remcos | 3da90b636e39cd1f67e3542c60d813c6ff8152f7f740b3ef4ef086ef120836df

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
28/06/2023, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4daef76971794649d0c0bcc97a9fd246.exe
Size

527KB
MD5

4daef76971794649d0c0bcc97a9fd246
SHA1

49522f33f7f2852d9637c98d560437b4d88adcd5
SHA256

3da90b636e39cd1f67e3542c60d813c6ff8152f7f740b3ef4ef086ef120836df
SHA512

3d83321a39384eb101ab261fc91444b400cae918d4422b8f298cda8eed73dad155ca9324235ba9e6a47316017498ad5fb6cde0111f3a111786aa47679a6b9a0a
SSDEEP

12288:0YxD6czlyK/Mu6h3qbnqy5FeTl52WtE8uped:0YxDjlF6h3AqucP1tbX

Score

10^/10

remcos log persistence rat

Malware Config

Extracted

Family

remcos

Botnet

LOG

5.253.114.108:2022

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
chromes.exe
copy_folder
chromes
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-456ENB
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
1476	chromes.exe
428	chromes.exe

Loads dropped DLL 3 IoCs

pid	Process
1748	4daef76971794649d0c0bcc97a9fd246.exe
1944	4daef76971794649d0c0bcc97a9fd246.exe
1476	chromes.exe

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Windows\CurrentVersion\Run\	chromes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-456ENB = "\"C:\\ProgramData\\chromes\\chromes.exe\""	chromes.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	chromes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Windows\CurrentVersion\Run\yienjscxhqmvrb = "C:\\Users\\Admin\\AppData\\Roaming\\oxtdmirbwg\\cluq.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\4daef76971794649d0c0bcc97a9fd246.exe\""	4daef76971794649d0c0bcc97a9fd246.exe
Key created	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Windows\CurrentVersion\Run\	4daef76971794649d0c0bcc97a9fd246.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	4daef76971794649d0c0bcc97a9fd246.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3419557010-3639509551-242374962-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-456ENB = "\"C:\\ProgramData\\chromes\\chromes.exe\""	4daef76971794649d0c0bcc97a9fd246.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-456ENB = "\"C:\\ProgramData\\chromes\\chromes.exe\""	4daef76971794649d0c0bcc97a9fd246.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-456ENB = "\"C:\\ProgramData\\chromes\\chromes.exe\""	chromes.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1748 set thread context of 1944	1748	4daef76971794649d0c0bcc97a9fd246.exe	28
PID 1476 set thread context of 428	1476	chromes.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1748	4daef76971794649d0c0bcc97a9fd246.exe
1476	chromes.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 1944	1748	4daef76971794649d0c0bcc97a9fd246.exe	28
PID 1748 wrote to memory of 1944	1748	4daef76971794649d0c0bcc97a9fd246.exe	28
PID 1748 wrote to memory of 1944	1748	4daef76971794649d0c0bcc97a9fd246.exe	28
PID 1748 wrote to memory of 1944	1748	4daef76971794649d0c0bcc97a9fd246.exe	28
PID 1748 wrote to memory of 1944	1748	4daef76971794649d0c0bcc97a9fd246.exe	28
PID 1944 wrote to memory of 1476	1944	4daef76971794649d0c0bcc97a9fd246.exe	29
PID 1944 wrote to memory of 1476	1944	4daef76971794649d0c0bcc97a9fd246.exe	29
PID 1944 wrote to memory of 1476	1944	4daef76971794649d0c0bcc97a9fd246.exe	29
PID 1944 wrote to memory of 1476	1944	4daef76971794649d0c0bcc97a9fd246.exe	29
PID 1476 wrote to memory of 428	1476	chromes.exe	30
PID 1476 wrote to memory of 428	1476	chromes.exe	30
PID 1476 wrote to memory of 428	1476	chromes.exe	30
PID 1476 wrote to memory of 428	1476	chromes.exe	30
PID 1476 wrote to memory of 428	1476	chromes.exe	30

C:\Users\Admin\AppData\Local\Temp\4daef76971794649d0c0bcc97a9fd246.exe
"C:\Users\Admin\AppData\Local\Temp\4daef76971794649d0c0bcc97a9fd246.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Users\Admin\AppData\Local\Temp\4daef76971794649d0c0bcc97a9fd246.exe
  "C:\Users\Admin\AppData\Local\Temp\4daef76971794649d0c0bcc97a9fd246.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\ProgramData\chromes\chromes.exe
    "C:\ProgramData\chromes\chromes.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\ProgramData\chromes\chromes.exe
      "C:\ProgramData\chromes\chromes.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:428

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\chromes\chromes.exe

Filesize
527KB

MD5
4daef76971794649d0c0bcc97a9fd246

SHA1
49522f33f7f2852d9637c98d560437b4d88adcd5

SHA256
3da90b636e39cd1f67e3542c60d813c6ff8152f7f740b3ef4ef086ef120836df

SHA512
3d83321a39384eb101ab261fc91444b400cae918d4422b8f298cda8eed73dad155ca9324235ba9e6a47316017498ad5fb6cde0111f3a111786aa47679a6b9a0a

Download Submit
C:\ProgramData\chromes\chromes.exe

Filesize
527KB

MD5
4daef76971794649d0c0bcc97a9fd246

SHA1
49522f33f7f2852d9637c98d560437b4d88adcd5

SHA256
3da90b636e39cd1f67e3542c60d813c6ff8152f7f740b3ef4ef086ef120836df

SHA512
3d83321a39384eb101ab261fc91444b400cae918d4422b8f298cda8eed73dad155ca9324235ba9e6a47316017498ad5fb6cde0111f3a111786aa47679a6b9a0a

Download Submit
C:\ProgramData\chromes\chromes.exe

Filesize
527KB

MD5
4daef76971794649d0c0bcc97a9fd246

SHA1
49522f33f7f2852d9637c98d560437b4d88adcd5

SHA256
3da90b636e39cd1f67e3542c60d813c6ff8152f7f740b3ef4ef086ef120836df

SHA512
3d83321a39384eb101ab261fc91444b400cae918d4422b8f298cda8eed73dad155ca9324235ba9e6a47316017498ad5fb6cde0111f3a111786aa47679a6b9a0a

Download Submit
C:\ProgramData\chromes\chromes.exe

Filesize
527KB

MD5
4daef76971794649d0c0bcc97a9fd246

SHA1
49522f33f7f2852d9637c98d560437b4d88adcd5

SHA256
3da90b636e39cd1f67e3542c60d813c6ff8152f7f740b3ef4ef086ef120836df

SHA512
3d83321a39384eb101ab261fc91444b400cae918d4422b8f298cda8eed73dad155ca9324235ba9e6a47316017498ad5fb6cde0111f3a111786aa47679a6b9a0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dzpynfhc.kke

Filesize
7KB

MD5
2da2f9b58155b21faccd9352055bc74d

SHA1
6099e2b423926ba86fd13297f6944a7ff88dd34f

SHA256
c701d68d498da31f667d4878936ca9ac7d17b5c6b4c1bcbf9d26ce96ebc98911

SHA512
7804999a641b751e2793c3bdb51dd29dd8261d5cc6ac835a29f2de71c7b0825a698debce789eb61dfa7845d3f9756f31fc92b9b53128fb5f3ba7d46062a42a54

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsd10D5.tmp\jzowju.dll

Filesize
4KB

MD5
ad28a4eb8b1c753de37dd6fb281e6e29

SHA1
a9a95e4033e96ce2dd6d542a7d8cb16175aed1d0

SHA256
7a613cced366b6345cd15449036a5ab7559058ca2988bbb267e655c71438cf33

SHA512
9c610092d8fac325058f02b4e7928c3123234f0188507841531deda77fa6109ae7216b9a38aaae3a3bb2bdf0cb2e3bad4b7d07bc958df4122bf8e7f7a87e7011

Download Submit
C:\Users\Admin\AppData\Local\Temp\yzvgyrxhu.tfc

Filesize
501KB

MD5
9253abb755a9ba6a746031aee8d56236

SHA1
ca16aa47369feb257911389414b80765691570fc

SHA256
f8d7fff833325442cf0e4cf6bb5d8457bff4d55d3de1b04115bd681ac903376f

SHA512
e73ab6277898b14fc5289478c9bd19c2cd960eeb8f300038af9d0b27d36aa8bb2e6fa2a85a4ef2a9a1a79cb9c0a2e243903d947cfdfec838020d3412d0b3ccab

Download Submit
\ProgramData\chromes\chromes.exe

Filesize
527KB

MD5
4daef76971794649d0c0bcc97a9fd246

SHA1
49522f33f7f2852d9637c98d560437b4d88adcd5

SHA256
3da90b636e39cd1f67e3542c60d813c6ff8152f7f740b3ef4ef086ef120836df

SHA512
3d83321a39384eb101ab261fc91444b400cae918d4422b8f298cda8eed73dad155ca9324235ba9e6a47316017498ad5fb6cde0111f3a111786aa47679a6b9a0a

Download Submit
\Users\Admin\AppData\Local\Temp\nsd10D5.tmp\jzowju.dll

Filesize
4KB

MD5
ad28a4eb8b1c753de37dd6fb281e6e29

SHA1
a9a95e4033e96ce2dd6d542a7d8cb16175aed1d0

SHA256
7a613cced366b6345cd15449036a5ab7559058ca2988bbb267e655c71438cf33

SHA512
9c610092d8fac325058f02b4e7928c3123234f0188507841531deda77fa6109ae7216b9a38aaae3a3bb2bdf0cb2e3bad4b7d07bc958df4122bf8e7f7a87e7011

Download Submit
\Users\Admin\AppData\Local\Temp\nso1384.tmp\jzowju.dll

Filesize
4KB

MD5
ad28a4eb8b1c753de37dd6fb281e6e29

SHA1
a9a95e4033e96ce2dd6d542a7d8cb16175aed1d0

SHA256
7a613cced366b6345cd15449036a5ab7559058ca2988bbb267e655c71438cf33

SHA512
9c610092d8fac325058f02b4e7928c3123234f0188507841531deda77fa6109ae7216b9a38aaae3a3bb2bdf0cb2e3bad4b7d07bc958df4122bf8e7f7a87e7011

Download Submit
memory/428-91-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/428-98-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/428-112-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/428-86-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/428-87-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/428-88-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/428-89-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/428-90-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/428-111-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/428-92-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/428-95-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/428-96-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/428-97-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/428-110-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/428-99-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/428-101-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/428-102-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/428-103-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/428-104-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/428-105-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/428-106-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/428-107-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/428-108-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/428-109-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1944-71-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1944-63-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1944-65-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download