KB

Download
memory/1636-161-0x00000000075A0000-0x00000000075BA000-memory.dmp

Filesize
104KB

Download
memory/4756-132-0x0000000000D80000-0x0000000000E88000-memory.dmp

Filesize
1.0MB

Download
memory/4756-136-0x0000000009250000-0x00000000092EC000-memory.dmp

Filesize
624KB

Download
memory/4756-135-0x00000000058D0000-0x00000000058DA000-memory.dmp

Filesize
40KB

Download
memory/4756-134-0x0000000005700000-0x0000000005792000-memory.dmp

Filesize
584KB

Download
memory/4756-133-0x0000000005C10000-0x00000000061B4000-memory.dmp

Filesize
5.6MB

Download