remcos | 2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65

Resubmissions

09-04-2024 14:18

240409-rmbsbahc53 10

09-04-2024 14:18

09-04-2024 14:17

09-04-2024 14:17

06-04-2024 01:09

Analysis

max time kernel
1800s
max time network
1806s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe
Size

548KB
MD5

10a4cb3233c444bcf6211100ab9bad9a
SHA1

2f4a679479fdff9d22226676d7a7eacab84311eb
SHA256

2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65
SHA512

0c847f9723d1e65a03d0e129555160a7730e3ab4625d488540dd82dc968b354e31ab042dd820da6b61662af62d0687696e458440ab66b940e3fa168c09af9303
SSDEEP

12288:FUH8UsiMHGMZY/QZsg4rvpvK9+uH2OG/4RY+ajkrSyxPln+07bSsEAmD:yH8XvHFA6sgyvxK4uHBLRPaArSuPl19

Score

10^/10

remcos gg rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

62.102.148.185:9771

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
newstart
keylog_path
%AppData%
mouse_option
false
mutex
remcos_wgwfvnfssp
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe

description	pid	process	target process
PID 3172 set thread context of 3916	3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

208 schtasks.exe

pid	process
208	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exepowershell.exepowershell.exe

pid	process
3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe
3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe
3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe
3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe
3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe
3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe
3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe
3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe
3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe
3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe
1724	powershell.exe
1724	powershell.exe
4448	powershell.exe
4448	powershell.exe
3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe
4448	powershell.exe
1724	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe
Token: SeDebugPrivilege	4448	powershell.exe
Token: SeDebugPrivilege	1724	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe

pid process

3916 2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe

pid	process
3916	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe

description	pid	process	target process
PID 3172 wrote to memory of 1724	3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe	powershell.exe
PID 3172 wrote to memory of 1724	3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe	powershell.exe
PID 3172 wrote to memory of 1724	3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe	powershell.exe
PID 3172 wrote to memory of 4448	3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe	powershell.exe
PID 3172 wrote to memory of 4448	3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe	powershell.exe
PID 3172 wrote to memory of 4448	3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe	powershell.exe
PID 3172 wrote to memory of 208	3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe	schtasks.exe
PID 3172 wrote to memory of 208	3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe	schtasks.exe
PID 3172 wrote to memory of 208	3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe	schtasks.exe
PID 3172 wrote to memory of 3916	3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe
PID 3172 wrote to memory of 3916	3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe
PID 3172 wrote to memory of 3916	3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe
PID 3172 wrote to memory of 3916	3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe
PID 3172 wrote to memory of 3916	3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe
PID 3172 wrote to memory of 3916	3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe
PID 3172 wrote to memory of 3916	3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe
PID 3172 wrote to memory of 3916	3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe
PID 3172 wrote to memory of 3916	3172	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe	2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe

C:\Users\Admin\AppData\Local\Temp\2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe
"C:\Users\Admin\AppData\Local\Temp\2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3172

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1724

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oFkpbhjTJbn.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4448

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oFkpbhjTJbn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp774E.tmp"
2⤵
- Creates scheduled task(s)
PID:208

C:\Users\Admin\AppData\Local\Temp\2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe
"C:\Users\Admin\AppData\Local\Temp\2a0a27371b6f4d355c3264fcc668d8a0fe1af7ebb8b19dca3b5cdf20a3282d65.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:3916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4444 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:2940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1032 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:4516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
678941f0fc4678ca3c6b536a640cb43a

SHA1
e812472ee1f7b03a31e84f5b9fe0bceb8ab5b064

SHA256
25023deb1b15e8136010cc24a44b3683cde46f196dacb8dbc576b2b60ecb5569

SHA512
3d7821e76342fa66282f8951233500fab4c90a7352d24927f8b5ce3f2ff774c27caae367c380470a36fde73b0ef464f5594af9bb7dbf014a11288286073fadee

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2cbjuigs.cme.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp774E.tmp

Filesize
1KB

MD5
e761c849822067c92f4e1d808cfcae9f

SHA1
aed58443601f62f3ea6893b4540319dbf7b3cc2a

SHA256
96c1e8db88eb4162c825c5fba4c9112eaf1cab5002588b794b4b1f22d7688c69

SHA512
8aec27338bc5d561d777bccffaa21e4a5eb9e483a972b7a3c1a26b0aa5efec20b5059cd773e7955ae8883cdbc1f6383738895f3c31e94198403804ceb50a4ebd

Download Submit
memory/1724-61-0x0000000071320000-0x000000007136C000-memory.dmp

Filesize
304KB

Download
memory/1724-16-0x00000000026B0000-0x00000000026E6000-memory.dmp

Filesize
216KB

Download
memory/1724-87-0x0000000007370000-0x000000000737A000-memory.dmp

Filesize
40KB

Download
memory/1724-84-0x00000000071E0000-0x0000000007283000-memory.dmp

Filesize
652KB

Download
memory/1724-72-0x0000000006580000-0x000000000659E000-memory.dmp

Filesize
120KB

Download
memory/1724-62-0x000000007FA40000-0x000000007FA50000-memory.dmp

Filesize
64KB

Download
memory/1724-30-0x0000000005790000-0x00000000057F6000-memory.dmp

Filesize
408KB

Download
memory/1724-58-0x0000000004B20000-0x0000000004B30000-memory.dmp

Filesize
64KB

Download
memory/1724-17-0x0000000004B20000-0x0000000004B30000-memory.dmp

Filesize
64KB

Download
memory/1724-91-0x0000000007540000-0x0000000007554000-memory.dmp

Filesize
80KB

Download
memory/1724-15-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/1724-18-0x0000000004B20000-0x0000000004B30000-memory.dmp

Filesize
64KB

Download
memory/1724-20-0x0000000005160000-0x0000000005788000-memory.dmp

Filesize
6.2MB

Download
memory/1724-57-0x0000000006080000-0x00000000060CC000-memory.dmp

Filesize
304KB

Download
memory/1724-55-0x0000000005B10000-0x0000000005E64000-memory.dmp

Filesize
3.3MB

Download
memory/1724-33-0x00000000059A0000-0x0000000005A06000-memory.dmp

Filesize
408KB

Download
memory/1724-93-0x0000000007620000-0x0000000007628000-memory.dmp

Filesize
32KB

Download
memory/1724-101-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/1724-28-0x0000000005030000-0x0000000005052000-memory.dmp

Filesize
136KB

Download
memory/3172-31-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/3172-5-0x0000000005010000-0x000000000501A000-memory.dmp

Filesize
40KB

Download
memory/3172-1-0x0000000000590000-0x000000000061E000-memory.dmp

Filesize
568KB

Download
memory/3172-2-0x00000000055E0000-0x0000000005B84000-memory.dmp

Filesize
5.6MB

Download
memory/3172-3-0x0000000005030000-0x00000000050C2000-memory.dmp

Filesize
584KB

Download
memory/3172-4-0x00000000051E0000-0x00000000051F0000-memory.dmp

Filesize
64KB

Download
memory/3172-0-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/3172-6-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/3172-7-0x0000000006200000-0x000000000620C000-memory.dmp

Filesize
48KB

Download
memory/3172-8-0x0000000006470000-0x00000000064D0000-memory.dmp

Filesize
384KB

Download
memory/3172-11-0x00000000051E0000-0x00000000051F0000-memory.dmp

Filesize
64KB

Download
memory/3172-9-0x0000000009F10000-0x0000000009FAC000-memory.dmp

Filesize
624KB

Download
memory/3172-10-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/3916-29-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3916-103-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3916-25-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3916-34-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/3916-46-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4448-56-0x0000000006380000-0x000000000639E000-memory.dmp

Filesize
120KB

Download
memory/4448-74-0x000000007F9B0000-0x000000007F9C0000-memory.dmp

Filesize
64KB

Download
memory/4448-86-0x0000000007690000-0x00000000076AA000-memory.dmp

Filesize
104KB

Download
memory/4448-22-0x0000000004F90000-0x0000000004FA0000-memory.dmp

Filesize
64KB

Download
memory/4448-88-0x0000000007910000-0x00000000079A6000-memory.dmp

Filesize
600KB

Download
memory/4448-89-0x0000000007890000-0x00000000078A1000-memory.dmp

Filesize
68KB

Download
memory/4448-90-0x00000000078C0000-0x00000000078CE000-memory.dmp

Filesize
56KB

Download
memory/4448-85-0x0000000007CF0000-0x000000000836A000-memory.dmp

Filesize
6.5MB

Download
memory/4448-92-0x00000000079D0000-0x00000000079EA000-memory.dmp

Filesize
104KB

Download
memory/4448-23-0x0000000004F90000-0x0000000004FA0000-memory.dmp

Filesize
64KB

Download
memory/4448-21-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/4448-73-0x0000000071320000-0x000000007136C000-memory.dmp

Filesize
304KB

Download
memory/4448-100-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/4448-60-0x0000000007380000-0x00000000073B2000-memory.dmp

Filesize
200KB

Download
memory/4448-59-0x0000000004F90000-0x0000000004FA0000-memory.dmp

Filesize
64KB

Download