remcos | 5bf3f7baa22f254ac5dfd3383902f12f07706ecbd6913cff25548cb9c8f68c54

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
12-12-2023 11:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0987654000090000.exe
Size

463KB
MD5

ac851f5b083c90453be2536fb7cf8eb0
SHA1

65832ec449c430855a54607908d71d58896293ff
SHA256

ac9790802a041c8d44f6bd430e0cc97ab9f452445aca1706acfe05851f7ce8a3
SHA512

9914deaae2c36d9b61da41bcd7cc2152083b715c48423df9625183a829e61d244ba67794776ab2669975189fe28b5da65dde1d24f230613be784307767ff3fa6
SSDEEP

6144:M8LxBwEVDPYW8JlHZB97/vh9122pfz0ryHoAtk9t/xiXT1yFahtXBpve5CzmTc/G:8uY3jZX7r12ZryIAtkvWpOstuCzJTHi

Score

10^/10

remcos remotehost collection persistence rat spyware stealer upx

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

107.175.229.139:8087

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-IZFV1M
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/2560-52-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView
behavioral1/memory/2560-69-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/2600-43-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral1/memory/2600-63-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2600-43-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/2560-52-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral1/memory/1932-57-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/1932-58-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/2600-63-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral1/memory/2560-69-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft

Executes dropped EXE 5 IoCs

Processes:

vqtemi.exevqtemi.exevqtemi.exevqtemi.exevqtemi.exe

pid process

2836 vqtemi.exe
3068 vqtemi.exe
2600 vqtemi.exe
2560 vqtemi.exe
1932 vqtemi.exe
Loads dropped DLL 6 IoCs

Processes:

0987654000090000.exevqtemi.exevqtemi.exe

pid process

1168 0987654000090000.exe
1168 0987654000090000.exe
2836 vqtemi.exe
3068 vqtemi.exe
3068 vqtemi.exe
3068 vqtemi.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2836	vqtemi.exe
3068	vqtemi.exe
2600	vqtemi.exe
2560	vqtemi.exe
1932	vqtemi.exe

pid	process
1168	0987654000090000.exe
1168	0987654000090000.exe
2836	vqtemi.exe
3068	vqtemi.exe
3068	vqtemi.exe
3068	vqtemi.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/3068-14-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/3068-16-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/3068-17-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/3068-18-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/3068-19-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/3068-20-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/3068-22-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/3068-23-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/3068-24-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/3068-25-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/3068-26-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/3068-27-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/3068-28-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/3068-30-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/3068-74-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/3068-76-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/3068-79-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/3068-80-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/3068-88-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/3068-89-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/3068-96-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/3068-97-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/3068-104-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/3068-105-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/3068-112-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral1/memory/3068-113-0x0000000000400000-0x000000000048B000-memory.dmp	upx

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

vqtemi.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vqtemi.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

vqtemi.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2952504676-3105837840-1406404655-1000\Software\Microsoft\Windows\CurrentVersion\Run\wgcktpyienjsc = "C:\\Users\\Admin\\AppData\\Roaming\\ejsoxt\\dmirb.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\vqtemi.exe\" "	vqtemi.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

vqtemi.exevqtemi.exe

description	pid	process	target process
PID 2836 set thread context of 3068	2836	vqtemi.exe	vqtemi.exe
PID 3068 set thread context of 2600	3068	vqtemi.exe	vqtemi.exe
PID 3068 set thread context of 2560	3068	vqtemi.exe	vqtemi.exe
PID 3068 set thread context of 1932	3068	vqtemi.exe	vqtemi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

vqtemi.exe

pid process

2600 vqtemi.exe
2600 vqtemi.exe
Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

vqtemi.exevqtemi.exe

pid process

2836 vqtemi.exe
3068 vqtemi.exe
3068 vqtemi.exe
3068 vqtemi.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

vqtemi.exe

description pid process

Token: SeDebugPrivilege 1932 vqtemi.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vqtemi.exe

pid process

3068 vqtemi.exe

pid	process
2600	vqtemi.exe
2600	vqtemi.exe

pid	process
2836	vqtemi.exe
3068	vqtemi.exe
3068	vqtemi.exe
3068	vqtemi.exe

description	pid	process
Token: SeDebugPrivilege	1932	vqtemi.exe

pid	process
3068	vqtemi.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

0987654000090000.exevqtemi.exevqtemi.exe

description	pid	process	target process
PID 1168 wrote to memory of 2836	1168	0987654000090000.exe	vqtemi.exe
PID 1168 wrote to memory of 2836	1168	0987654000090000.exe	vqtemi.exe
PID 1168 wrote to memory of 2836	1168	0987654000090000.exe	vqtemi.exe
PID 1168 wrote to memory of 2836	1168	0987654000090000.exe	vqtemi.exe
PID 2836 wrote to memory of 3068	2836	vqtemi.exe	vqtemi.exe
PID 2836 wrote to memory of 3068	2836	vqtemi.exe	vqtemi.exe
PID 2836 wrote to memory of 3068	2836	vqtemi.exe	vqtemi.exe
PID 2836 wrote to memory of 3068	2836	vqtemi.exe	vqtemi.exe
PID 2836 wrote to memory of 3068	2836	vqtemi.exe	vqtemi.exe
PID 3068 wrote to memory of 2600	3068	vqtemi.exe	vqtemi.exe
PID 3068 wrote to memory of 2600	3068	vqtemi.exe	vqtemi.exe
PID 3068 wrote to memory of 2600	3068	vqtemi.exe	vqtemi.exe
PID 3068 wrote to memory of 2600	3068	vqtemi.exe	vqtemi.exe
PID 3068 wrote to memory of 2600	3068	vqtemi.exe	vqtemi.exe
PID 3068 wrote to memory of 2560	3068	vqtemi.exe	vqtemi.exe
PID 3068 wrote to memory of 2560	3068	vqtemi.exe	vqtemi.exe
PID 3068 wrote to memory of 2560	3068	vqtemi.exe	vqtemi.exe
PID 3068 wrote to memory of 2560	3068	vqtemi.exe	vqtemi.exe
PID 3068 wrote to memory of 2560	3068	vqtemi.exe	vqtemi.exe
PID 3068 wrote to memory of 1932	3068	vqtemi.exe	vqtemi.exe
PID 3068 wrote to memory of 1932	3068	vqtemi.exe	vqtemi.exe
PID 3068 wrote to memory of 1932	3068	vqtemi.exe	vqtemi.exe
PID 3068 wrote to memory of 1932	3068	vqtemi.exe	vqtemi.exe
PID 3068 wrote to memory of 1932	3068	vqtemi.exe	vqtemi.exe

C:\Users\Admin\AppData\Local\Temp\0987654000090000.exe
"C:\Users\Admin\AppData\Local\Temp\0987654000090000.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1168

C:\Users\Admin\AppData\Local\Temp\vqtemi.exe
"C:\Users\Admin\AppData\Local\Temp\vqtemi.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2836

C:\Users\Admin\AppData\Local\Temp\vqtemi.exe
"C:\Users\Admin\AppData\Local\Temp\vqtemi.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068

C:\Users\Admin\AppData\Local\Temp\vqtemi.exe
C:\Users\Admin\AppData\Local\Temp\vqtemi.exe /stext "C:\Users\Admin\AppData\Local\Temp\wxcgifhd"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2600

C:\Users\Admin\AppData\Local\Temp\vqtemi.exe
C:\Users\Admin\AppData\Local\Temp\vqtemi.exe /stext "C:\Users\Admin\AppData\Local\Temp\zshziyrxfzqa"
4⤵
- Executes dropped EXE
- Accesses Microsoft Outlook accounts
PID:2560

C:\Users\Admin\AppData\Local\Temp\vqtemi.exe
C:\Users\Admin\AppData\Local\Temp\vqtemi.exe /stext "C:\Users\Admin\AppData\Local\Temp\jumrjqkzbhinxhq"
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
d5b3fa74f4a9885abbfcea262a9fddb1

SHA1
2cbbb19f398d0b93d91284693f633eaf69f57f6c

SHA256
6293cbfb97a7e6389d397d6b77bf5b7d90d2bc957062ddec03b11f82addd3892

SHA512
ec84158fa2c34c926d364ef456cd8cefeda3676388ba46c059f8e76d0b523369cefefcae065f1f8fd7048532bba75a905253c96cacfaa73a39f671969e5d639a

Download Submit
C:\Users\Admin\AppData\Local\Temp\eyhgd.jer

Filesize
252KB

MD5
ca7ad6c734d55aac2eef45faca75cc65

SHA1
7599b53f8858ab8bad4770d87c50e74550c4cf6a

SHA256
6af23d92e5bac4cd6d762dd4303753977ade5385c0184ce1cacc5b18ced1935f

SHA512
21e36792ac556263fcc7675f07499ae972b22b3fb742b32f5adbc7fc5eb77ffd39132f7351b4b0941305e840afbab853deaac21a44f264055d232bfd48677a10

Download Submit
C:\Users\Admin\AppData\Local\Temp\wxcgifhd

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\Users\Admin\AppData\Local\Temp\vqtemi.exe

Filesize
298KB

MD5
734c4492a033a663f9bfc2c2c8dfe824

SHA1
c5fb75bb9b28bdeded604822b9a5c286aebadcdc

SHA256
e9c38d8b535141fe9bbc3c6fb57b74bf94f31dbdeea49eab9940678f0864bc47

SHA512
e3ba69173c259e40839ab88d9f30f81d7dade7c4bea1ed2ce85c1cff34dc7cbfe5d3ac0afa2823980be6fcf0470adb9a1d81120a684d4ef3ad1f380e1a199a7f

Download Submit
memory/1932-57-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1932-58-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1932-55-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1932-50-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2560-48-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2560-42-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2560-69-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2560-52-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2600-34-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2600-43-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2600-63-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2600-39-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2600-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2836-9-0x00000000000E0000-0x00000000000E2000-memory.dmp

Filesize
8KB

Download
memory/3068-25-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-66-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3068-28-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-27-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-26-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-24-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-23-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-22-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-20-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-19-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-18-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-17-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-16-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-72-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3068-71-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3068-30-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-73-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3068-74-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-76-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-79-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-80-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-14-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-82-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3068-88-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-89-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-96-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-97-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-104-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-105-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-112-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3068-113-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download