remcos | 664366376cf61a783a4ceec1b77bcb77c23459a4314e65ac25f75c91f23a3a35

General

Target

96827f1fe360ee7a1bd51e5059cc0809.ps1
Size

1.7MB
MD5

96827f1fe360ee7a1bd51e5059cc0809
SHA1

e73f2650c707192f627de4eae1f94dfc15249102
SHA256

664366376cf61a783a4ceec1b77bcb77c23459a4314e65ac25f75c91f23a3a35
SHA512

fe8df1c653123bc45d3a4fdd308844fbdb901682a815705d867568ba2b17bcd64c7fefda8d0379d79e2197beef48b24d69dd13ff60565dd9ed47b21363c84a24
SSDEEP

1536:5wG7MA34KtGjNnRm9aTpYlIgayfLyhmyORtjIPxplXCZInfLwbkSOW+69VYH9g3y:5A

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Version

3.2.0 Pro

Botnet

RemoteHost

C2

toornavigator.sytes.net:35500

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
logs
keylog_path
%AppData%
mouse_option
false
mutex
Explorer-L4H7CG
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2052 set thread context of 2852	2052	powershell.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2052	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2052	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2852	RegSvcs.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2852	2052	powershell.exe	29
PID 2052 wrote to memory of 2852	2052	powershell.exe	29
PID 2052 wrote to memory of 2852	2052	powershell.exe	29
PID 2052 wrote to memory of 2852	2052	powershell.exe	29
PID 2052 wrote to memory of 2852	2052	powershell.exe	29
PID 2052 wrote to memory of 2852	2052	powershell.exe	29
PID 2052 wrote to memory of 2852	2052	powershell.exe	29
PID 2052 wrote to memory of 2852	2052	powershell.exe	29
PID 2052 wrote to memory of 2852	2052	powershell.exe	29
PID 2052 wrote to memory of 2852	2052	powershell.exe	29
PID 2052 wrote to memory of 2852	2052	powershell.exe	29
PID 2052 wrote to memory of 2852	2052	powershell.exe	29
PID 2052 wrote to memory of 2852	2052	powershell.exe	29
PID 2052 wrote to memory of 2852	2052	powershell.exe	29
PID 2052 wrote to memory of 2852	2052	powershell.exe	29
PID 2052 wrote to memory of 2852	2052	powershell.exe	29

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\96827f1fe360ee7a1bd51e5059cc0809.ps1
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\logs\logs.dat

Filesize
148B

MD5
5e831f7094191a67323e7d3f8f2fc269

SHA1
1aaecc2c450b590f6622326c3fc6bff13d69d17f

SHA256
4ebb927dae8294c9b6961aa61a20846b20c6e2e127c6b80e7729fa6e96246e7f

SHA512
ed45d900aecccf677c938c13bf0aece88f39ef5722c33d79ee527fed184596c224286138cc04e035c1dc955f7d39fa03a3beca1999db3ec3b84c1c8e47888298

Download Submit
memory/2052-12-0x000000001BC40000-0x000000001BC60000-memory.dmp

Filesize
128KB

Download
memory/2052-20-0x000000001BC40000-0x000000001BC58000-memory.dmp

Filesize
96KB

Download
memory/2052-7-0x0000000002770000-0x00000000027F0000-memory.dmp

Filesize
512KB

Download
memory/2052-8-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/2052-9-0x0000000002770000-0x00000000027F0000-memory.dmp

Filesize
512KB

Download
memory/2052-10-0x0000000002770000-0x00000000027F0000-memory.dmp

Filesize
512KB

Download
memory/2052-11-0x0000000002770000-0x00000000027F0000-memory.dmp

Filesize
512KB

Download
memory/2052-16-0x000000001BC40000-0x000000001BC58000-memory.dmp

Filesize
96KB

Download
memory/2052-5-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/2052-22-0x000000001BC40000-0x000000001BC58000-memory.dmp

Filesize
96KB

Download
memory/2052-24-0x000000001BC40000-0x000000001BC58000-memory.dmp

Filesize
96KB

Download
memory/2052-25-0x000000001BC00000-0x000000001BC01000-memory.dmp

Filesize
4KB

Download
memory/2052-18-0x000000001BC40000-0x000000001BC58000-memory.dmp

Filesize
96KB

Download
memory/2052-6-0x00000000029A0000-0x00000000029A8000-memory.dmp

Filesize
32KB

Download
memory/2052-13-0x000000001BC40000-0x000000001BC58000-memory.dmp

Filesize
96KB

Download
memory/2052-4-0x000000001B4B0000-0x000000001B792000-memory.dmp

Filesize
2.9MB

Download
memory/2052-14-0x000000001BC40000-0x000000001BC58000-memory.dmp

Filesize
96KB

Download
memory/2052-40-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/2852-39-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2852-34-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2852-42-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2852-44-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2852-45-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2852-33-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2852-32-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2852-31-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2852-30-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2852-26-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2852-35-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2852-36-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2852-37-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2852-50-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2852-28-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download

Analysis

Sharing