remcos | efcc97c8dac23a0c8bc179fd3b54efd3594e71d5103f211bf468e2a6e550590e

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2023 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SYN2023060702.exe
Size

551KB
MD5

e550594dbf07c3a445d0ee6d44325c96
SHA1

ac62125f63e40ed06e6b3cf7a4b180543894d797
SHA256

efcc97c8dac23a0c8bc179fd3b54efd3594e71d5103f211bf468e2a6e550590e
SHA512

92924f57caf0c7b5fc08576d807079c7c060ccecc882766c5298af18288c9cbd9a9d01bd325007b52d983e669e90db9b42fcbe525442887e3de66d9246c1565e
SSDEEP

12288:ZLLsWrDu24O0XFrfiPfuw91uhQ9TaQX5eQ4L1NbRHgWAvHv3cIXsSlwjFh:ZLLTrfj9TaY5eV5N95AfUVSoFh

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

155.94.185.15:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-FUG8H1
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	SYN2023060702.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	SYN2023060702.exe

Loads dropped DLL 1 IoCs

pid	Process
224	SYN2023060702.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
3732	SYN2023060702.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
224	SYN2023060702.exe
3732	SYN2023060702.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 224 set thread context of 3732	224	SYN2023060702.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
224	SYN2023060702.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3732	SYN2023060702.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 3732	224	SYN2023060702.exe	91
PID 224 wrote to memory of 3732	224	SYN2023060702.exe	91
PID 224 wrote to memory of 3732	224	SYN2023060702.exe	91
PID 224 wrote to memory of 3732	224	SYN2023060702.exe	91

C:\Users\Admin\AppData\Local\Temp\SYN2023060702.exe
"C:\Users\Admin\AppData\Local\Temp\SYN2023060702.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:224
- C:\Users\Admin\AppData\Local\Temp\SYN2023060702.exe
  "C:\Users\Admin\AppData\Local\Temp\SYN2023060702.exe"
  2⤵
  - Checks QEMU agent file
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:3732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
26b3ed21321670cc6438f55219ecbd2d

SHA1
61ffb90049312d491ebbc0a643b51862b97cd5ff

SHA256
08384471785fe1a76185c430999ac3f27c814a798b074a667ddf46de2a2c866a

SHA512
4478bc89732d6ffc6c133af644c6bcd33d0ae2aac897545bf16ec534d61e8151b0f37ce901e9b3712eebd263d35c5c973666c73d0ae70a161810abbace4b1ce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp88ED.tmp\System.dll

Filesize
11KB

MD5
c9473cb90d79a374b2ba6040ca16e45c

SHA1
ab95b54f12796dce57210d65f05124a6ed81234a

SHA256
b80a5cba69d1853ed5979b0ca0352437bf368a5cfb86cb4528edadd410e11352

SHA512
eafe7d5894622bc21f663bca4dd594392ee0f5b29270b6b56b0187093d6a3a103545464ff6398ad32d2cf15dab79b1f133218ba9ba337ddc01330b5ada804d7b

Download Submit
memory/3732-160-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3732-152-0x0000000001660000-0x00000000057E4000-memory.dmp

Filesize
65.5MB

Download
memory/3732-154-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3732-157-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3732-148-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3732-147-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3732-163-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3732-166-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3732-169-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3732-172-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3732-175-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3732-178-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download