remcos | 6bda8394101554cfdc4f42dd2e5628f390fd09663571a8d080610aac270ff08b

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 18:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Backdoor.exe
Size

100KB
MD5

b413fee050bacbf831bc006f0414b6ca
SHA1

ef6aad6bc6443f73a991724355ed74d610b1409b
SHA256

6bda8394101554cfdc4f42dd2e5628f390fd09663571a8d080610aac270ff08b
SHA512

fe813018c1e4a57679c2a4c13e08025715b21ff6f247aab3406d1fc0dbe1d15d3069f13a39e4b3b0b6ad4e598cc71ab3ac990c9fccaf9eb94ec967172807850c
SSDEEP

3072:nhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+JP/P6Ervb:nhzOv2fM13jsIFSHNT7P/P6Qvb

Score

10^/10

remcos dlscord persistence rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Dlscord

shall-someone.gl.at.ply.gg:60408

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
10
connect_interval
5
copy_file
Bin.exe
copy_folder
Factorio
delete_file
true
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%SystemDrive%
keylog_crypt
true
keylog_file
driver.dat
keylog_flag
false
keylog_folder
keyboard drivers
keylog_path
%WinDir%\System32
mouse_option
false
mutex
remcos_bfpmypnbrt
screenshot_crypt
true
screenshot_flag
true
screenshot_folder
Screen drivers
screenshot_path
%WinDir%\System32
screenshot_time
60
startup_value
Windows.Defender
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Deletes itself 1 IoCs

pid	Process
2088	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2084	Bin.exe

Loads dropped DLL 2 IoCs

pid	Process
2088	cmd.exe
2088	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows.Defender = "\"C:\\Factorio\\Bin.exe\""	Backdoor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows.Defender = "\"C:\\Factorio\\Bin.exe\""	Bin.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Screen drivers\0.png	iexplore.exe
File created	C:\Windows\SysWOW64\Screen drivers\0.dat	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\keyboard drivers\driver.dat	iexplore.exe
File created	C:\Windows\SysWOW64\keyboard drivers\driver.dat	iexplore.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2084 set thread context of 1212	2084	Bin.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1716	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2084	Bin.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1212	iexplore.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1212	iexplore.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2088	2052	Backdoor.exe	28
PID 2052 wrote to memory of 2088	2052	Backdoor.exe	28
PID 2052 wrote to memory of 2088	2052	Backdoor.exe	28
PID 2052 wrote to memory of 2088	2052	Backdoor.exe	28
PID 2052 wrote to memory of 2088	2052	Backdoor.exe	28
PID 2052 wrote to memory of 2088	2052	Backdoor.exe	28
PID 2052 wrote to memory of 2088	2052	Backdoor.exe	28
PID 2088 wrote to memory of 1716	2088	cmd.exe	30
PID 2088 wrote to memory of 1716	2088	cmd.exe	30
PID 2088 wrote to memory of 1716	2088	cmd.exe	30
PID 2088 wrote to memory of 1716	2088	cmd.exe	30
PID 2088 wrote to memory of 2084	2088	cmd.exe	31
PID 2088 wrote to memory of 2084	2088	cmd.exe	31
PID 2088 wrote to memory of 2084	2088	cmd.exe	31
PID 2088 wrote to memory of 2084	2088	cmd.exe	31
PID 2084 wrote to memory of 1212	2084	Bin.exe	32
PID 2084 wrote to memory of 1212	2084	Bin.exe	32
PID 2084 wrote to memory of 1212	2084	Bin.exe	32
PID 2084 wrote to memory of 1212	2084	Bin.exe	32
PID 2084 wrote to memory of 1212	2084	Bin.exe	32
PID 2084 wrote to memory of 1212	2084	Bin.exe	32
PID 2084 wrote to memory of 1212	2084	Bin.exe	32
PID 2084 wrote to memory of 1212	2084	Bin.exe	32
PID 2084 wrote to memory of 1212	2084	Bin.exe	32
PID 2084 wrote to memory of 1212	2084	Bin.exe	32
PID 2084 wrote to memory of 1212	2084	Bin.exe	32
PID 1212 wrote to memory of 1944	1212	iexplore.exe	35
PID 1212 wrote to memory of 1944	1212	iexplore.exe	35
PID 1212 wrote to memory of 1944	1212	iexplore.exe	35
PID 1212 wrote to memory of 1944	1212	iexplore.exe	35
PID 1212 wrote to memory of 1944	1212	iexplore.exe	35
PID 1212 wrote to memory of 1944	1212	iexplore.exe	35
PID 1212 wrote to memory of 1944	1212	iexplore.exe	35

C:\Users\Admin\AppData\Local\Temp\Backdoor.exe
"C:\Users\Admin\AppData\Local\Temp\Backdoor.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\SysWOW64\PING.EXE
    PING 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1716
- - C:\Factorio\Bin.exe
    "C:\Factorio\Bin.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
      4⤵
      Drops file in System32 directory
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1212
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\uninstall.bat" "
        5⤵
        
        PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.bat

Filesize
124B

MD5
759ab5c089cfd8f901faeed5d73fd09e

SHA1
6ba2a675a86af1f5b6fb231b7413bd9f3adf44cb

SHA256
8e8565eb225b14e95d7e364f5096f26099f1f289ad48913fb8483b7179d4d37e

SHA512
0896f2d40abbfe725669581ee9384e22b7f4751e4484ffdbf0a1880a1c8db284c075c77d8da684927e1f434642a1aaf0471f534f93f1bad16a4e4909eed02e79

Download Submit
C:\Users\Admin\AppData\Local\Temp\uninstall.bat

Filesize
118B

MD5
6a69d260c2c46be5dc0852f16bdc3d74

SHA1
82096aa9c752bd92be2efc6690631ca47ac26502

SHA256
921a2307d3cb46c9cf0a4f398547bd4dd9da65c84d53f14f142dc4532f288fe6

SHA512
d21b9fe7778141edb037953779569219e3113df462c57bd2dc076669aee43a9ea540dfe4171616729995318d2fc56555117f3230302a1510a48f44d143df5678

Download Submit
\Factorio\Bin.exe

Filesize
100KB

MD5
b413fee050bacbf831bc006f0414b6ca

SHA1
ef6aad6bc6443f73a991724355ed74d610b1409b

SHA256
6bda8394101554cfdc4f42dd2e5628f390fd09663571a8d080610aac270ff08b

SHA512
fe813018c1e4a57679c2a4c13e08025715b21ff6f247aab3406d1fc0dbe1d15d3069f13a39e4b3b0b6ad4e598cc71ab3ac990c9fccaf9eb94ec967172807850c

Download Submit
memory/1212-15-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download