remcos | 877c532a5efd938960866a93ff9c63ac79a19a7d2ad22652f7d55b81d2e1b75a

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
23/05/2023, 12:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HUC2323EDE.exe
Size

1.0MB
MD5

308284ac2cb49c4445dcf747d81d8a97
SHA1

30f069d66dee503888b128bbf9276807bd7e0e00
SHA256

877c532a5efd938960866a93ff9c63ac79a19a7d2ad22652f7d55b81d2e1b75a
SHA512

7b6873043ae54b2feebd97849f1977aede3513485ed70df5e17c1657240a6e33fa02d4bbbfb0b900060c02fcd5facce8c6685780dd37797d40a1642a8bef8f5f
SSDEEP

24576:rTLHPsXfaGbeX8WUHkMC7tgkEQ5EvG7iXGmyA:bHPsvaGb2BM+gkfSG7iXby

Score

10^/10

remcos congo rat

Malware Config

Extracted

Family

remcos

Botnet

CONGO

194.147.140.144:1993

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-BXO8P8
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1720 set thread context of 1536	1720	HUC2323EDE.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1172	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1720	HUC2323EDE.exe
1720	HUC2323EDE.exe
1720	HUC2323EDE.exe
1720	HUC2323EDE.exe
1720	HUC2323EDE.exe
1720	HUC2323EDE.exe
868	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1720	HUC2323EDE.exe
Token: SeDebugPrivilege	868	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1536	HUC2323EDE.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 868	1720	HUC2323EDE.exe	28
PID 1720 wrote to memory of 868	1720	HUC2323EDE.exe	28
PID 1720 wrote to memory of 868	1720	HUC2323EDE.exe	28
PID 1720 wrote to memory of 868	1720	HUC2323EDE.exe	28
PID 1720 wrote to memory of 1172	1720	HUC2323EDE.exe	30
PID 1720 wrote to memory of 1172	1720	HUC2323EDE.exe	30
PID 1720 wrote to memory of 1172	1720	HUC2323EDE.exe	30
PID 1720 wrote to memory of 1172	1720	HUC2323EDE.exe	30
PID 1720 wrote to memory of 1536	1720	HUC2323EDE.exe	32
PID 1720 wrote to memory of 1536	1720	HUC2323EDE.exe	32
PID 1720 wrote to memory of 1536	1720	HUC2323EDE.exe	32
PID 1720 wrote to memory of 1536	1720	HUC2323EDE.exe	32
PID 1720 wrote to memory of 1536	1720	HUC2323EDE.exe	32
PID 1720 wrote to memory of 1536	1720	HUC2323EDE.exe	32
PID 1720 wrote to memory of 1536	1720	HUC2323EDE.exe	32
PID 1720 wrote to memory of 1536	1720	HUC2323EDE.exe	32
PID 1720 wrote to memory of 1536	1720	HUC2323EDE.exe	32
PID 1720 wrote to memory of 1536	1720	HUC2323EDE.exe	32
PID 1720 wrote to memory of 1536	1720	HUC2323EDE.exe	32
PID 1720 wrote to memory of 1536	1720	HUC2323EDE.exe	32
PID 1720 wrote to memory of 1536	1720	HUC2323EDE.exe	32

C:\Users\Admin\AppData\Local\Temp\HUC2323EDE.exe
"C:\Users\Admin\AppData\Local\Temp\HUC2323EDE.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hqZEExbeHi.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:868
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hqZEExbeHi" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD0C8.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1172
- C:\Users\Admin\AppData\Local\Temp\HUC2323EDE.exe
  "C:\Users\Admin\AppData\Local\Temp\HUC2323EDE.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
bc1575ef36254eae084b822ba5d8b2e4

SHA1
96fe41e76b383759455df6f77133247b00b62650

SHA256
08b40879963157bb989d6efc9c5cba40566e9396f8bbb91904e089837a65a9ca

SHA512
6425682994e8fc72b2540c482c39b26a10e45482aa7c95f1099be2e9e1a95d61710695082d7cfaa8e6a73ce775be778f5363ddc7a0c5f43837487bf0abb4088b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD0C8.tmp

Filesize
1KB

MD5
6f25a3e23a4a7a494e750478350c14e8

SHA1
2e13e479d78d87243cd140a38dfe0fd88142795c

SHA256
133ac01dd9c2ab5161f2acb9cae07c8e1180f936ebace554737558e904bd6090

SHA512
724579bc7a869461fac4bba275aa4e68d70e0223dce61722dbba886b0cde851e1cbf36340c942a76a850a11ef71620eb1c669257f41ad8895e66d2615c0fb2d0

Download Submit
memory/868-87-0x00000000024F0000-0x0000000002530000-memory.dmp

Filesize
256KB

Download
memory/868-80-0x00000000024F0000-0x0000000002530000-memory.dmp

Filesize
256KB

Download
memory/1536-101-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-110-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-147-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-146-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-68-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-69-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-103-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-72-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-70-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-106-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-75-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-74-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-76-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1536-77-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-144-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-79-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-81-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-83-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-84-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-85-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-86-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-143-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-88-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-89-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-90-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-92-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-93-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-94-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-96-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-97-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-98-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-99-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-142-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-102-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-71-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-140-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-73-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-107-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-108-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-139-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-105-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-111-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-112-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-113-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-115-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-116-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-117-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-119-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-120-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-121-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-123-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-124-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-125-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-126-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-128-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-129-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-130-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-132-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-133-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-134-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-135-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-137-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1536-138-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1720-55-0x00000000006A0000-0x00000000006AE000-memory.dmp

Filesize
56KB

Download
memory/1720-59-0x0000000005700000-0x00000000057BA000-memory.dmp

Filesize
744KB

Download
memory/1720-54-0x00000000008E0000-0x00000000009F2000-memory.dmp

Filesize
1.1MB

Download
memory/1720-56-0x0000000004990000-0x00000000049D0000-memory.dmp

Filesize
256KB

Download
memory/1720-57-0x0000000004990000-0x00000000049D0000-memory.dmp

Filesize
256KB

Download
memory/1720-67-0x0000000007FF0000-0x0000000008076000-memory.dmp

Filesize
536KB

Download
memory/1720-58-0x00000000006C0000-0x00000000006CA000-memory.dmp

Filesize
40KB

Download