remcos | 08aa3bfb5f56d17ce70299a7ac6680738f95df00da7445f6ba4d7064dfa73d71

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 12:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe
Size

884KB
MD5

cb60f9802b22337e3182ff3045e848fa
SHA1

b3d29c2524c103e786e2a73c3dfdbe37b8e0ee28
SHA256

16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce
SHA512

bb7a9e679caa06f904eff2b4f08006d2cbeae03dfaa9e7a6b90e667040bedee607c8d147a16b56d5ecae99a11e0e9f6fdafc436f48867e12022198020f749be0
SSDEEP

24576:6OKGhEYdA9mPUiGZHQZcrOuP115OI7BN1:dKGhEYdAMfhSd155B

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

91.92.244.17:2707

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-ZBS4C6
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation	16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe

description pid process target process

PID 64 set thread context of 3296 64 16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3124 schtasks.exe

description	pid	process	target process
PID 64 set thread context of 3296	64	16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe	vbc.exe

pid	process
3124	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exepowershell.exepowershell.exe

pid	process
64	16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe
3520	powershell.exe
4428	powershell.exe
64	16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe
3520	powershell.exe
4428	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	64	16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe
Token: SeDebugPrivilege	3520	powershell.exe
Token: SeDebugPrivilege	4428	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe

description	pid	process	target process
PID 64 wrote to memory of 3520	64	16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe	powershell.exe
PID 64 wrote to memory of 3520	64	16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe	powershell.exe
PID 64 wrote to memory of 3520	64	16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe	powershell.exe
PID 64 wrote to memory of 4428	64	16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe	powershell.exe
PID 64 wrote to memory of 4428	64	16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe	powershell.exe
PID 64 wrote to memory of 4428	64	16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe	powershell.exe
PID 64 wrote to memory of 3124	64	16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe	schtasks.exe
PID 64 wrote to memory of 3124	64	16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe	schtasks.exe
PID 64 wrote to memory of 3124	64	16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe	schtasks.exe
PID 64 wrote to memory of 3296	64	16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe	vbc.exe
PID 64 wrote to memory of 3296	64	16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe	vbc.exe
PID 64 wrote to memory of 3296	64	16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe	vbc.exe
PID 64 wrote to memory of 3296	64	16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe	vbc.exe
PID 64 wrote to memory of 3296	64	16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe	vbc.exe
PID 64 wrote to memory of 3296	64	16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe	vbc.exe
PID 64 wrote to memory of 3296	64	16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe	vbc.exe
PID 64 wrote to memory of 3296	64	16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe	vbc.exe
PID 64 wrote to memory of 3296	64	16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe	vbc.exe
PID 64 wrote to memory of 3296	64	16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe	vbc.exe
PID 64 wrote to memory of 3296	64	16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe	vbc.exe
PID 64 wrote to memory of 3296	64	16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe
"C:\Users\Admin\AppData\Local\Temp\16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:64

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\16e9bc6afb3e487749ffed54bace65bb58dd5257c66a0baef767d371eda437ce.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3520

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xEAqrgXRK.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4428

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xEAqrgXRK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9C8E.tmp"
2⤵
- Creates scheduled task(s)
PID:3124

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:3296

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

T1064

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
0e0b8960772711e17db728fa94287878

SHA1
86d2ab6ae8a0c2b0a9dce8d46acd0681c3f8c5da

SHA256
cef4fc858417302b6651a54124b3fcbbb38e1266400b86d8cabb7c21b185e790

SHA512
797b75608c58fd1a4ff29b2eeb7a289665ff5b7b280c90930c65985fef7352cc6b0eb97216d3c30199de89de19af18463b527af4b284464674972215455afc4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_df1xso0f.iba.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9C8E.tmp
Filesize
1KB

MD5
664a51f00a358c55599653ce719bf372

SHA1
c32732e8cf444c32863a72f332409e5b5096766d

SHA256
7f3508dcad2a41a8d0e772b44bae7364dfe1cfc4f70563f1a48e5d72af61b492

SHA512
b665df9267046dbc04b2651b8681300ea2e67c6a0768d0f4a9a49fbf1b55ce064054f8448687c6de328da006ea5900512d28c08cdb20bf9af18a58afc2b92a0b

Download Submit
memory/64-8-0x0000000005460000-0x000000000546C000-memory.dmp

Filesize
48KB

Download
memory/64-3-0x00000000050C0000-0x0000000005152000-memory.dmp

Filesize
584KB

Download
memory/64-5-0x0000000005160000-0x000000000516A000-memory.dmp

Filesize
40KB

Download
memory/64-6-0x0000000005420000-0x0000000005434000-memory.dmp

Filesize
80KB

Download
memory/64-7-0x0000000005450000-0x000000000545A000-memory.dmp

Filesize
40KB

Download
memory/64-0-0x0000000074480000-0x0000000074C30000-memory.dmp

Filesize
7.7MB

Download
memory/64-50-0x0000000074480000-0x0000000074C30000-memory.dmp

Filesize
7.7MB

Download
memory/64-10-0x0000000008AF0000-0x0000000008B8C000-memory.dmp

Filesize
624KB

Download
memory/64-2-0x0000000005760000-0x0000000005D04000-memory.dmp

Filesize
5.6MB

Download
memory/64-24-0x0000000074480000-0x0000000074C30000-memory.dmp

Filesize
7.7MB

Download
memory/64-9-0x00000000063E0000-0x00000000064A0000-memory.dmp

Filesize
768KB

Download
memory/64-4-0x0000000005060000-0x0000000005070000-memory.dmp

Filesize
64KB

Download
memory/64-1-0x00000000005D0000-0x00000000006B4000-memory.dmp

Filesize
912KB

Download
memory/3296-99-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3296-33-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3296-107-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3296-108-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3296-102-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3296-109-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3296-110-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3296-101-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3296-32-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3296-106-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3296-39-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3296-100-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3296-52-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3296-51-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3296-103-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3296-53-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3296-104-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3296-98-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3296-105-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3520-90-0x0000000007B40000-0x0000000007B5A000-memory.dmp

Filesize
104KB

Download
memory/3520-59-0x000000007F600000-0x000000007F610000-memory.dmp

Filesize
64KB

Download
memory/3520-15-0x0000000002BC0000-0x0000000002BF6000-memory.dmp

Filesize
216KB

Download
memory/3520-58-0x00000000074A0000-0x00000000074D2000-memory.dmp

Filesize
200KB

Download
memory/3520-62-0x0000000072F50000-0x0000000072F9C000-memory.dmp

Filesize
304KB

Download
memory/3520-16-0x0000000074480000-0x0000000074C30000-memory.dmp

Filesize
7.7MB

Download
memory/3520-17-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download
memory/3520-19-0x0000000005760000-0x0000000005D88000-memory.dmp

Filesize
6.2MB

Download
memory/3520-83-0x0000000007E40000-0x00000000084BA000-memory.dmp

Filesize
6.5MB

Download
memory/3520-56-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download
memory/3520-85-0x0000000007870000-0x000000000787A000-memory.dmp

Filesize
40KB

Download
memory/3520-18-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download
memory/3520-21-0x0000000005500000-0x0000000005522000-memory.dmp

Filesize
136KB

Download
memory/3520-25-0x0000000005E00000-0x0000000005E66000-memory.dmp

Filesize
408KB

Download
memory/3520-28-0x0000000005E70000-0x0000000005ED6000-memory.dmp

Filesize
408KB

Download
memory/3520-40-0x0000000005EE0000-0x0000000006234000-memory.dmp

Filesize
3.3MB

Download
memory/3520-96-0x0000000074480000-0x0000000074C30000-memory.dmp

Filesize
7.7MB

Download
memory/4428-84-0x00000000072C0000-0x00000000072DA000-memory.dmp

Filesize
104KB

Download
memory/4428-91-0x00000000075E0000-0x00000000075E8000-memory.dmp

Filesize
32KB

Download
memory/4428-97-0x0000000074480000-0x0000000074C30000-memory.dmp

Filesize
7.7MB

Download
memory/4428-55-0x00000000064F0000-0x000000000653C000-memory.dmp

Filesize
304KB

Download
memory/4428-54-0x0000000005B90000-0x0000000005BAE000-memory.dmp

Filesize
120KB

Download
memory/4428-57-0x0000000002700000-0x0000000002710000-memory.dmp

Filesize
64KB

Download
memory/4428-89-0x0000000007500000-0x0000000007514000-memory.dmp

Filesize
80KB

Download
memory/4428-88-0x00000000074F0000-0x00000000074FE000-memory.dmp

Filesize
56KB

Download
memory/4428-23-0x0000000002700000-0x0000000002710000-memory.dmp

Filesize
64KB

Download
memory/4428-87-0x00000000074C0000-0x00000000074D1000-memory.dmp

Filesize
68KB

Download
memory/4428-22-0x0000000074480000-0x0000000074C30000-memory.dmp

Filesize
7.7MB

Download
memory/4428-86-0x0000000007540000-0x00000000075D6000-memory.dmp

Filesize
600KB

Download
memory/4428-82-0x0000000007180000-0x0000000007223000-memory.dmp

Filesize
652KB

Download
memory/4428-61-0x000000007EE70000-0x000000007EE80000-memory.dmp

Filesize
64KB

Download
memory/4428-72-0x0000000006560000-0x000000000657E000-memory.dmp

Filesize
120KB

Download
memory/4428-60-0x0000000072F50000-0x0000000072F9C000-memory.dmp

Filesize
304KB

Download