remcos | 2204d5013172a22cc16536a4a51c813b1f79ab936e47f442485d4c7e8c89e86d

General

Target

59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe
Size

1020KB
MD5

20a500fd451c33e49c77aaf6cd79b1d9
SHA1

1e681faa82a3e65e1ea9f7e829af35aebf99da1e
SHA256

59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917
SHA512

591a4665bae8d5d4af5a2b1c03444b7e01dbcecb39eab82065520092626ac40d058710e1054156c81caa4c4fb6a41448d6cde7aa5a4e4a0b3a4c3dc2516b7ac7
SSDEEP

24576:fEmFxUYl8y5VHiiR7Ya2yvTzLeTl28APMmQZglLam:smFxUYzeiR7DTEVfhZK

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

89.37.99.49:5888

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-0VIV73
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

Processes:

59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe

description	pid	process	target process
PID 1048 set thread context of 1800	1048	59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1424 schtasks.exe

pid	process
1424	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exepowershell.exe

pid	process
1048	59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe
1048	59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe
2020	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1048	59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe
Token: SeDebugPrivilege	2020	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe

description	pid	process	target process
PID 1048 wrote to memory of 2020	1048	59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe	powershell.exe
PID 1048 wrote to memory of 2020	1048	59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe	powershell.exe
PID 1048 wrote to memory of 2020	1048	59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe	powershell.exe
PID 1048 wrote to memory of 2020	1048	59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe	powershell.exe
PID 1048 wrote to memory of 1424	1048	59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe	schtasks.exe
PID 1048 wrote to memory of 1424	1048	59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe	schtasks.exe
PID 1048 wrote to memory of 1424	1048	59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe	schtasks.exe
PID 1048 wrote to memory of 1424	1048	59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe	schtasks.exe
PID 1048 wrote to memory of 1800	1048	59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe	vbc.exe
PID 1048 wrote to memory of 1800	1048	59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe	vbc.exe
PID 1048 wrote to memory of 1800	1048	59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe	vbc.exe
PID 1048 wrote to memory of 1800	1048	59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe	vbc.exe
PID 1048 wrote to memory of 1800	1048	59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe	vbc.exe
PID 1048 wrote to memory of 1800	1048	59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe	vbc.exe
PID 1048 wrote to memory of 1800	1048	59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe	vbc.exe
PID 1048 wrote to memory of 1800	1048	59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe	vbc.exe
PID 1048 wrote to memory of 1800	1048	59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe	vbc.exe
PID 1048 wrote to memory of 1800	1048	59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe	vbc.exe
PID 1048 wrote to memory of 1800	1048	59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe	vbc.exe
PID 1048 wrote to memory of 1800	1048	59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe	vbc.exe
PID 1048 wrote to memory of 1800	1048	59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe
"C:\Users\Admin\AppData\Local\Temp\59d705df5b4d6a3e818d5529de6270397899239ba61a19f746a7149768b47917.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AShWCrYsHjW.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AShWCrYsHjW" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEB88.tmp"
2⤵
- Creates scheduled task(s)
PID:1424

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:1800

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpEB88.tmp
Filesize
1KB

MD5
fb401b576cd1417491099d071390e56b

SHA1
845fc0c071c2d8870c1957973b3e9b957e22ac40

SHA256
d92f353b31268fb04977cceb76fe8b4152c104a7c77ddae02c4ce937cd47d9b1

SHA512
697b3152c524cb11477447f62b6f78a8c81df0f240af0cd3df79e7e76f4c237c2d5daa06cc3f0d7b55ee9e8af15b9cca3cd790ddad4a1689999b70c6a9ee9b96

Download Submit
memory/1048-54-0x0000000000C50000-0x0000000000D54000-memory.dmp

Filesize
1.0MB

Download
memory/1048-55-0x00000000046E0000-0x0000000004720000-memory.dmp

Filesize
256KB

Download
memory/1048-56-0x0000000000460000-0x000000000046E000-memory.dmp

Filesize
56KB

Download
memory/1048-57-0x00000000046E0000-0x0000000004720000-memory.dmp

Filesize
256KB

Download
memory/1048-58-0x00000000009F0000-0x00000000009FA000-memory.dmp

Filesize
40KB

Download
memory/1048-59-0x0000000005780000-0x0000000005836000-memory.dmp

Filesize
728KB

Download
memory/1048-67-0x0000000005F30000-0x0000000005FB0000-memory.dmp

Filesize
512KB

Download
memory/1800-76-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1800-82-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1800-70-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1800-71-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1800-72-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1800-73-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1800-74-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1800-75-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1800-68-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1800-77-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1800-79-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1800-80-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1800-81-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1800-69-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1800-83-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1800-96-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1800-95-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1800-94-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1800-90-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1800-91-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1800-92-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1800-93-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2020-87-0x0000000002370000-0x00000000023B0000-memory.dmp

Filesize
256KB

Download
memory/2020-86-0x0000000002370000-0x00000000023B0000-memory.dmp

Filesize
256KB

Download
memory/2020-85-0x0000000002370000-0x00000000023B0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads