remcos | 203638ce48220b8473b79233a695ac30d5d103508c6eb0b9ced9ea2729e5fb27

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 23:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
afb741ddb6c75469ff3ca02dc958f433.exe
Size 273KB
Sample240229-2796qaff54
SHA256 203638ce48220b8473b79233a695ac30d5d103508c6eb0b9ced9ea2729e5fb27
MD5 afb741ddb6c75469ff3ca02dc958f433
SHA1 db50d350ef0a94c6e5153b07949d40f53b1ee7ee
SHA512 90dfe49dc426050027868e39f47c7f9044b89d192013cd610df0dc6b721a29067a16fdbb45f125f7213c6319ac18fde2d14482b4bd42cabd3221683bcb599aab
SSDEEP 6144:Br4rDLOD5qbNWo1rzibk7RqGyC46qGZ7Y70MJb:weF4H/CTwnZ7YD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos octadderall rat upx

Malware Config

Extracted

Family

remcos

Botnet

OctAdderall

amazon0101.duckdns.org:2405

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
toolx.exe
copy_folder
Tools
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
logs
keylog_path
%AppData%
mouse_option
false
mutex
iuhttrds432-IVDB56
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
tools
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

remcos

Version

2.0.7 Pro

Botnet

OctAdderall

amazon0101.duckdns.org:2405

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
toolx.exe
copy_folder
Tools
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
logs
keylog_path
%AppData%
mouse_option
false
mutex
iuhttrds432-IVDB56
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
tools
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	afb741ddb6c75469ff3ca02dc958f433.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NOTDgF.url	afb741ddb6c75469ff3ca02dc958f433.exe

Executes dropped EXE 1 IoCs

pid	Process
4844	hnxTEJuRycbG.exe

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000400000001e5eb-7.dat	upx
behavioral2/memory/4844-11-0x0000000000400000-0x00000000004AB000-memory.dmp	upx
behavioral2/memory/4844-26-0x0000000000400000-0x00000000004AB000-memory.dmp	upx
behavioral2/memory/4844-27-0x0000000000400000-0x00000000004AB000-memory.dmp	upx
behavioral2/memory/4844-29-0x0000000000400000-0x00000000004AB000-memory.dmp	upx
behavioral2/memory/4844-32-0x0000000000400000-0x00000000004AB000-memory.dmp	upx
behavioral2/memory/4844-33-0x0000000000400000-0x00000000004AB000-memory.dmp	upx
behavioral2/memory/4844-36-0x0000000000400000-0x00000000004AB000-memory.dmp	upx
behavioral2/memory/4844-37-0x0000000000400000-0x00000000004AB000-memory.dmp	upx
behavioral2/memory/4844-40-0x0000000000400000-0x00000000004AB000-memory.dmp	upx
behavioral2/memory/4844-42-0x0000000000400000-0x00000000004AB000-memory.dmp	upx
behavioral2/memory/4844-44-0x0000000000400000-0x00000000004AB000-memory.dmp	upx
behavioral2/memory/4844-46-0x0000000000400000-0x00000000004AB000-memory.dmp	upx
behavioral2/memory/4844-48-0x0000000000400000-0x00000000004AB000-memory.dmp	upx
behavioral2/memory/4844-50-0x0000000000400000-0x00000000004AB000-memory.dmp	upx
behavioral2/memory/4844-52-0x0000000000400000-0x00000000004AB000-memory.dmp	upx
behavioral2/memory/4844-54-0x0000000000400000-0x00000000004AB000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2792 set thread context of 2660	2792	afb741ddb6c75469ff3ca02dc958f433.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2928	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2792	afb741ddb6c75469ff3ca02dc958f433.exe
2792	afb741ddb6c75469ff3ca02dc958f433.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2792	afb741ddb6c75469ff3ca02dc958f433.exe
Token: 33	4836	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4836	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2660	MSBuild.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 4844	2792	afb741ddb6c75469ff3ca02dc958f433.exe	88
PID 2792 wrote to memory of 4844	2792	afb741ddb6c75469ff3ca02dc958f433.exe	88
PID 2792 wrote to memory of 4844	2792	afb741ddb6c75469ff3ca02dc958f433.exe	88
PID 2792 wrote to memory of 2800	2792	afb741ddb6c75469ff3ca02dc958f433.exe	89
PID 2792 wrote to memory of 2800	2792	afb741ddb6c75469ff3ca02dc958f433.exe	89
PID 2792 wrote to memory of 2800	2792	afb741ddb6c75469ff3ca02dc958f433.exe	89
PID 2792 wrote to memory of 2928	2792	afb741ddb6c75469ff3ca02dc958f433.exe	93
PID 2792 wrote to memory of 2928	2792	afb741ddb6c75469ff3ca02dc958f433.exe	93
PID 2792 wrote to memory of 2928	2792	afb741ddb6c75469ff3ca02dc958f433.exe	93
PID 2792 wrote to memory of 2660	2792	afb741ddb6c75469ff3ca02dc958f433.exe	95
PID 2792 wrote to memory of 2660	2792	afb741ddb6c75469ff3ca02dc958f433.exe	95
PID 2792 wrote to memory of 2660	2792	afb741ddb6c75469ff3ca02dc958f433.exe	95
PID 2792 wrote to memory of 2660	2792	afb741ddb6c75469ff3ca02dc958f433.exe	95
PID 2792 wrote to memory of 2660	2792	afb741ddb6c75469ff3ca02dc958f433.exe	95
PID 2792 wrote to memory of 2660	2792	afb741ddb6c75469ff3ca02dc958f433.exe	95
PID 2792 wrote to memory of 2660	2792	afb741ddb6c75469ff3ca02dc958f433.exe	95
PID 2792 wrote to memory of 2660	2792	afb741ddb6c75469ff3ca02dc958f433.exe	95
PID 2792 wrote to memory of 2660	2792	afb741ddb6c75469ff3ca02dc958f433.exe	95
PID 2792 wrote to memory of 2660	2792	afb741ddb6c75469ff3ca02dc958f433.exe	95

C:\Users\Admin\AppData\Local\Temp\afb741ddb6c75469ff3ca02dc958f433.exe
"C:\Users\Admin\AppData\Local\Temp\afb741ddb6c75469ff3ca02dc958f433.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Users\Admin\AppData\Roaming\hnxTEJuRycbG.exe
  "C:\Users\Admin\AppData\Roaming\hnxTEJuRycbG.exe"
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /query
  2⤵
  PID:2800
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /sc MINUTE /tn NOTDgF /MO 1 /tr "C:\Users\Admin\AppData\Roaming\zoop\zoopla.exe\
  2⤵
  - Creates scheduled task(s)
  PID:2928
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2660

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x150 0x338
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hnxTEJuRycbG.exe

Path C:\Users\Admin\AppData\Roaming\hnxTEJuRycbG.exe
Size 108KB
SHA256 b50816ecc6ec849fcb0ed0677c8a6b1f0867a74638679bcafc4f63dcc5b2e1ef
MD5 eb5f4d94d12c511d7bfe8608652adb6a
SHA1 ba9a6b46f359d116bfcbca244d00e07f985414e9
SHA512 ab315d7c76d14e4bb18e36fdeddfe616e9c5c8b997381190d5d45189049658afb7ed5442292e2b0562f4f895557a86fe3b179f1f5b90c7102c28858859abf7ee
SSDEEP 3072:HdH7CgmrM74S4NOOAfidzDkua60fXWbaAIw:HtBmU4NdzDkuWfsT
MD5 SHA1 SHA512 SSDEEP

Submit Download

logs.dat

Path C:\Users\Admin\AppData\Roaming\logs\logs.dat
Size 95B
SHA256 fa7ecb7f5dd8369f0e1b137b366fc5ea1490cb0c23d9ff92aec9e8b3d3b2b0e8
MD5 d995b6f552afa49858880a823a3812a6
SHA1 24917196b946474d31bad7038cd4d28a36f18843
SHA512 a0df57849994a9bb8aaf00a04e192fcac4f7d594392224d6dd589295f53114c4e08fb1f8be5e1a1cd92e81317bd0ff756bc7da41108b7d02fa1f263ab580c68e
MD5 SHA1 SHA512

Submit Download

memory/2660-21-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2660-19-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2660-23-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2660-24-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2660-30-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2792-2-0x0000000003190000-0x000000000319C000-memory.dmp

Download

memory/2792-1-0x0000000074780000-0x0000000074F30000-memory.dmp

Download

memory/2792-14-0x0000000005750000-0x000000000576F000-memory.dmp

Download

memory/2792-15-0x0000000006340000-0x00000000063DC000-memory.dmp

Download

memory/2792-20-0x0000000074780000-0x0000000074F30000-memory.dmp

Download

memory/2792-0-0x0000000000DB0000-0x0000000000DFA000-memory.dmp

Download

memory/4844-29-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/4844-37-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/4844-26-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/4844-32-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/4844-33-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/4844-11-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/4844-36-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/4844-27-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/4844-40-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/4844-42-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/4844-44-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/4844-46-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/4844-48-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/4844-50-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/4844-52-0x0000000000400000-0x00000000004AB000-memory.dmp

Download

memory/4844-54-0x0000000000400000-0x00000000004AB000-memory.dmp

Download