remcos | d4a1576213580954e906144a0434fc9df19ce746a726504e70597c58ce9a4fd5

Analysis

max time kernel
148s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-02-2024 05:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Purchase Order-ListSamples_xls.scr
Size

932KB
MD5

acf1a5648f805a2e245c5ca3ed592298
SHA1

c6f2fad033b2b6aa910a75c5cd3d94184406fde7
SHA256

1351e61c2b4c13ccf8b28d7f1f9aa82f7cce424e723a30bacbfa404d1d98fa6d
SHA512

5e28c34f7f1a46cf41af0d51c5fb941c811212a0c96f933e6f9464e143b27fef8412a63e0df0cd11894a7df171759284d22f9eb947921d0c9d5c0f7e330e7ea8
SSDEEP

24576:OtK2xcQUuT2bpG4tDjoL4BjCtLPM3pP3j++VTZ:Os2xL2lG4Vg8KLP4P3jrZ

Score

10^/10

remcos rat

Malware Config

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
behavioral1/memory/1784-30-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2016	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2716	powershell.exe
2864	powershell.exe
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr
2220	Purchase Order-ListSamples_xls.scr

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	Purchase Order-ListSamples_xls.scr
Token: SeDebugPrivilege	2716	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2716	2220	Purchase Order-ListSamples_xls.scr	30
PID 2220 wrote to memory of 2716	2220	Purchase Order-ListSamples_xls.scr	30
PID 2220 wrote to memory of 2716	2220	Purchase Order-ListSamples_xls.scr	30
PID 2220 wrote to memory of 2716	2220	Purchase Order-ListSamples_xls.scr	30
PID 2220 wrote to memory of 2864	2220	Purchase Order-ListSamples_xls.scr	32
PID 2220 wrote to memory of 2864	2220	Purchase Order-ListSamples_xls.scr	32
PID 2220 wrote to memory of 2864	2220	Purchase Order-ListSamples_xls.scr	32
PID 2220 wrote to memory of 2864	2220	Purchase Order-ListSamples_xls.scr	32
PID 2220 wrote to memory of 2016	2220	Purchase Order-ListSamples_xls.scr	33
PID 2220 wrote to memory of 2016	2220	Purchase Order-ListSamples_xls.scr	33
PID 2220 wrote to memory of 2016	2220	Purchase Order-ListSamples_xls.scr	33
PID 2220 wrote to memory of 2016	2220	Purchase Order-ListSamples_xls.scr	33
PID 2220 wrote to memory of 1784	2220	Purchase Order-ListSamples_xls.scr	36
PID 2220 wrote to memory of 1784	2220	Purchase Order-ListSamples_xls.scr	36
PID 2220 wrote to memory of 1784	2220	Purchase Order-ListSamples_xls.scr	36
PID 2220 wrote to memory of 1784	2220	Purchase Order-ListSamples_xls.scr	36
PID 2220 wrote to memory of 1784	2220	Purchase Order-ListSamples_xls.scr	36
PID 2220 wrote to memory of 1784	2220	Purchase Order-ListSamples_xls.scr	36
PID 2220 wrote to memory of 1784	2220	Purchase Order-ListSamples_xls.scr	36

C:\Users\Admin\AppData\Local\Temp\Purchase Order-ListSamples_xls.scr
"C:\Users\Admin\AppData\Local\Temp\Purchase Order-ListSamples_xls.scr" /S
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Purchase Order-ListSamples_xls.scr"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2716
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LfCyGc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LfCyGc" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDEEA.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2016
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scripting

T1064

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpDEEA.tmp

Filesize
1KB

MD5
c4aa49a56ea6229e6e1bd6856b150182

SHA1
7ccf506e018e8c6e2f333e84698c6531a8ea2757

SHA256
2dcf945f161345e73fa57875c2f03744aedca6ebcda981df5125e02df65f4385

SHA512
1a600478b86643fc98488d54a4e43e9d67ef4fe23d599c347238ef4c841ecb99d754aa420cbde71aa0ee924eed933c5e380571169322518465ea8871917d905a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
0b4f0af0d96a827a941a526b48bf280f

SHA1
b9b8e729d14e12913d30035c734226c81720ee8c

SHA256
df1cbce8c3d772d79adca2d29d955a3729dd197e8fbd3bf06961d82de8bf0904

SHA512
76ea0450ad7adfa363af587b113d556d877de568e1071214822ffb564bd2ecd447abb03942d7e765e83baef9f2d11026ffa4af3f1f9615222b1169a0c312edfc

Download Submit
memory/1784-30-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1784-28-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1784-27-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1784-26-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2220-5-0x0000000000640000-0x000000000064E000-memory.dmp

Filesize
56KB

Download
memory/2220-4-0x00000000005F0000-0x00000000005FA000-memory.dmp

Filesize
40KB

Download
memory/2220-8-0x00000000003E0000-0x0000000000420000-memory.dmp

Filesize
256KB

Download
memory/2220-6-0x0000000004990000-0x0000000004A50000-memory.dmp

Filesize
768KB

Download
memory/2220-0-0x0000000000BA0000-0x0000000000C8C000-memory.dmp

Filesize
944KB

Download
memory/2220-1-0x00000000740E0000-0x00000000747CE000-memory.dmp

Filesize
6.9MB

Download
memory/2220-2-0x00000000003E0000-0x0000000000420000-memory.dmp

Filesize
256KB

Download
memory/2220-3-0x00000000005C0000-0x00000000005D4000-memory.dmp

Filesize
80KB

Download
memory/2220-7-0x00000000740E0000-0x00000000747CE000-memory.dmp

Filesize
6.9MB

Download
memory/2716-25-0x0000000002690000-0x00000000026D0000-memory.dmp

Filesize
256KB

Download
memory/2716-22-0x000000006EC30000-0x000000006F1DB000-memory.dmp

Filesize
5.7MB

Download
memory/2716-23-0x0000000002690000-0x00000000026D0000-memory.dmp

Filesize
256KB

Download
memory/2716-33-0x000000006EC30000-0x000000006F1DB000-memory.dmp

Filesize
5.7MB

Download
memory/2864-24-0x000000006EC30000-0x000000006F1DB000-memory.dmp

Filesize
5.7MB

Download
memory/2864-21-0x000000006EC30000-0x000000006F1DB000-memory.dmp

Filesize
5.7MB

Download
memory/2864-32-0x000000006EC30000-0x000000006F1DB000-memory.dmp

Filesize
5.7MB

Download