remcos | dcb2c88a0e980e5d5b2227eb3ede87e3aed37ac3a1126bbc547671763a1c102e

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
18/07/2023, 12:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

51173f4615fda6188760cb468b593a27.exe
Size

831KB
MD5

51173f4615fda6188760cb468b593a27
SHA1

24795a56a6d1dcd780922eb0b8879f65019849cd
SHA256

dcb2c88a0e980e5d5b2227eb3ede87e3aed37ac3a1126bbc547671763a1c102e
SHA512

db94eea44597fa7bc8577588a74eb8239dc9b914cc379a119ffeac6fa499e356d2c1601ffb4a594227c5a3ff24a4c6e68df8ea1a1e8718adff514937b301adba
SSDEEP

24576:uVI6+51cyQkbzsqkC3ecuPRE3oravDlwYCl:uVIFj7IqkCuZRjSlwYCl

Score

10^/10

remcos favor rat

Malware Config

Extracted

Family

remcos

Botnet

Favor

favor-grace-fax.home-webserver.de:37782

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
UYGV78YHj987Ys.exe
copy_folder
iu7ytrtyu
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
true
keylog_file
0987yUIO0987yUIOiuyg.dat
keylog_flag
false
keylog_folder
98UyghjI9Uyhg9IUY
mouse_option
false
mutex
-87yhJKO987ygh-DSBOY7
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Utilsap.exe.exe	Powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Utilsap.exe.exe	Powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2660 set thread context of 2772	2660	51173f4615fda6188760cb468b593a27.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3048	Powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	51173f4615fda6188760cb468b593a27.exe
Token: SeDebugPrivilege	3048	Powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2772	InstallUtil.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 3048	2660	51173f4615fda6188760cb468b593a27.exe	28
PID 2660 wrote to memory of 3048	2660	51173f4615fda6188760cb468b593a27.exe	28
PID 2660 wrote to memory of 3048	2660	51173f4615fda6188760cb468b593a27.exe	28
PID 2660 wrote to memory of 3048	2660	51173f4615fda6188760cb468b593a27.exe	28
PID 2660 wrote to memory of 2772	2660	51173f4615fda6188760cb468b593a27.exe	30
PID 2660 wrote to memory of 2772	2660	51173f4615fda6188760cb468b593a27.exe	30
PID 2660 wrote to memory of 2772	2660	51173f4615fda6188760cb468b593a27.exe	30
PID 2660 wrote to memory of 2772	2660	51173f4615fda6188760cb468b593a27.exe	30
PID 2660 wrote to memory of 2772	2660	51173f4615fda6188760cb468b593a27.exe	30
PID 2660 wrote to memory of 2772	2660	51173f4615fda6188760cb468b593a27.exe	30
PID 2660 wrote to memory of 2772	2660	51173f4615fda6188760cb468b593a27.exe	30
PID 2660 wrote to memory of 2772	2660	51173f4615fda6188760cb468b593a27.exe	30
PID 2660 wrote to memory of 2772	2660	51173f4615fda6188760cb468b593a27.exe	30
PID 2660 wrote to memory of 2772	2660	51173f4615fda6188760cb468b593a27.exe	30
PID 2660 wrote to memory of 2772	2660	51173f4615fda6188760cb468b593a27.exe	30
PID 2660 wrote to memory of 2772	2660	51173f4615fda6188760cb468b593a27.exe	30
PID 2660 wrote to memory of 2772	2660	51173f4615fda6188760cb468b593a27.exe	30
PID 2660 wrote to memory of 2772	2660	51173f4615fda6188760cb468b593a27.exe	30
PID 2660 wrote to memory of 2772	2660	51173f4615fda6188760cb468b593a27.exe	30
PID 2660 wrote to memory of 2772	2660	51173f4615fda6188760cb468b593a27.exe	30

C:\Users\Admin\AppData\Local\Temp\51173f4615fda6188760cb468b593a27.exe
"C:\Users\Admin\AppData\Local\Temp\51173f4615fda6188760cb468b593a27.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
  "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\51173f4615fda6188760cb468b593a27.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Utilsap.exe.exe'
  2⤵
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3048
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\98UyghjI9Uyhg9IUY\0987yUIO0987yUIOiuyg.dat

Filesize
184B

MD5
a64b3c14fbffae2c15cb0dbb3b8f35a0

SHA1
5ea02952ce2a7b0a0f2ec3c686f41588387cd884

SHA256
97c0fce7e111f8c32d05aec243be7317efcf46f93c4c0c3d7750d8b9fecb78cd

SHA512
37c9749a9c09213da40aee3488dfb5de0680d576723981d968386c0004d17edd8b5b6c91dea9b7a65e8209d0b2030394d1cf1ddcdd9947d07058beeb330d6b93

Download Submit
memory/2660-114-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2660-68-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2660-57-0x0000000004BF0000-0x0000000004CB8000-memory.dmp

Filesize
800KB

Download
memory/2660-55-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/2660-142-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Filesize
6.9MB

Download
memory/2660-115-0x0000000000450000-0x0000000000451000-memory.dmp

Filesize
4KB

Download
memory/2660-76-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2660-64-0x0000000000660000-0x000000000068A000-memory.dmp

Filesize
168KB

Download
memory/2660-65-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2660-110-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2660-54-0x0000000000FB0000-0x0000000001086000-memory.dmp

Filesize
856KB

Download
memory/2660-70-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2660-72-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2660-74-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2660-78-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2660-80-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2660-84-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2660-90-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2660-94-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2660-100-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2660-104-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2660-108-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2660-56-0x0000000000690000-0x00000000006D0000-memory.dmp

Filesize
256KB

Download
memory/2660-112-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2660-66-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2660-106-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2660-102-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2660-98-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2660-96-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2660-92-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2660-88-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2660-86-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2660-82-0x0000000000660000-0x0000000000683000-memory.dmp

Filesize
140KB

Download
memory/2772-127-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2772-125-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2772-116-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2772-118-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2772-120-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2772-155-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2772-139-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2772-123-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2772-121-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2772-129-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/3048-136-0x000000006EC00000-0x000000006F1AB000-memory.dmp

Filesize
5.7MB

Download
memory/3048-62-0x0000000002850000-0x0000000002890000-memory.dmp

Filesize
256KB

Download
memory/3048-61-0x000000006EC00000-0x000000006F1AB000-memory.dmp

Filesize
5.7MB

Download
memory/3048-63-0x0000000002850000-0x0000000002890000-memory.dmp

Filesize
256KB

Download
memory/3048-60-0x000000006EC00000-0x000000006F1AB000-memory.dmp

Filesize
5.7MB

Download