remcos | 52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
13/02/2023, 12:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OVERDUE PAYMENT.exe
Size 498KB
Sample230213-n6a4cace21
SHA256 52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d
MD5 b0f70946dc03f74519457537d9bcf0ef
SHA1 373c6256339023c584db4f13bc3f856a30c3cabe
SHA512 ed3d83970cdbbe86ec9e9a71ed844883197e4db8158f0fe551d07ad3956f5a11f70211b32d002097f94fe5da0c412e61e3bd54181db5f59d8d411e34d784d037
SSDEEP 12288:FYIVcKxsozwYGYAq3nArsgYUY72y+PrXH6Yi:FY2t2gwYbvwXYUI2fHM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos uc persistence rat

Malware Config

Extracted

Family

remcos

Botnet

ucremcz1.ddns.net:1823

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
BIN.exe
copy_folder
BIN
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Rmc-X402GF
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
bin
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
2020	lzkmb.exe
568	lzkmb.exe

Loads dropped DLL 2 IoCs

pid	Process
1220	OVERDUE PAYMENT.exe
2020	lzkmb.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\itgmvxdnnn = "C:\\Users\\Admin\\AppData\\Roaming\\lsoeaawuetxeut\\nmdavrpjtcgwp.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\lzkmb.exe\" C:\\Users\\Admin\\AppDa"	lzkmb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2020 set thread context of 568	2020	lzkmb.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2020	lzkmb.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
568	lzkmb.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 2020	1220	OVERDUE PAYMENT.exe	28
PID 1220 wrote to memory of 2020	1220	OVERDUE PAYMENT.exe	28
PID 1220 wrote to memory of 2020	1220	OVERDUE PAYMENT.exe	28
PID 1220 wrote to memory of 2020	1220	OVERDUE PAYMENT.exe	28
PID 2020 wrote to memory of 568	2020	lzkmb.exe	30
PID 2020 wrote to memory of 568	2020	lzkmb.exe	30
PID 2020 wrote to memory of 568	2020	lzkmb.exe	30
PID 2020 wrote to memory of 568	2020	lzkmb.exe	30
PID 2020 wrote to memory of 568	2020	lzkmb.exe	30

C:\Users\Admin\AppData\Local\Temp\OVERDUE PAYMENT.exe
"C:\Users\Admin\AppData\Local\Temp\OVERDUE PAYMENT.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Users\Admin\AppData\Local\Temp\lzkmb.exe
  "C:\Users\Admin\AppData\Local\Temp\lzkmb.exe" C:\Users\Admin\AppData\Local\Temp\knfjha.hh
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Users\Admin\AppData\Local\Temp\lzkmb.exe
    "C:\Users\Admin\AppData\Local\Temp\lzkmb.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

knfjha.hh

Path C:\Users\Admin\AppData\Local\Temp\knfjha.hh
Size 7KB
SHA256 02de3931623e485d24b2adf8b8ccbee8a0998e3110ef6eb46ab1f7e6604f8d6d
MD5 e831f5cbcc3c46cd83b371eda3a289ea
SHA1 379569339b669da98a7b35595bc887bc9388efea
SHA512 2a9c0fda6750c51ee2d6299ecc9b6b48134a2a750b5ce762a279857b23af8a7621e08035554f4721814a55d891d4578ec9acf7282f97dba9e48a652b60792dc0
SSDEEP 192:darcitQvArWiPva4b9XjO/zZCJK8ppkhDU15gJLrLXC:uCYrNPvaqM/1CJKFDU8JTy
MD5 SHA1 SHA512 SSDEEP

Submit Download

lzkmb.exe

Path C:\Users\Admin\AppData\Local\Temp\lzkmb.exe
Size 67KB
SHA256 f0e9b2a827b79b610136b6bcdd508d0a086f94165ac23eefb1992371076f5dd4
MD5 3edc861d2a5b3419a84a5308c5fd4234
SHA1 2d5184ed41e9ba18deb4a7b18dd8fecd33595c36
SHA512 d9696afc93ea03aa3dab6d6519f71c3abdbe8f3b78ab0069751a731dd0c89d09bfa7e8ccf609c532dc5b7659b3e3e3b50d16a8941c4e3e7e07736072481f9f4e
SSDEEP 1536:i6/kCXbDbk8uzOvPqs4N+Jo7vfM013M3pJg:1/RnUNso7vfZ13wJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lzkmb.exe

Path C:\Users\Admin\AppData\Local\Temp\lzkmb.exe
Size 67KB
SHA256 f0e9b2a827b79b610136b6bcdd508d0a086f94165ac23eefb1992371076f5dd4
MD5 3edc861d2a5b3419a84a5308c5fd4234
SHA1 2d5184ed41e9ba18deb4a7b18dd8fecd33595c36
SHA512 d9696afc93ea03aa3dab6d6519f71c3abdbe8f3b78ab0069751a731dd0c89d09bfa7e8ccf609c532dc5b7659b3e3e3b50d16a8941c4e3e7e07736072481f9f4e
SSDEEP 1536:i6/kCXbDbk8uzOvPqs4N+Jo7vfM013M3pJg:1/RnUNso7vfZ13wJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lzkmb.exe

Path C:\Users\Admin\AppData\Local\Temp\lzkmb.exe
Size 67KB
SHA256 f0e9b2a827b79b610136b6bcdd508d0a086f94165ac23eefb1992371076f5dd4
MD5 3edc861d2a5b3419a84a5308c5fd4234
SHA1 2d5184ed41e9ba18deb4a7b18dd8fecd33595c36
SHA512 d9696afc93ea03aa3dab6d6519f71c3abdbe8f3b78ab0069751a731dd0c89d09bfa7e8ccf609c532dc5b7659b3e3e3b50d16a8941c4e3e7e07736072481f9f4e
SSDEEP 1536:i6/kCXbDbk8uzOvPqs4N+Jo7vfM013M3pJg:1/RnUNso7vfZ13wJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

skdoccs.o

Path C:\Users\Admin\AppData\Local\Temp\skdoccs.o
Size 489KB
SHA256 ccfc233126a7a6f2968e12428f8a72e552c0a8893532fff88f21e03e5b7c0bd0
MD5 3fb89236a898bfaafcafe54e4b418788
SHA1 819636caa11099db90177b48e972d4dac6b3fefd
SHA512 e97b6c4240647e41ec5750758e7e2debbcbae2ac92a8d01d08604de6d86b416c10a3a67dac477ed1ac017a01d6ec020ded1042cff6b5bec1220e4e9c27344b6c
SSDEEP 12288:j2yjKx2Xh5b2LtzwiyA+m2pDDs5hNxamY+x/cnFEk:j2nx2Xh12pwwSD4T/cnJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lzkmb.exe

Path \Users\Admin\AppData\Local\Temp\lzkmb.exe
Size 67KB
SHA256 f0e9b2a827b79b610136b6bcdd508d0a086f94165ac23eefb1992371076f5dd4
MD5 3edc861d2a5b3419a84a5308c5fd4234
SHA1 2d5184ed41e9ba18deb4a7b18dd8fecd33595c36
SHA512 d9696afc93ea03aa3dab6d6519f71c3abdbe8f3b78ab0069751a731dd0c89d09bfa7e8ccf609c532dc5b7659b3e3e3b50d16a8941c4e3e7e07736072481f9f4e
SSDEEP 1536:i6/kCXbDbk8uzOvPqs4N+Jo7vfM013M3pJg:1/RnUNso7vfZ13wJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

lzkmb.exe

Path \Users\Admin\AppData\Local\Temp\lzkmb.exe
Size 67KB
SHA256 f0e9b2a827b79b610136b6bcdd508d0a086f94165ac23eefb1992371076f5dd4
MD5 3edc861d2a5b3419a84a5308c5fd4234
SHA1 2d5184ed41e9ba18deb4a7b18dd8fecd33595c36
SHA512 d9696afc93ea03aa3dab6d6519f71c3abdbe8f3b78ab0069751a731dd0c89d09bfa7e8ccf609c532dc5b7659b3e3e3b50d16a8941c4e3e7e07736072481f9f4e
SSDEEP 1536:i6/kCXbDbk8uzOvPqs4N+Jo7vfM013M3pJg:1/RnUNso7vfZ13wJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/568-66-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/568-67-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1220-54-0x00000000753F1000-0x00000000753F3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads