remcos | bd1f96f81bda3d8cca3ed43f3fae60c3ed4d3585dbc94f2a3ede42d8d95c5ade

Analysis

max time kernel
161s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/03/2024, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b015f9b93ba27a57fc8cffbdd4bfed5b.exe
Size 981KB
Sample240301-cty4vsag79
SHA256 bd1f96f81bda3d8cca3ed43f3fae60c3ed4d3585dbc94f2a3ede42d8d95c5ade
MD5 b015f9b93ba27a57fc8cffbdd4bfed5b
SHA1 d55afd4f8d40f14326d06a042517d00149457802
SHA512 ea7746466ee2a5445415a8afd664c9137fcc35651ba9b7f3d7d1df415e16e433cf6caebba5a91748d6ee98f466cc4a6a7c9b8af4d70f49c16342146c9e9c9c7b
SSDEEP 24576:FywCCOsBgo0q4wMnBqTzdUoIbnkpiaV9xVSKQiJs3qd:FyBDoHMB6zdUoIby79Xs3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzduoss rat

Malware Config

Extracted

Family

remcos

Version

3.1.2 Pro

Botnet

ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZDUOSS

dominoduck2118.duckdns.org:9806

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
loggs.dat
keylog_flag
false
keylog_folder
Appdataaa
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-AEQNMG
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

resource	yara_rule
behavioral2/memory/1244-8-0x0000000002A70000-0x0000000002A82000-memory.dmp	CustAttr

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	b015f9b93ba27a57fc8cffbdd4bfed5b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1244 set thread context of 3392	1244	b015f9b93ba27a57fc8cffbdd4bfed5b.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1244	b015f9b93ba27a57fc8cffbdd4bfed5b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1244	b015f9b93ba27a57fc8cffbdd4bfed5b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3392	RegSvcs.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2704	1244	b015f9b93ba27a57fc8cffbdd4bfed5b.exe	97
PID 1244 wrote to memory of 2704	1244	b015f9b93ba27a57fc8cffbdd4bfed5b.exe	97
PID 1244 wrote to memory of 2704	1244	b015f9b93ba27a57fc8cffbdd4bfed5b.exe	97
PID 1244 wrote to memory of 3392	1244	b015f9b93ba27a57fc8cffbdd4bfed5b.exe	99
PID 1244 wrote to memory of 3392	1244	b015f9b93ba27a57fc8cffbdd4bfed5b.exe	99
PID 1244 wrote to memory of 3392	1244	b015f9b93ba27a57fc8cffbdd4bfed5b.exe	99
PID 1244 wrote to memory of 3392	1244	b015f9b93ba27a57fc8cffbdd4bfed5b.exe	99
PID 1244 wrote to memory of 3392	1244	b015f9b93ba27a57fc8cffbdd4bfed5b.exe	99
PID 1244 wrote to memory of 3392	1244	b015f9b93ba27a57fc8cffbdd4bfed5b.exe	99
PID 1244 wrote to memory of 3392	1244	b015f9b93ba27a57fc8cffbdd4bfed5b.exe	99
PID 1244 wrote to memory of 3392	1244	b015f9b93ba27a57fc8cffbdd4bfed5b.exe	99
PID 1244 wrote to memory of 3392	1244	b015f9b93ba27a57fc8cffbdd4bfed5b.exe	99
PID 1244 wrote to memory of 3392	1244	b015f9b93ba27a57fc8cffbdd4bfed5b.exe	99
PID 1244 wrote to memory of 3392	1244	b015f9b93ba27a57fc8cffbdd4bfed5b.exe	99
PID 1244 wrote to memory of 3392	1244	b015f9b93ba27a57fc8cffbdd4bfed5b.exe	99

C:\Users\Admin\AppData\Local\Temp\b015f9b93ba27a57fc8cffbdd4bfed5b.exe
"C:\Users\Admin\AppData\Local\Temp\b015f9b93ba27a57fc8cffbdd4bfed5b.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\pInCsIkcuSKvK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8B63.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2704
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp8B63.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp8B63.tmp
Size 1KB
SHA256 66baa8100448e3e1ada5f809583bcaa981476ceb697f22abc2049828352fe084
MD5 47a42305ea0758b633c22e8fef425444
SHA1 fa669e2af71ddfe2950104c0f01893ed407ca2a9
SHA512 8ed4e64e0a8c089ec84a8a410ed12cd2ec5dca2a72967334eeebc201d7cb07020e5a9654372b0fc19c2bdf5d6974cb78293d58600a8cf9a7d1635199bb7614f6
MD5 SHA1 SHA512

Submit Download

loggs.dat

Path C:\Users\Admin\AppData\Roaming\Appdataaa\loggs.dat
Size 74B
SHA256 e943714be438331f3d8718ad26b775ceee964eea302caee9bd1d6336985d8dd5
MD5 fb1e8b198521976f8b98f0b46ab623ed
SHA1 76b91a617fe306abc7729217d4d391ce1ba28f05
SHA512 b786d34bc2fdc920e4fe5b74f0217a28edd9b5459a8259b3cc50d4e9b3bc62d60bfc49aa46de45730641ad8bf5baf5f8f019cb6c17651ac4793a954d1bdeff3a
MD5 SHA1 SHA512

Submit Download

memory/1244-12-0x0000000007F20000-0x0000000007F9E000-memory.dmp

Download

memory/1244-2-0x0000000005090000-0x000000000512C000-memory.dmp

Download

memory/1244-4-0x0000000005130000-0x00000000051C2000-memory.dmp

Download

memory/1244-5-0x0000000005010000-0x0000000005020000-memory.dmp

Download

memory/1244-6-0x00000000052D0000-0x00000000052DA000-memory.dmp

Download

memory/1244-7-0x0000000005340000-0x0000000005396000-memory.dmp

Download

memory/1244-8-0x0000000002A70000-0x0000000002A82000-memory.dmp

Download

memory/1244-9-0x00000000749E0000-0x0000000075190000-memory.dmp

Download

memory/1244-10-0x0000000005010000-0x0000000005020000-memory.dmp

Download

memory/1244-1-0x00000000749E0000-0x0000000075190000-memory.dmp

Download

memory/1244-3-0x00000000056E0000-0x0000000005C84000-memory.dmp

Download

memory/1244-0-0x0000000000590000-0x000000000068A000-memory.dmp

Download

memory/1244-11-0x0000000007E20000-0x0000000007EDA000-memory.dmp

Download

memory/1244-23-0x00000000749E0000-0x0000000075190000-memory.dmp

Download

memory/3392-21-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3392-22-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3392-24-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3392-19-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3392-26-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3392-27-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3392-30-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3392-18-0x0000000000400000-0x0000000000478000-memory.dmp

Download