Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
02-06-2023 13:14
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230220-en
General
-
Target
file.exe
-
Size
744KB
-
MD5
447766638aad4f1a4e04568524e27e90
-
SHA1
8bfdd143a996a7db7abd6a00e634d6d04d115a1e
-
SHA256
bc3e38148839e72cc594c795183adb3ba9664be94be03fb254e7c9232553077f
-
SHA512
38e5abc10e894242ae98ee20dc6e3bf4cfd65bb8a4a9f6e78e2289db1c1614b180cf7471dee6fe09e8c3d725eb4aca09543ca1c41ac94070e38749b38330008a
-
SSDEEP
12288:hrRQSMl6m5YfhamfW47jScSJmvlPuFsuMGNO8BHZnRM+ErWbVdVKEdFa:h9zMl6mmfUmLqcSJmTKOuHHM+Erkpa
Malware Config
Extracted
remcos
RemoteHost
127.0.0.1:2080
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-6IHMTY
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
file.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation file.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 1344 svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
file.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\"" file.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
svchost.exedescription pid process target process PID 1344 set thread context of 228 1344 svchost.exe AddInProcess32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3204 timeout.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
file.exepid process 4644 file.exe 4644 file.exe 4644 file.exe 4644 file.exe 4644 file.exe 4644 file.exe 4644 file.exe 4644 file.exe 4644 file.exe 4644 file.exe 4644 file.exe 4644 file.exe 4644 file.exe 4644 file.exe 4644 file.exe 4644 file.exe 4644 file.exe 4644 file.exe 4644 file.exe 4644 file.exe 4644 file.exe 4644 file.exe 4644 file.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
file.exesvchost.exedescription pid process Token: SeDebugPrivilege 4644 file.exe Token: SeDebugPrivilege 1344 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
AddInProcess32.exepid process 228 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
file.execmd.execmd.exesvchost.exedescription pid process target process PID 4644 wrote to memory of 1508 4644 file.exe cmd.exe PID 4644 wrote to memory of 1508 4644 file.exe cmd.exe PID 4644 wrote to memory of 2144 4644 file.exe cmd.exe PID 4644 wrote to memory of 2144 4644 file.exe cmd.exe PID 1508 wrote to memory of 3596 1508 cmd.exe schtasks.exe PID 1508 wrote to memory of 3596 1508 cmd.exe schtasks.exe PID 2144 wrote to memory of 3204 2144 cmd.exe timeout.exe PID 2144 wrote to memory of 3204 2144 cmd.exe timeout.exe PID 2144 wrote to memory of 1344 2144 cmd.exe svchost.exe PID 2144 wrote to memory of 1344 2144 cmd.exe svchost.exe PID 1344 wrote to memory of 228 1344 svchost.exe AddInProcess32.exe PID 1344 wrote to memory of 228 1344 svchost.exe AddInProcess32.exe PID 1344 wrote to memory of 228 1344 svchost.exe AddInProcess32.exe PID 1344 wrote to memory of 228 1344 svchost.exe AddInProcess32.exe PID 1344 wrote to memory of 228 1344 svchost.exe AddInProcess32.exe PID 1344 wrote to memory of 228 1344 svchost.exe AddInProcess32.exe PID 1344 wrote to memory of 228 1344 svchost.exe AddInProcess32.exe PID 1344 wrote to memory of 228 1344 svchost.exe AddInProcess32.exe PID 1344 wrote to memory of 228 1344 svchost.exe AddInProcess32.exe PID 1344 wrote to memory of 228 1344 svchost.exe AddInProcess32.exe PID 1344 wrote to memory of 228 1344 svchost.exe AddInProcess32.exe PID 1344 wrote to memory of 228 1344 svchost.exe AddInProcess32.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9E77.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"4⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\remcos\logs.datFilesize
144B
MD5faa6b59d9c2345daaf2e0cfbbc88ef2f
SHA1a75545f6b54f116f960c7b1fd70022e3284516e6
SHA2564cabf0f11904c0b3361af139f0e6a3401aa9542d8294909a8ec015505642d75f
SHA51266db8328ad28d8d99a037890c11abbabd6e1d4f922c82f6dfcc32a6998452c4244e489bf4da4c644d74bea6fb45ecec161319a27eddf6412d7c075e44ff514e3
-
C:\Users\Admin\AppData\Local\Temp\tmp9E77.tmp.batFilesize
151B
MD57b9e6de4176157557f2b07c5dc4c77ed
SHA1a9d2b2c959dd6d2eb3f020a468797a1a055b2143
SHA25603b779ed9f88f52f729b064d007d99a137215fbea4c18a188d125bca009cf74f
SHA51202a987d189b0aecbd4933649298b9c236d722ba60a9c9d9fe1a9e3c04dc5c58bbf7bfb2f2e1dfaf8e6060e02ea8ea07edae850a0dc1efe696ba5b684c23c768a
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
744KB
MD5447766638aad4f1a4e04568524e27e90
SHA18bfdd143a996a7db7abd6a00e634d6d04d115a1e
SHA256bc3e38148839e72cc594c795183adb3ba9664be94be03fb254e7c9232553077f
SHA51238e5abc10e894242ae98ee20dc6e3bf4cfd65bb8a4a9f6e78e2289db1c1614b180cf7471dee6fe09e8c3d725eb4aca09543ca1c41ac94070e38749b38330008a
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
744KB
MD5447766638aad4f1a4e04568524e27e90
SHA18bfdd143a996a7db7abd6a00e634d6d04d115a1e
SHA256bc3e38148839e72cc594c795183adb3ba9664be94be03fb254e7c9232553077f
SHA51238e5abc10e894242ae98ee20dc6e3bf4cfd65bb8a4a9f6e78e2289db1c1614b180cf7471dee6fe09e8c3d725eb4aca09543ca1c41ac94070e38749b38330008a
-
memory/228-143-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-145-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-146-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-147-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-149-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-150-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-151-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-152-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-153-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-154-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-156-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-157-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-158-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-159-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-161-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-162-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-163-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-164-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-166-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-167-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-168-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-170-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-171-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-172-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-173-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-175-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-176-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-177-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-179-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-180-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-181-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-183-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-184-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-185-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-186-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-188-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-189-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-190-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-192-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-193-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-194-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-196-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-197-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-198-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-200-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-201-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-202-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-204-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-205-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-206-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-207-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-209-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-210-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-211-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-213-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-214-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-215-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-217-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-218-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-219-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-220-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-222-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-223-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-224-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/228-226-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/4644-133-0x0000020018680000-0x000002001873E000-memory.dmpFilesize
760KB
-
memory/4644-134-0x0000020018AC0000-0x0000020018AD0000-memory.dmpFilesize
64KB