remcos | b4dfd2634ebcea3dfb1dd0becd6b7dd6945fa3d8650c1d3a870ad3185320af45

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2023, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
allegato_625.js
Size 4KB
Sample231127-ldppxsff67
SHA256 b4dfd2634ebcea3dfb1dd0becd6b7dd6945fa3d8650c1d3a870ad3185320af45
MD5 971aa261620b94d13f338bb6d9a8a2f0
SHA1 f14137b2badea24c32879976751f7a9c6fa5ec3c
SHA512 d2b2cfa46e5a0b2734681ece01d8947905ebb0de09681d1ff2229a187460828a7220ab50391e95f28a531b5e3ea855081eacd32ba46fdfdaa2f69f8e7a9c9bc7
SSDEEP 96:1YPlgCnFVlzZxCURPZUKBRlmANYisEpXh5tfotx44baMS14VMLsDlOZAon:yyCnFVlVkgPPBRnzsKXh5tfotx44b1SJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

retghrtgwtrgtg.bounceme.net:3839
listpoints.click:7020
datastream.myvnc.com:5225
gservicese.com:2718
center.onthewifi.com:8118

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
explorer.exe
delete_file
false
hide_file
true
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-OPX7KW
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Blocklisted process makes network request 1 IoCs

flow	pid	Process
6	4536	wscript.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation	wscript.exe

Deletes itself 1 IoCs

pid	Process
4536	wscript.exe

Executes dropped EXE 2 IoCs

pid	Process
1728	GY_tool.exe
920	atkexComSvc.exe

Loads dropped DLL 3 IoCs

pid	Process
920	atkexComSvc.exe
920	atkexComSvc.exe
920	atkexComSvc.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 920 set thread context of 4836	920	atkexComSvc.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1728	GY_tool.exe
1728	GY_tool.exe
920	atkexComSvc.exe
920	atkexComSvc.exe
4836	cmd.exe
4836	cmd.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
920	atkexComSvc.exe
4836	cmd.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 1728	4536	wscript.exe	86
PID 4536 wrote to memory of 1728	4536	wscript.exe	86
PID 1728 wrote to memory of 920	1728	GY_tool.exe	88
PID 1728 wrote to memory of 920	1728	GY_tool.exe	88
PID 1728 wrote to memory of 920	1728	GY_tool.exe	88
PID 920 wrote to memory of 4836	920	atkexComSvc.exe	90
PID 920 wrote to memory of 4836	920	atkexComSvc.exe	90
PID 920 wrote to memory of 4836	920	atkexComSvc.exe	90
PID 920 wrote to memory of 4836	920	atkexComSvc.exe	90
PID 4836 wrote to memory of 1732	4836	cmd.exe	102
PID 4836 wrote to memory of 1732	4836	cmd.exe	102
PID 4836 wrote to memory of 1732	4836	cmd.exe	102
PID 4836 wrote to memory of 1732	4836	cmd.exe	102

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\allegato_625.js
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Users\Admin\AppData\Local\Temp\GY_tool.exe
  "C:\Users\Admin\AppData\Local\Temp\GY_tool.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Users\Admin\AppData\Roaming\sss_Bg\atkexComSvc.exe
    C:\Users\Admin\AppData\Roaming\sss_Bg\atkexComSvc.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:920
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\SysWOW64\cmd.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:4836
    - - C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        5⤵
        
        PID:1732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1b571942

Path C:\Users\Admin\AppData\Local\Temp\1b571942
Size 1.1MB
SHA256 17a8fcd7e012cd7bc1a48b8537943c749b5101ca1746c2df68fbbc9f8232a8cb
MD5 38e31db9144978d11bc0d4635e1e5511
SHA1 d3ec5247b66301b74c7bfaed40a033f7cb838484
SHA512 c6cac766781bfc4d8d440125c72a67a4b6767fb37280cb488309897972897a2e9d7cf187a759507b80cb3e3d01f9070690f1d29c177f75eff4e3abf16d9ef9c1
SSDEEP 24576:JndfEe8mYPq/6nWSozd+XneFlFPE+/ZGnOmsuIloGRq4:JndfEe8mYPq/6nWB+X+TP1IOmsuIloT4
MD5 SHA1 SHA512 SSDEEP

Submit Download

GY_tool.exe

Path C:\Users\Admin\AppData\Local\Temp\GY_tool.exe
Size 1.1MB
SHA256 d3bb0fed8b90aed93809d285139d34885642f05090f31c227453d21fef4c170d
MD5 760e2f767503e36bf1553a48ec597713
SHA1 b04c35dc7b669ba3dc3dde444c19991bd2e1a493
SHA512 951d877215b51014e66499d1626d2c63a84f4d8f4bdc35fe3fe9b0c449139c9a4eb096b05793ec2b85864fcc55691a9420b89f07d17d9ef6f04293f987b1a0b6
SSDEEP 24576:R1FvXWeilJJzhVN/XAfsCTv3wbodhYBT6jBDuOIAxsTbtC2:R1tXWeilJJdVN/AUifYBT6jDxCZl
MD5 SHA1 SHA512 SSDEEP

Submit Download

GY_tool.exe

Path C:\Users\Admin\AppData\Local\Temp\GY_tool.exe
Size 1.1MB
SHA256 d3bb0fed8b90aed93809d285139d34885642f05090f31c227453d21fef4c170d
MD5 760e2f767503e36bf1553a48ec597713
SHA1 b04c35dc7b669ba3dc3dde444c19991bd2e1a493
SHA512 951d877215b51014e66499d1626d2c63a84f4d8f4bdc35fe3fe9b0c449139c9a4eb096b05793ec2b85864fcc55691a9420b89f07d17d9ef6f04293f987b1a0b6
SSDEEP 24576:R1FvXWeilJJzhVN/XAfsCTv3wbodhYBT6jBDuOIAxsTbtC2:R1tXWeilJJdVN/AUifYBT6jDxCZl
MD5 SHA1 SHA512 SSDEEP

Submit Download

GY_tool.exe

Path C:\Users\Admin\AppData\Local\Temp\GY_tool.exe
Size 1.1MB
SHA256 d3bb0fed8b90aed93809d285139d34885642f05090f31c227453d21fef4c170d
MD5 760e2f767503e36bf1553a48ec597713
SHA1 b04c35dc7b669ba3dc3dde444c19991bd2e1a493
SHA512 951d877215b51014e66499d1626d2c63a84f4d8f4bdc35fe3fe9b0c449139c9a4eb096b05793ec2b85864fcc55691a9420b89f07d17d9ef6f04293f987b1a0b6
SSDEEP 24576:R1FvXWeilJJzhVN/XAfsCTv3wbodhYBT6jBDuOIAxsTbtC2:R1tXWeilJJdVN/AUifYBT6jDxCZl
MD5 SHA1 SHA512 SSDEEP

Submit Download

ASUS_WMI.dll

Path C:\Users\Admin\AppData\Roaming\sss_Bg\ASUS_WMI.dll
Size 224KB
SHA256 6523b44da6fa7078c7795b7705498e487b0625e28e15aec2d270c6e4a909b5a5
MD5 3f109a02c8d642e8003a1188df40d861
SHA1 f723f38471b8872443aa9177eef12a96c02cc84a
SHA512 023696a52d48c465ab62e3ee754b445093b8a0ed0a232b430ce1f0db3dae382c9e1fba210c2b04d1018cc29bfb69c546976912f3939a76e98bcb792ae57af0da
SSDEEP 3072:Y4WuqFgPmBNRP8hXzGXPkW6ZZW8egH1/jQoAg0FubAxZ+051gh9b6q4TQWdO8g:Y9t2nhQ2ZW8ecAOAZCqQWY8g
MD5 SHA1 SHA512 SSDEEP

Submit Download

ASUS_WMI.dll

Path C:\Users\Admin\AppData\Roaming\sss_Bg\ASUS_WMI.dll
Size 224KB
SHA256 6523b44da6fa7078c7795b7705498e487b0625e28e15aec2d270c6e4a909b5a5
MD5 3f109a02c8d642e8003a1188df40d861
SHA1 f723f38471b8872443aa9177eef12a96c02cc84a
SHA512 023696a52d48c465ab62e3ee754b445093b8a0ed0a232b430ce1f0db3dae382c9e1fba210c2b04d1018cc29bfb69c546976912f3939a76e98bcb792ae57af0da
SSDEEP 3072:Y4WuqFgPmBNRP8hXzGXPkW6ZZW8egH1/jQoAg0FubAxZ+051gh9b6q4TQWdO8g:Y9t2nhQ2ZW8ecAOAZCqQWY8g
MD5 SHA1 SHA512 SSDEEP

Submit Download

ATKEX.dll

Path C:\Users\Admin\AppData\Roaming\sss_Bg\ATKEX.dll
Size 84KB
SHA256 c8b16f1c6883a23021da37d9116a757f971fe919d64ef8f9dba17a7d8dd39adb
MD5 e68562f63265e1a70881446b4b9dc455
SHA1 da16ef9367bde3ce892b1a0e33bc179d8acdceb3
SHA512 6bedea10a5b50f6e93e8566c18970c8ad1b8dfc7d5961069fc5d5216dcdded0b2a2ad8dd91f4ad80f8604d573a343c126df238ee5c448cdc26b899077957a674
SSDEEP 1536:C3zQ0q8XqIh06v0UQpTcX+CZntb9lviEossWVcd+u8Nc15TCvOM:UqhIh06vKpTcX+El2+uKc15TCF
MD5 SHA1 SHA512 SSDEEP

Submit Download

ATKEX.dll

Path C:\Users\Admin\AppData\Roaming\sss_Bg\ATKEX.dll
Size 84KB
SHA256 c8b16f1c6883a23021da37d9116a757f971fe919d64ef8f9dba17a7d8dd39adb
MD5 e68562f63265e1a70881446b4b9dc455
SHA1 da16ef9367bde3ce892b1a0e33bc179d8acdceb3
SHA512 6bedea10a5b50f6e93e8566c18970c8ad1b8dfc7d5961069fc5d5216dcdded0b2a2ad8dd91f4ad80f8604d573a343c126df238ee5c448cdc26b899077957a674
SSDEEP 1536:C3zQ0q8XqIh06v0UQpTcX+CZntb9lviEossWVcd+u8Nc15TCvOM:UqhIh06vKpTcX+El2+uKc15TCF
MD5 SHA1 SHA512 SSDEEP

Submit Download

AsIO.dll

Path C:\Users\Admin\AppData\Roaming\sss_Bg\AsIO.dll
Size 120KB
SHA256 32e57a7262661c5f001ae9404d9d3814d680104d0893d5b308c06f90e2d0679f
MD5 27ad1378d4fabc19bd98b8ab783c7f7d
SHA1 3dfb6fe20fa573cc59895b67c682a8f2d4d7a551
SHA512 371b10ae21d2f3d499cce47b9f067845b201c6faa63f1f26d164e20975e6ac03e37910fabdaba8e11d3597a24d0015b40a7abafdcee5028bd3225ddb4527eb81
SSDEEP 3072:tU+CK0llptaTHfPwr5Zm6Qi0Zq/PgVbObYL:tUxbllaborXQtqbg
MD5 SHA1 SHA512 SSDEEP

Submit Download

AsIO.dll

Path C:\Users\Admin\AppData\Roaming\sss_Bg\AsIO.dll
Size 120KB
SHA256 32e57a7262661c5f001ae9404d9d3814d680104d0893d5b308c06f90e2d0679f
MD5 27ad1378d4fabc19bd98b8ab783c7f7d
SHA1 3dfb6fe20fa573cc59895b67c682a8f2d4d7a551
SHA512 371b10ae21d2f3d499cce47b9f067845b201c6faa63f1f26d164e20975e6ac03e37910fabdaba8e11d3597a24d0015b40a7abafdcee5028bd3225ddb4527eb81
SSDEEP 3072:tU+CK0llptaTHfPwr5Zm6Qi0Zq/PgVbObYL:tUxbllaborXQtqbg
MD5 SHA1 SHA512 SSDEEP

Submit Download

atkexComSvc.exe

Path C:\Users\Admin\AppData\Roaming\sss_Bg\atkexComSvc.exe
Size 446KB
SHA256 12c22ba646232d5d5087d0300d5cfd46fed424f26143a02dc866f1bfceab3c10
MD5 485008b43f0edceba0e0d3ca04bc1c1a
SHA1 55ae8f105af415bb763d1b87f6572f078052877c
SHA512 402652786daae635c7405f5fa0924d768cbde2086f9f57b10f00f921dec98e37168f5c3a6baa5593ba9a478f3971d32747c517ffd485d25634c924e6b08815b1
SSDEEP 12288:vK5+DMJA3TAz4plk9iZOOti81N5y1qMIg+GV5Zul3M:y5+DMJA3TAz4plk9ijK1qlGV7ulM
MD5 SHA1 SHA512 SSDEEP

Submit Download

atkexComSvc.exe

Path C:\Users\Admin\AppData\Roaming\sss_Bg\atkexComSvc.exe
Size 446KB
SHA256 12c22ba646232d5d5087d0300d5cfd46fed424f26143a02dc866f1bfceab3c10
MD5 485008b43f0edceba0e0d3ca04bc1c1a
SHA1 55ae8f105af415bb763d1b87f6572f078052877c
SHA512 402652786daae635c7405f5fa0924d768cbde2086f9f57b10f00f921dec98e37168f5c3a6baa5593ba9a478f3971d32747c517ffd485d25634c924e6b08815b1
SSDEEP 12288:vK5+DMJA3TAz4plk9iZOOti81N5y1qMIg+GV5Zul3M:y5+DMJA3TAz4plk9ijK1qlGV7ulM
MD5 SHA1 SHA512 SSDEEP

Submit Download

resort.dbf

Path C:\Users\Admin\AppData\Roaming\sss_Bg\resort.dbf
Size 931KB
SHA256 b5185e75c020e665ae7c0f9ad20b629b7f3a6483dac5415feed816b117b81f08
MD5 0b548f5b3782c94d14a395d7f37388e3
SHA1 0adda1d5c7c070f719da1b121de8cc16fe35cad6
SHA512 41b5faea1aacd3441c4a4ecd7a196afdb710ec4c62253ac4beb34462d936352e9fbfdcfde3e60d8b42d9457402dfc26dc21bfea4a56bc128d65d32bde16febbd
SSDEEP 24576:23keNVxaFR2H9WmqM4Op05fsabrVVGrrk/:20eD8FR2H9Wmqq2sejGrq
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/920-44-0x0000000074BE0000-0x0000000074D5B000-memory.dmp

Download

memory/920-45-0x00007FF8B70B0000-0x00007FF8B72A5000-memory.dmp

Download

memory/920-46-0x0000000074BE0000-0x0000000074D5B000-memory.dmp

Download

memory/920-48-0x0000000074BE0000-0x0000000074D5B000-memory.dmp

Download

memory/1728-47-0x00007FF899370000-0x00007FF8994E2000-memory.dmp

Download

memory/1728-19-0x00007FF7ED930000-0x00007FF7EDA5B000-memory.dmp

Download

memory/1728-26-0x00007FF899370000-0x00007FF8994E2000-memory.dmp

Download

memory/1728-23-0x00007FF899370000-0x00007FF8994E2000-memory.dmp

Download

memory/1728-20-0x00007FF899370000-0x00007FF8994E2000-memory.dmp

Download

memory/1728-33-0x00007FF899370000-0x00007FF8994E2000-memory.dmp

Download

memory/1732-58-0x00007FF8B70B0000-0x00007FF8B72A5000-memory.dmp

Download

memory/1732-69-0x0000000000440000-0x00000000004C4000-memory.dmp

Download

memory/1732-72-0x0000000000440000-0x00000000004C4000-memory.dmp

Download

memory/1732-71-0x0000000000440000-0x00000000004C4000-memory.dmp

Download

memory/1732-70-0x0000000000440000-0x00000000004C4000-memory.dmp

Download

memory/1732-67-0x0000000000440000-0x00000000004C4000-memory.dmp

Download

memory/1732-59-0x0000000000440000-0x00000000004C4000-memory.dmp

Download

memory/1732-62-0x0000000000930000-0x0000000000D63000-memory.dmp

Download

memory/1732-63-0x0000000000440000-0x00000000004C4000-memory.dmp

Download

memory/1732-64-0x0000000000440000-0x00000000004C4000-memory.dmp

Download

memory/1732-65-0x0000000000440000-0x00000000004C4000-memory.dmp

Download

memory/1732-66-0x0000000000440000-0x00000000004C4000-memory.dmp

Download

memory/4836-50-0x0000000074BE0000-0x0000000074D5B000-memory.dmp

Download

memory/4836-52-0x00007FF8B70B0000-0x00007FF8B72A5000-memory.dmp

Download

memory/4836-57-0x0000000074BE0000-0x0000000074D5B000-memory.dmp

Download

memory/4836-55-0x0000000074BE0000-0x0000000074D5B000-memory.dmp

Download

memory/4836-54-0x0000000074BE0000-0x0000000074D5B000-memory.dmp

Download