remcos | efcc97c8dac23a0c8bc179fd3b54efd3594e71d5103f211bf468e2a6e550590e

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2023, 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SYN2023060702.exe
Size

551KB
MD5

e550594dbf07c3a445d0ee6d44325c96
SHA1

ac62125f63e40ed06e6b3cf7a4b180543894d797
SHA256

efcc97c8dac23a0c8bc179fd3b54efd3594e71d5103f211bf468e2a6e550590e
SHA512

92924f57caf0c7b5fc08576d807079c7c060ccecc882766c5298af18288c9cbd9a9d01bd325007b52d983e669e90db9b42fcbe525442887e3de66d9246c1565e
SSDEEP

12288:ZLLsWrDu24O0XFrfiPfuw91uhQ9TaQX5eQ4L1NbRHgWAvHv3cIXsSlwjFh:ZLLTrfj9TaY5eV5N95AfUVSoFh

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

155.94.185.15:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-FUG8H1
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	SYN2023060702.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	SYN2023060702.exe

Loads dropped DLL 1 IoCs

pid	Process
1928	SYN2023060702.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1220	SYN2023060702.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1928	SYN2023060702.exe
1220	SYN2023060702.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1928 set thread context of 1220	1928	SYN2023060702.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1928	SYN2023060702.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1220	SYN2023060702.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 1220	1928	SYN2023060702.exe	90
PID 1928 wrote to memory of 1220	1928	SYN2023060702.exe	90
PID 1928 wrote to memory of 1220	1928	SYN2023060702.exe	90
PID 1928 wrote to memory of 1220	1928	SYN2023060702.exe	90

C:\Users\Admin\AppData\Local\Temp\SYN2023060702.exe
"C:\Users\Admin\AppData\Local\Temp\SYN2023060702.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Users\Admin\AppData\Local\Temp\SYN2023060702.exe
  "C:\Users\Admin\AppData\Local\Temp\SYN2023060702.exe"
  2⤵
  - Checks QEMU agent file
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:1220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
6ca0c8f70affdc7a95407a2eebdb9b0b

SHA1
ee907ea78c1de0fac09accd7fd2d46047ba12304

SHA256
910317b4117c3ad48a2af1f4ccb92ec37ba001e7a5e809e673cbff6136d5fb10

SHA512
49f8a2f34f40bb3d3f38f7b7c870449fe3d94a7a7efec1164b82acbda91a74221c38c56eacbc29b1dad1b35c9190809ba0854b9ab6f2556973c7197debfa6742

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsrF311.tmp\System.dll

Filesize
11KB

MD5
c9473cb90d79a374b2ba6040ca16e45c

SHA1
ab95b54f12796dce57210d65f05124a6ed81234a

SHA256
b80a5cba69d1853ed5979b0ca0352437bf368a5cfb86cb4528edadd410e11352

SHA512
eafe7d5894622bc21f663bca4dd594392ee0f5b29270b6b56b0187093d6a3a103545464ff6398ad32d2cf15dab79b1f133218ba9ba337ddc01330b5ada804d7b

Download Submit
memory/1220-147-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/1220-148-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/1220-152-0x0000000001660000-0x00000000057E4000-memory.dmp

Filesize
65.5MB

Download
memory/1220-155-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/1220-158-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/1220-161-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/1220-164-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/1220-167-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/1220-170-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/1220-173-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download