remcos | 6f35ab9d6aed8b8df1754149da79be5cdadae7b5366e8f2be46d9370f7e920c0

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2024 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Server_1faa.ps1
Size

1022KB
MD5

237ee8e11875f3993a29a61d6d20d09c
SHA1

96b8e653f486975e420dba4d7e25736627543080
SHA256

28be1304d7a2f20f015672afe5d72fd287a251f07a7a06b30c57685ae27ce0f8
SHA512

89f7154aa8272cff8df9b89ac8adaec84343a26ac9157720cfbbdf00a7da688e6731006c1f0ea48d77167f740216cc6157bcb4c66a8d261f4bc67d02598a88b9
SSDEEP

12288:Vm8eHNHc142NYv5rNHI4ppN5mAy5BmqgJr64Zdy670D1wp6gPC9GJTgjse0YRVF1:006uFuaj

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Version

3.1.5 Pro

Botnet

RemoteHost

185.19.85.168:8888

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-6MZBDK
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 3108 set thread context of 1872 3108 powershell.exe aspnet_compiler.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exe

pid process

3108 powershell.exe
3108 powershell.exe
3108 powershell.exe
3108 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 3108 powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

aspnet_compiler.exe

pid process

1872 aspnet_compiler.exe

description	pid	process	target process
PID 3108 set thread context of 1872	3108	powershell.exe	aspnet_compiler.exe

pid	process
3108	powershell.exe
3108	powershell.exe
3108	powershell.exe
3108	powershell.exe

description	pid	process
Token: SeDebugPrivilege	3108	powershell.exe

pid	process
1872	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 3108 wrote to memory of 4992	3108	powershell.exe	aspnet_compiler.exe
PID 3108 wrote to memory of 4992	3108	powershell.exe	aspnet_compiler.exe
PID 3108 wrote to memory of 4992	3108	powershell.exe	aspnet_compiler.exe
PID 3108 wrote to memory of 1872	3108	powershell.exe	aspnet_compiler.exe
PID 3108 wrote to memory of 1872	3108	powershell.exe	aspnet_compiler.exe
PID 3108 wrote to memory of 1872	3108	powershell.exe	aspnet_compiler.exe
PID 3108 wrote to memory of 1872	3108	powershell.exe	aspnet_compiler.exe
PID 3108 wrote to memory of 1872	3108	powershell.exe	aspnet_compiler.exe
PID 3108 wrote to memory of 1872	3108	powershell.exe	aspnet_compiler.exe
PID 3108 wrote to memory of 1872	3108	powershell.exe	aspnet_compiler.exe
PID 3108 wrote to memory of 1872	3108	powershell.exe	aspnet_compiler.exe
PID 3108 wrote to memory of 1872	3108	powershell.exe	aspnet_compiler.exe
PID 3108 wrote to memory of 1872	3108	powershell.exe	aspnet_compiler.exe
PID 3108 wrote to memory of 1872	3108	powershell.exe	aspnet_compiler.exe
PID 3108 wrote to memory of 1872	3108	powershell.exe	aspnet_compiler.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Server_1faa.ps1
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3108

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
2⤵
PID:4992

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tagefzht.nsn.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Filesize
148B

MD5
f5646a63c8a00ee7fff0cd9f4ca9baab

SHA1
2424dcf00a20dae4b92f05468a9739b934323fc8

SHA256
d6b48424260e1134b63c69640abef66a7b4f94af8a7623589da9aed294f1d28d

SHA512
e0c1d6e7d93ea21888813e49a9c7d6df8360458990726ac8579563a59eb5aa5428d30acf5eb49fb98d9d72fe506d7c56c1de1e1f2de5c8dcc9102bdd9b187a48

Download Submit
memory/1872-24-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1872-16-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1872-30-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1872-14-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1872-23-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1872-18-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1872-22-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/1872-20-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/3108-19-0x00007FFA75000000-0x00007FFA75AC1000-memory.dmp

Filesize
10.8MB

Download
memory/3108-11-0x00000235EDCE0000-0x00000235EDCF0000-memory.dmp

Filesize
64KB

Download
memory/3108-10-0x00007FFA75000000-0x00007FFA75AC1000-memory.dmp

Filesize
10.8MB

Download
memory/3108-13-0x00000235ED800000-0x00000235ED816000-memory.dmp

Filesize
88KB

Download
memory/3108-9-0x00000235ED7D0000-0x00000235ED7F2000-memory.dmp

Filesize
136KB

Download
memory/3108-12-0x00000235EDCE0000-0x00000235EDCF0000-memory.dmp

Filesize
64KB

Download