remcos | 422615c8d808550754675e825e1af240833928de9f8da026008b22ada2f16cd7

Analysis

max time kernel
148s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23-01-2024 05:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Invoice for Return of Excess Amount (Temmuz) dd 10.01.2024.exe
Size

782KB
MD5

8e2f08deaac5bddbb57f3c5d40ea8bd0
SHA1

be7842f6e42e7ec89285ef2c65f84952ffebdbd5
SHA256

59559873eaa5a5b25f029c6768a22d3e84b03b7467cc764ea5f081edc0bfeb58
SHA512

ac2e98db25f2a867383d47f77076b0133242f6492eab7578db557b8c56a57443525f8a57e76438462bc65d9d04a742ea646b1f1351d2970f29fa569debe3a200
SSDEEP

24576:3fLMW38ZStHH1tbAKovtn2X4nTFu8EG4W4:voJZ8HH1tPovtnc4TFcG4W4

Score

10^/10

remcos top persistence rat

Malware Config

Extracted

Family

remcos

Botnet

Top

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
false
keylog_file
mqerms.dat
keylog_flag
false
keylog_path
%AppData%
mouse_option
false
mutex
alpwovnb-G3F5OR
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Loads dropped DLL 1 IoCs

Processes:

Invoice for Return of Excess Amount (Temmuz) dd 10.01.2024.exe

pid process

1540 Invoice for Return of Excess Amount (Temmuz) dd 10.01.2024.exe

pid	process
1540	Invoice for Return of Excess Amount (Temmuz) dd 10.01.2024.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

wab.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Larvefdders = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Hyperite\\Skibsstningers.exe"	wab.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

wab.exe

pid process

2552 wab.exe
2552 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Invoice for Return of Excess Amount (Temmuz) dd 10.01.2024.exewab.exe

pid process

1540 Invoice for Return of Excess Amount (Temmuz) dd 10.01.2024.exe
2552 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Invoice for Return of Excess Amount (Temmuz) dd 10.01.2024.exe

description pid process target process

PID 1540 set thread context of 2552 1540 Invoice for Return of Excess Amount (Temmuz) dd 10.01.2024.exe wab.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Invoice for Return of Excess Amount (Temmuz) dd 10.01.2024.exe

pid process

1540 Invoice for Return of Excess Amount (Temmuz) dd 10.01.2024.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

wab.exe

pid process

2552 wab.exe

pid	process
2552	wab.exe
2552	wab.exe

pid	process
1540	Invoice for Return of Excess Amount (Temmuz) dd 10.01.2024.exe
2552	wab.exe

description	pid	process	target process
PID 1540 set thread context of 2552	1540	Invoice for Return of Excess Amount (Temmuz) dd 10.01.2024.exe	wab.exe

pid	process
1540	Invoice for Return of Excess Amount (Temmuz) dd 10.01.2024.exe

pid	process
2552	wab.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

Invoice for Return of Excess Amount (Temmuz) dd 10.01.2024.exe

description	pid	process	target process
PID 1540 wrote to memory of 2552	1540	Invoice for Return of Excess Amount (Temmuz) dd 10.01.2024.exe	wab.exe
PID 1540 wrote to memory of 2552	1540	Invoice for Return of Excess Amount (Temmuz) dd 10.01.2024.exe	wab.exe
PID 1540 wrote to memory of 2552	1540	Invoice for Return of Excess Amount (Temmuz) dd 10.01.2024.exe	wab.exe
PID 1540 wrote to memory of 2552	1540	Invoice for Return of Excess Amount (Temmuz) dd 10.01.2024.exe	wab.exe
PID 1540 wrote to memory of 2552	1540	Invoice for Return of Excess Amount (Temmuz) dd 10.01.2024.exe	wab.exe
PID 1540 wrote to memory of 2552	1540	Invoice for Return of Excess Amount (Temmuz) dd 10.01.2024.exe	wab.exe

C:\Users\Admin\AppData\Local\Temp\Invoice for Return of Excess Amount (Temmuz) dd 10.01.2024.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice for Return of Excess Amount (Temmuz) dd 10.01.2024.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1540

C:\Program Files (x86)\windows mail\wab.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice for Return of Excess Amount (Temmuz) dd 10.01.2024.exe"
2⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2552

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
5419b1d9c9e189e4d950580aca4c9f64

SHA1
be37e7d84067962da84320dfae9170463c5adb25

SHA256
c74201c32a21448221016b91392d254577afad9ebd8cd3c0986bceef2c123ea9

SHA512
3754737e757458522783cdfb70ed48087b6f4e8e239e7951eede5fd32651b915f894a04021e5e8f0c515c881f34d4e1cb5220aeaf949b16096d02e485303319b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
52416428259bff992bed59a9f1cacd68

SHA1
2b8b449a1b70d1b040de92dd4c59ce1d440b10fa

SHA256
a0f0d4bf71da51d7ca0816cee770c7c699e925350f2dd583449088b29d5b5865

SHA512
3c314b60204bf89b674564f21dbbb14e9a34ca1419ec2b19f4a7a99d676672912a12a153d7bb0d5550bd45ab8788fc429e4f0db2d8bb26ea15275ba7a51eb7c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBBD5.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
\Users\Admin\AppData\Local\Temp\nstEF1.tmp\System.dll
Filesize
12KB

MD5
4add245d4ba34b04f213409bfe504c07

SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

Download Submit
memory/1540-16-0x0000000077C50000-0x0000000077DF9000-memory.dmp

Filesize
1.7MB

Download
memory/1540-17-0x0000000077E40000-0x0000000077F16000-memory.dmp

Filesize
856KB

Download
memory/1540-18-0x0000000075170000-0x0000000075177000-memory.dmp

Filesize
28KB

Download
memory/2552-165-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-169-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-21-0x0000000077E40000-0x0000000077F16000-memory.dmp

Filesize
856KB

Download
memory/2552-23-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-142-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-143-0x0000000000270000-0x0000000003D0F000-memory.dmp

Filesize
58.6MB

Download
memory/2552-145-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-144-0x0000000077E40000-0x0000000077F16000-memory.dmp

Filesize
856KB

Download
memory/2552-146-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-147-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-148-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-149-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-150-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-151-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-152-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-153-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-154-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-155-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-156-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-157-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-158-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-159-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-160-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-161-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-162-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-163-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-164-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-19-0x0000000077C50000-0x0000000077DF9000-memory.dmp

Filesize
1.7MB

Download
memory/2552-166-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-167-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-168-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-20-0x0000000077E76000-0x0000000077E77000-memory.dmp

Filesize
4KB

Download
memory/2552-170-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-171-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-172-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-173-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-174-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-175-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-176-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-177-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-179-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-178-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-180-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-181-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-182-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-183-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-184-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-185-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-186-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-187-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-188-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-189-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-192-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-193-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-194-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-195-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-196-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-197-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-198-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-199-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-200-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-201-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-202-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download
memory/2552-203-0x00000000731D0000-0x0000000074232000-memory.dmp

Filesize
16.4MB

Download