remcos | c99b050645ebbc138018a9dcb4c3029bc1a9aa9376e7541c1011e815942948e1

Resubmissions

01/02/2023, 17:02

230201-vj6p3aah39 10

01/02/2023, 17:00

230201-vjf5eacg4s 10

01/02/2023, 16:57

230201-vgbrxacg2y 10

Analysis

max time kernel
149s
max time network
146s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/02/2023, 17:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DHL SHIPPING DOC PDF.exe
Size

1.0MB
MD5

6d452842eeb2efa505763049d59c553a
SHA1

e13f2202155e12573a985b5df24319e5320f588e
SHA256

52e2a0d6ec4940ac71db48d62f8de4fa9ea7ea4a0abfaff91175ea2e0ec0d998
SHA512

c37faf01a77690351e6cd47196821dddca39a3df07a9286b17e2916fc107429ddadc5dc9fa695bfb52ab8105a1e41b1367c6d68472dac64ecb47f9a9be4add54
SSDEEP

24576:uL5mA6W5L4EAyxtiH5wkm99RtPK7TQXQyRU5JqG4yPa:eJ41OtiH5wbbRucXQyRU8

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

51.75.209.245:2406

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-52YOYG
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 280 set thread context of 1460	280	DHL SHIPPING DOC PDF.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1600	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
280	DHL SHIPPING DOC PDF.exe
280	DHL SHIPPING DOC PDF.exe
280	DHL SHIPPING DOC PDF.exe
280	DHL SHIPPING DOC PDF.exe
280	DHL SHIPPING DOC PDF.exe
280	DHL SHIPPING DOC PDF.exe
900	powershell.exe
1696	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	280	DHL SHIPPING DOC PDF.exe
Token: SeDebugPrivilege	900	powershell.exe
Token: SeDebugPrivilege	1696	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1460	DHL SHIPPING DOC PDF.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 280 wrote to memory of 1696	280	DHL SHIPPING DOC PDF.exe	27
PID 280 wrote to memory of 1696	280	DHL SHIPPING DOC PDF.exe	27
PID 280 wrote to memory of 1696	280	DHL SHIPPING DOC PDF.exe	27
PID 280 wrote to memory of 1696	280	DHL SHIPPING DOC PDF.exe	27
PID 280 wrote to memory of 900	280	DHL SHIPPING DOC PDF.exe	29
PID 280 wrote to memory of 900	280	DHL SHIPPING DOC PDF.exe	29
PID 280 wrote to memory of 900	280	DHL SHIPPING DOC PDF.exe	29
PID 280 wrote to memory of 900	280	DHL SHIPPING DOC PDF.exe	29
PID 280 wrote to memory of 1600	280	DHL SHIPPING DOC PDF.exe	31
PID 280 wrote to memory of 1600	280	DHL SHIPPING DOC PDF.exe	31
PID 280 wrote to memory of 1600	280	DHL SHIPPING DOC PDF.exe	31
PID 280 wrote to memory of 1600	280	DHL SHIPPING DOC PDF.exe	31
PID 280 wrote to memory of 1460	280	DHL SHIPPING DOC PDF.exe	33
PID 280 wrote to memory of 1460	280	DHL SHIPPING DOC PDF.exe	33
PID 280 wrote to memory of 1460	280	DHL SHIPPING DOC PDF.exe	33
PID 280 wrote to memory of 1460	280	DHL SHIPPING DOC PDF.exe	33
PID 280 wrote to memory of 1460	280	DHL SHIPPING DOC PDF.exe	33
PID 280 wrote to memory of 1460	280	DHL SHIPPING DOC PDF.exe	33
PID 280 wrote to memory of 1460	280	DHL SHIPPING DOC PDF.exe	33
PID 280 wrote to memory of 1460	280	DHL SHIPPING DOC PDF.exe	33
PID 280 wrote to memory of 1460	280	DHL SHIPPING DOC PDF.exe	33
PID 280 wrote to memory of 1460	280	DHL SHIPPING DOC PDF.exe	33
PID 280 wrote to memory of 1460	280	DHL SHIPPING DOC PDF.exe	33
PID 280 wrote to memory of 1460	280	DHL SHIPPING DOC PDF.exe	33
PID 280 wrote to memory of 1460	280	DHL SHIPPING DOC PDF.exe	33

C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe
"C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:280
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1696
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gpnAwW.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:900
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gpnAwW" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCBA9.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1600
- C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\DHL SHIPPING DOC PDF.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpCBA9.tmp

Filesize
1KB

MD5
287bee001d261c79c63c237729c971a8

SHA1
3c29333b953da55fd1c1524878faadfa9f4bf637

SHA256
cbf917bef0caa224ae75f884a8db021a35f6723b4a8ad2ee561a43a2242f8605

SHA512
7ee23022628b77e8db72c0de4436760e0303c5cd1b907cd4a031a5bad50e93090d94067e6760749404cf9f63ff6d8f5291705d6307d9326e88d0569e9e1d7afe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
a7eab551e17425353a0bb0041ef5cb05

SHA1
c908c662993796916a67a61136d743769153fb33

SHA256
7793d9a76bf7bfdf92123842bffaf4ea0886f245008855fc7640a329c59a4aef

SHA512
e006374563ae93a93c710aff6a001ed31e78d06401b235941d3a994016b8cd10c6c44f810f85a195b2552eda9aa4c94b5e6ad986939c5bf7b93469af953f8db3

Download Submit
memory/280-66-0x00000000080C0000-0x000000000813C000-memory.dmp

Filesize
496KB

Download
memory/280-55-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download
memory/280-56-0x0000000000390000-0x00000000003A4000-memory.dmp

Filesize
80KB

Download
memory/280-57-0x00000000004B0000-0x00000000004BA000-memory.dmp

Filesize
40KB

Download
memory/280-58-0x0000000005FB0000-0x0000000006062000-memory.dmp

Filesize
712KB

Download
memory/280-54-0x0000000000C60000-0x0000000000D68000-memory.dmp

Filesize
1.0MB

Download
memory/900-85-0x000000006F9B0000-0x000000006FF5B000-memory.dmp

Filesize
5.7MB

Download
memory/1460-68-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1460-75-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1460-87-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1460-70-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1460-72-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1460-73-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1460-74-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1460-67-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1460-77-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1460-79-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1460-83-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1460-86-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1696-84-0x000000006F9B0000-0x000000006FF5B000-memory.dmp

Filesize
5.7MB

Download