remcos | 6f35ab9d6aed8b8df1754149da79be5cdadae7b5366e8f2be46d9370f7e920c0

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2024 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Server_77251.ps1
Size

1022KB
MD5

2352e6c5e2c71eadedc4b1d1a75eac79
SHA1

4467d978577f2ed268cac8e3027f07637c890de7
SHA256

b12ae24085460abf05fccc1b18438a6894fb7ac6018ee7d35f033911aa4f8ba0
SHA512

5937c03b23cf2ff6992491259c73e7bbcdc3ce3780c373cfeb484eaea0933263f10c270132a61f745e5776fd335ebb83ce77162567c6d958f87632b416f96e5e
SSDEEP

12288:Bm8eHNHc142NYv5rNHI4ppN5mAy5BmqgJr64Zdy670D1wp6gPC9GJTgjse0YRVFU:g06uFBaj

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Version

3.1.5 Pro

Botnet

RemoteHost

185.19.85.168:8888

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-HJX1WP
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 5008 set thread context of 4932 5008 powershell.exe aspnet_compiler.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

5008 powershell.exe
5008 powershell.exe
5008 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 5008 powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

aspnet_compiler.exe

pid process

4932 aspnet_compiler.exe

description	pid	process	target process
PID 5008 set thread context of 4932	5008	powershell.exe	aspnet_compiler.exe

pid	process
5008	powershell.exe
5008	powershell.exe
5008	powershell.exe

description	pid	process
Token: SeDebugPrivilege	5008	powershell.exe

pid	process
4932	aspnet_compiler.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 5008 wrote to memory of 4932	5008	powershell.exe	aspnet_compiler.exe
PID 5008 wrote to memory of 4932	5008	powershell.exe	aspnet_compiler.exe
PID 5008 wrote to memory of 4932	5008	powershell.exe	aspnet_compiler.exe
PID 5008 wrote to memory of 4932	5008	powershell.exe	aspnet_compiler.exe
PID 5008 wrote to memory of 4932	5008	powershell.exe	aspnet_compiler.exe
PID 5008 wrote to memory of 4932	5008	powershell.exe	aspnet_compiler.exe
PID 5008 wrote to memory of 4932	5008	powershell.exe	aspnet_compiler.exe
PID 5008 wrote to memory of 4932	5008	powershell.exe	aspnet_compiler.exe
PID 5008 wrote to memory of 4932	5008	powershell.exe	aspnet_compiler.exe
PID 5008 wrote to memory of 4932	5008	powershell.exe	aspnet_compiler.exe
PID 5008 wrote to memory of 4932	5008	powershell.exe	aspnet_compiler.exe
PID 5008 wrote to memory of 4932	5008	powershell.exe	aspnet_compiler.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Server_77251.ps1
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5008

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:4932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3968 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:8
1⤵
PID:3584

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4whjopwk.h3u.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Filesize
148B

MD5
819a3d0e83d29b1dac3215f78858a8c0

SHA1
ad9fe5bcfae7f0381402c4001a6b587d3c10a021

SHA256
cb0a44d8b0be4895226d47053b70bc7daed7d1e83dad81658b55df212b97d9e2

SHA512
917131eb5f61cb76f02e487106c58d98c6065fecde6be3fc08d60d129e6ff6e913c4ece42f953b1e2a429b8bd5de0633e53a4815901047e16b77519645877b96

Download Submit
memory/4932-22-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4932-20-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4932-31-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4932-25-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4932-24-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4932-15-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4932-18-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/4932-21-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/5008-19-0x00007FFB76AA0000-0x00007FFB77561000-memory.dmp

Filesize
10.8MB

Download
memory/5008-12-0x0000026827480000-0x0000026827490000-memory.dmp

Filesize
64KB

Download
memory/5008-5-0x0000026827420000-0x0000026827442000-memory.dmp

Filesize
136KB

Download
memory/5008-14-0x0000026827EF0000-0x0000026827F06000-memory.dmp

Filesize
88KB

Download
memory/5008-13-0x0000026827480000-0x0000026827490000-memory.dmp

Filesize
64KB

Download
memory/5008-10-0x00007FFB76AA0000-0x00007FFB77561000-memory.dmp

Filesize
10.8MB

Download
memory/5008-11-0x0000026827480000-0x0000026827490000-memory.dmp

Filesize
64KB

Download