remcos | 7fa317ded5966fbe87a173f7376325f7232b9b7430b27ccfb3ae86006903d5b6

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
14/02/2024, 13:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pdf09fdp.exe
Size 526KB
Sample240214-qcntfsbd4y
SHA256 7fa317ded5966fbe87a173f7376325f7232b9b7430b27ccfb3ae86006903d5b6
MD5 1ea8537ea3ddec9e0730821cc642673c
SHA1 4b36e8ac16bddc0c718b17c9b06509f0966c3186
SHA512 0e31d7477a61a6626e52f771eb3bf48abfe00f4aed82cd52afada1b4c715fcafa70cb098742cab2dfc69378374f8cb8c51b47dd2798c062e8b33dd1d93cc17fb
SSDEEP 6144:KClMw2Xp5wLj3OcbQxfxtvm2vJ3L1NsQbuk7l9yFMI:K8Mw2XwLDTQxfx7vBpuk7l90
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost collection rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

107.175.229.139:8087

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
yes.png
keylog_flag
false
keylog_folder
aka
keylog_path
%AppData%
mouse_option
false
mutex
jhudguiytgu-AAHEXC
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4244-63-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView
behavioral2/memory/4244-69-0x0000000000400000-0x0000000000457000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/3344-60-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/3344-72-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

resource	yara_rule
behavioral2/memory/3344-60-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4244-63-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/864-68-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4244-69-0x0000000000400000-0x0000000000457000-memory.dmp	Nirsoft
behavioral2/memory/864-70-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/3344-72-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	pdf09fdp.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\H.lnk	pdf09fdp.exe

Executes dropped EXE 1 IoCs

pid	Process
920	H.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	AddInProcess32.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 920 set thread context of 1740	920	H.exe	93
PID 1740 set thread context of 3344	1740	AddInProcess32.exe	95
PID 1740 set thread context of 4244	1740	AddInProcess32.exe	96
PID 1740 set thread context of 864	1740	AddInProcess32.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4020	pdf09fdp.exe
4020	pdf09fdp.exe
4020	pdf09fdp.exe
4020	pdf09fdp.exe
4020	pdf09fdp.exe
4020	pdf09fdp.exe
4020	pdf09fdp.exe
4020	pdf09fdp.exe
4020	pdf09fdp.exe
4020	pdf09fdp.exe
4020	pdf09fdp.exe
4020	pdf09fdp.exe
4020	pdf09fdp.exe
4020	pdf09fdp.exe
4020	pdf09fdp.exe
4020	pdf09fdp.exe
4020	pdf09fdp.exe
4020	pdf09fdp.exe
4020	pdf09fdp.exe
4020	pdf09fdp.exe
4020	pdf09fdp.exe
4020	pdf09fdp.exe
4020	pdf09fdp.exe
4020	pdf09fdp.exe
4020	pdf09fdp.exe
920	H.exe
920	H.exe
920	H.exe
920	H.exe
3344	AddInProcess32.exe
3344	AddInProcess32.exe
864	AddInProcess32.exe
864	AddInProcess32.exe
3344	AddInProcess32.exe
3344	AddInProcess32.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
1740	AddInProcess32.exe
1740	AddInProcess32.exe
1740	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4020	pdf09fdp.exe
Token: SeDebugPrivilege	920	H.exe
Token: SeDebugPrivilege	864	AddInProcess32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1740	AddInProcess32.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 920	4020	pdf09fdp.exe	89
PID 4020 wrote to memory of 920	4020	pdf09fdp.exe	89
PID 4020 wrote to memory of 920	4020	pdf09fdp.exe	89
PID 920 wrote to memory of 316	920	H.exe	92
PID 920 wrote to memory of 316	920	H.exe	92
PID 920 wrote to memory of 316	920	H.exe	92
PID 920 wrote to memory of 316	920	H.exe	92
PID 920 wrote to memory of 316	920	H.exe	92
PID 920 wrote to memory of 316	920	H.exe	92
PID 920 wrote to memory of 316	920	H.exe	92
PID 920 wrote to memory of 316	920	H.exe	92
PID 920 wrote to memory of 316	920	H.exe	92
PID 920 wrote to memory of 316	920	H.exe	92
PID 920 wrote to memory of 316	920	H.exe	92
PID 920 wrote to memory of 316	920	H.exe	92
PID 920 wrote to memory of 1740	920	H.exe	93
PID 920 wrote to memory of 1740	920	H.exe	93
PID 920 wrote to memory of 1740	920	H.exe	93
PID 920 wrote to memory of 1740	920	H.exe	93
PID 920 wrote to memory of 1740	920	H.exe	93
PID 920 wrote to memory of 1740	920	H.exe	93
PID 920 wrote to memory of 1740	920	H.exe	93
PID 920 wrote to memory of 1740	920	H.exe	93
PID 920 wrote to memory of 1740	920	H.exe	93
PID 920 wrote to memory of 1740	920	H.exe	93
PID 920 wrote to memory of 1740	920	H.exe	93
PID 920 wrote to memory of 1740	920	H.exe	93
PID 1740 wrote to memory of 3344	1740	AddInProcess32.exe	95
PID 1740 wrote to memory of 3344	1740	AddInProcess32.exe	95
PID 1740 wrote to memory of 3344	1740	AddInProcess32.exe	95
PID 1740 wrote to memory of 3344	1740	AddInProcess32.exe	95
PID 1740 wrote to memory of 4244	1740	AddInProcess32.exe	96
PID 1740 wrote to memory of 4244	1740	AddInProcess32.exe	96
PID 1740 wrote to memory of 4244	1740	AddInProcess32.exe	96
PID 1740 wrote to memory of 4244	1740	AddInProcess32.exe	96
PID 1740 wrote to memory of 864	1740	AddInProcess32.exe	97
PID 1740 wrote to memory of 864	1740	AddInProcess32.exe	97
PID 1740 wrote to memory of 864	1740	AddInProcess32.exe	97
PID 1740 wrote to memory of 864	1740	AddInProcess32.exe	97

C:\Users\Admin\AppData\Local\Temp\pdf09fdp.exe
"C:\Users\Admin\AppData\Local\Temp\pdf09fdp.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\KGD\H.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\KGD\H.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:920
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:316
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1740
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\ypovtmngoxryb"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3344
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\aktfueyicfjlduid"
      4⤵
      Accesses Microsoft Outlook accounts
      PID:4244
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe /stext "C:\Users\Admin\AppData\Local\Temp\lmzynpjbqnbqniehdiv"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ypovtmngoxryb

Path C:\Users\Admin\AppData\Local\Temp\ypovtmngoxryb
Size 4KB
SHA256 b92f48c215f2d309a748e67787283bb2c61bbce1faf7dcb3b917f57be92b28e2
MD5 2cbe8873d9d19e766fd9a1f758da8e74
SHA1 544271b8bf2aa7108e9f0f1cf11de5eb2a389f17
SHA512 4f8842cfc7b97b82e5f105aeb1b838f9f50072d3f9cae7412e09c0f8fb592a40fc6064cd9ef8e67133ec5694590d106d3e3141e2fd0a21c3d32d6340068ca632
SSDEEP 48:wvvv05TXgxfvvc5TXgxfdvv05TXgxBvv05TXgxakvv05TXg7:mvkXgxv8Xgp1vkXgPvkXgbvkXg7
MD5 SHA1 SHA512 SSDEEP

Submit Download

H.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\KGD\H.exe
Size 526KB
SHA256 7fa317ded5966fbe87a173f7376325f7232b9b7430b27ccfb3ae86006903d5b6
MD5 1ea8537ea3ddec9e0730821cc642673c
SHA1 4b36e8ac16bddc0c718b17c9b06509f0966c3186
SHA512 0e31d7477a61a6626e52f771eb3bf48abfe00f4aed82cd52afada1b4c715fcafa70cb098742cab2dfc69378374f8cb8c51b47dd2798c062e8b33dd1d93cc17fb
SSDEEP 6144:KClMw2Xp5wLj3OcbQxfxtvm2vJ3L1NsQbuk7l9yFMI:K8Mw2XwLDTQxfx7vBpuk7l90
MD5 SHA1 SHA512 SSDEEP

Submit Download

yes.png

Path C:\Users\Admin\AppData\Roaming\aka\yes.png
Size 144B
SHA256 bb99da0a854174519418cc28918e6f5d6c63991667e0702ed6bb2fda03dd50ea
MD5 b0d881d01e563ada4dd1a98dc94997d5
SHA1 5b229704c54f4bc3fb0a0fb84ef710f4534d110d
SHA512 0c18ece9e231a3ca3e8ac0a7072c731afd0aedcd0f86ebc332889c78a4acad7959dc3f8b19c021c45afa924fd0774917ee7670c7b38f1a1ae7353831e59f8107
MD5 SHA1 SHA512

Submit Download

memory/864-70-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/864-68-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/864-67-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/864-57-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/920-29-0x0000000005500000-0x0000000005510000-memory.dmp

Download

memory/920-30-0x0000000005500000-0x0000000005510000-memory.dmp

Download

memory/920-38-0x0000000074CD0000-0x0000000075480000-memory.dmp

Download

memory/920-34-0x0000000005500000-0x0000000005510000-memory.dmp

Download

memory/920-33-0x0000000074CD0000-0x0000000075480000-memory.dmp

Download

memory/920-32-0x00000000076D0000-0x00000000076D6000-memory.dmp

Download

memory/920-31-0x00000000076B0000-0x00000000076CA000-memory.dmp

Download

memory/920-26-0x0000000000A30000-0x0000000000ABA000-memory.dmp

Download

memory/920-28-0x0000000074CD0000-0x0000000075480000-memory.dmp

Download

memory/1740-78-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/1740-74-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/1740-106-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1740-105-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1740-98-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1740-97-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1740-90-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1740-35-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1740-37-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1740-89-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1740-39-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1740-41-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1740-42-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1740-43-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1740-44-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1740-45-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1740-46-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1740-47-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1740-49-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1740-87-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/1740-80-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/1740-50-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1740-81-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1740-79-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/1740-77-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/1740-51-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3344-72-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3344-56-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3344-60-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3344-52-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4020-8-0x00000000051F0000-0x0000000005200000-memory.dmp

Download

memory/4020-5-0x00000000051F0000-0x0000000005200000-memory.dmp

Download

memory/4020-27-0x0000000074CD0000-0x0000000075480000-memory.dmp

Download

memory/4020-2-0x00000000053D0000-0x0000000005974000-memory.dmp

Download

memory/4020-0-0x0000000000690000-0x000000000071A000-memory.dmp

Download

memory/4020-4-0x0000000004F60000-0x0000000004FFC000-memory.dmp

Download

memory/4020-7-0x0000000007D90000-0x0000000007DD0000-memory.dmp

Download

memory/4020-6-0x0000000004EA0000-0x0000000004EAA000-memory.dmp

Download

memory/4020-12-0x000000000ABA0000-0x000000000ABC2000-memory.dmp

Download

memory/4020-3-0x0000000004EC0000-0x0000000004F52000-memory.dmp

Download

memory/4020-1-0x0000000074CD0000-0x0000000075480000-memory.dmp

Download

memory/4020-11-0x000000000B420000-0x000000000B94C000-memory.dmp

Download

memory/4020-9-0x000000000A8A0000-0x000000000A906000-memory.dmp

Download

memory/4020-10-0x000000000AD20000-0x000000000AEE2000-memory.dmp

Download

memory/4244-63-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/4244-53-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/4244-59-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/4244-69-0x0000000000400000-0x0000000000457000-memory.dmp

Download