remcos | 7f957a63ff320cf43b53f9f8e7a11ffd327c12a63704cc7fdf11a9a1111ed8f7

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
09/02/2023, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hesaphareketi-01.pdf.exe
Size 554KB
Sample230209-mpp1hagg67
SHA256 7f957a63ff320cf43b53f9f8e7a11ffd327c12a63704cc7fdf11a9a1111ed8f7
MD5 717445cae48a9d1f360cbb33ebf6f13e
SHA1 62babaeb13830077f391e02e5549338361e634c5
SHA512 098274b28f09b03c21dacc37ec2b82b778e3b896bc8bdb9b424c3c9a2bff3d6de054f548416585e3301face14e98ceaabe0fedcfa005123db969171b2aa81321
SSDEEP 12288:+YbZtLo6pUwdDF0jDqRqctH1UO79pwRpkF0gaC:+YbZVxUwdDF0fQdH1xhpwO0gh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

report1.duckdns.org:5890

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-O5GSXS
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
1232	axkazhdzmh.exe
1336	axkazhdzmh.exe

Loads dropped DLL 3 IoCs

pid	Process
1652	hesaphareketi-01.pdf.exe
1652	hesaphareketi-01.pdf.exe
1232	axkazhdzmh.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\nwscotvemnk = "C:\\Users\\Admin\\AppData\\Roaming\\rbaqwntxctptt\\hxwsf.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\axkazhdzmh.exe\" C:\\Users\\Admin\\AppData\\L"	axkazhdzmh.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1232 set thread context of 1336	1232	axkazhdzmh.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1232	axkazhdzmh.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1336	axkazhdzmh.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1232	1652	hesaphareketi-01.pdf.exe	27
PID 1652 wrote to memory of 1232	1652	hesaphareketi-01.pdf.exe	27
PID 1652 wrote to memory of 1232	1652	hesaphareketi-01.pdf.exe	27
PID 1652 wrote to memory of 1232	1652	hesaphareketi-01.pdf.exe	27
PID 1232 wrote to memory of 1336	1232	axkazhdzmh.exe	28
PID 1232 wrote to memory of 1336	1232	axkazhdzmh.exe	28
PID 1232 wrote to memory of 1336	1232	axkazhdzmh.exe	28
PID 1232 wrote to memory of 1336	1232	axkazhdzmh.exe	28
PID 1232 wrote to memory of 1336	1232	axkazhdzmh.exe	28

C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\hesaphareketi-01.pdf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\AppData\Local\Temp\axkazhdzmh.exe
  "C:\Users\Admin\AppData\Local\Temp\axkazhdzmh.exe" C:\Users\Admin\AppData\Local\Temp\hqixdlt.dkz
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Users\Admin\AppData\Local\Temp\axkazhdzmh.exe
    "C:\Users\Admin\AppData\Local\Temp\axkazhdzmh.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

axkazhdzmh.exe

Path C:\Users\Admin\AppData\Local\Temp\axkazhdzmh.exe
Size 122KB
SHA256 b918388d1c6bfa1e29206d960f5fc187619acb3036f04ff8352ea064a7ed885c
MD5 ebc1009a8ef6702a56552c77c9bea7df
SHA1 415e25c7041d99ba6ded4ca521377f79df0af639
SHA512 a060d0e16ad6ef4f46af18c2097b4decea3ca0d65bf171395acdc21bd4fbd0bc276174777914d840a10714db6a4fc49ba10ad7c97f9ec1a8ea513bf50c1159b8
SSDEEP 3072:8O9HnbxJtsvSRrKBwlM6zerg+huGCH/c25U/wdijnI3vfqjDPUaqKr:tnJtRoBH6zergb/c6igdK
MD5 SHA1 SHA512 SSDEEP

Submit Download

axkazhdzmh.exe

Path C:\Users\Admin\AppData\Local\Temp\axkazhdzmh.exe
Size 122KB
SHA256 b918388d1c6bfa1e29206d960f5fc187619acb3036f04ff8352ea064a7ed885c
MD5 ebc1009a8ef6702a56552c77c9bea7df
SHA1 415e25c7041d99ba6ded4ca521377f79df0af639
SHA512 a060d0e16ad6ef4f46af18c2097b4decea3ca0d65bf171395acdc21bd4fbd0bc276174777914d840a10714db6a4fc49ba10ad7c97f9ec1a8ea513bf50c1159b8
SSDEEP 3072:8O9HnbxJtsvSRrKBwlM6zerg+huGCH/c25U/wdijnI3vfqjDPUaqKr:tnJtRoBH6zergb/c6igdK
MD5 SHA1 SHA512 SSDEEP

Submit Download

axkazhdzmh.exe

Path C:\Users\Admin\AppData\Local\Temp\axkazhdzmh.exe
Size 122KB
SHA256 b918388d1c6bfa1e29206d960f5fc187619acb3036f04ff8352ea064a7ed885c
MD5 ebc1009a8ef6702a56552c77c9bea7df
SHA1 415e25c7041d99ba6ded4ca521377f79df0af639
SHA512 a060d0e16ad6ef4f46af18c2097b4decea3ca0d65bf171395acdc21bd4fbd0bc276174777914d840a10714db6a4fc49ba10ad7c97f9ec1a8ea513bf50c1159b8
SSDEEP 3072:8O9HnbxJtsvSRrKBwlM6zerg+huGCH/c25U/wdijnI3vfqjDPUaqKr:tnJtRoBH6zergb/c6igdK
MD5 SHA1 SHA512 SSDEEP

Submit Download

hqixdlt.dkz

Path C:\Users\Admin\AppData\Local\Temp\hqixdlt.dkz
Size 7KB
SHA256 08f232c68f1bca3f8bbf25ae18ff847e6f18b706a57134d7e5061a7b2cac7756
MD5 1856411f5a587f216891a6c244fddca9
SHA1 abfd7f49c98fb73a0032903804a3248396e02098
SHA512 387b078c8f951c5df65053ce3faee17b0e3b3e4da6e0de28f2db859faac3473b67c33c7645c88010af95a0216f4a917a397439b855a6e5422602aa1d3251ca71
SSDEEP 192:darcitQvArWiPvMgb9HoOTVDdlMsiCJbNf0tO18FzSi:uCYrNPvMS5T1dlMsigaO1izd
MD5 SHA1 SHA512 SSDEEP

Submit Download

lfecneztrjd.rt

Path C:\Users\Admin\AppData\Local\Temp\lfecneztrjd.rt
Size 495KB
SHA256 aff7b6c4b02d3736f6ea90c3cafaf787849f828cd88ab3efe030cb8a5673f7c1
MD5 dd0e71b945934e5d65b2285575e682ab
SHA1 260220eef6b0aaa648548b31c7adcbe3089e6a20
SHA512 0df888ef718bc68cb1a513bc895db6b4c8d11f36dae730724109b04a6b5ed1e291b88bbe2e6a10be8a61604013ba2d3903f88374be82779f56e7eed73073f477
SSDEEP 12288:IRBb5CbZGa1dW6arAHti6d+mGBnY0WRurvIERS7Y/He1:ItQZGa2rec6diSurvIwG1
MD5 SHA1 SHA512 SSDEEP

Submit Download

axkazhdzmh.exe

Path \Users\Admin\AppData\Local\Temp\axkazhdzmh.exe
Size 122KB
SHA256 b918388d1c6bfa1e29206d960f5fc187619acb3036f04ff8352ea064a7ed885c
MD5 ebc1009a8ef6702a56552c77c9bea7df
SHA1 415e25c7041d99ba6ded4ca521377f79df0af639
SHA512 a060d0e16ad6ef4f46af18c2097b4decea3ca0d65bf171395acdc21bd4fbd0bc276174777914d840a10714db6a4fc49ba10ad7c97f9ec1a8ea513bf50c1159b8
SSDEEP 3072:8O9HnbxJtsvSRrKBwlM6zerg+huGCH/c25U/wdijnI3vfqjDPUaqKr:tnJtRoBH6zergb/c6igdK
MD5 SHA1 SHA512 SSDEEP

Submit Download

axkazhdzmh.exe

Path \Users\Admin\AppData\Local\Temp\axkazhdzmh.exe
Size 122KB
SHA256 b918388d1c6bfa1e29206d960f5fc187619acb3036f04ff8352ea064a7ed885c
MD5 ebc1009a8ef6702a56552c77c9bea7df
SHA1 415e25c7041d99ba6ded4ca521377f79df0af639
SHA512 a060d0e16ad6ef4f46af18c2097b4decea3ca0d65bf171395acdc21bd4fbd0bc276174777914d840a10714db6a4fc49ba10ad7c97f9ec1a8ea513bf50c1159b8
SSDEEP 3072:8O9HnbxJtsvSRrKBwlM6zerg+huGCH/c25U/wdijnI3vfqjDPUaqKr:tnJtRoBH6zergb/c6igdK
MD5 SHA1 SHA512 SSDEEP

Submit Download

axkazhdzmh.exe

Path \Users\Admin\AppData\Local\Temp\axkazhdzmh.exe
Size 122KB
SHA256 b918388d1c6bfa1e29206d960f5fc187619acb3036f04ff8352ea064a7ed885c
MD5 ebc1009a8ef6702a56552c77c9bea7df
SHA1 415e25c7041d99ba6ded4ca521377f79df0af639
SHA512 a060d0e16ad6ef4f46af18c2097b4decea3ca0d65bf171395acdc21bd4fbd0bc276174777914d840a10714db6a4fc49ba10ad7c97f9ec1a8ea513bf50c1159b8
SSDEEP 3072:8O9HnbxJtsvSRrKBwlM6zerg+huGCH/c25U/wdijnI3vfqjDPUaqKr:tnJtRoBH6zergb/c6igdK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1336-67-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1336-68-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1652-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads