remcos | 05a341a2577c728e8a994775b17b8c5562539146d78a5de948e3534e1ae1c629

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
proof of payment.exe
Size 906KB
Sample240503-nae3esdb2x
SHA256 05a341a2577c728e8a994775b17b8c5562539146d78a5de948e3534e1ae1c629
MD5 931254205cd64ad16b18fc9b318e2ca6
SHA1 4e5c18fcbf06212d952e084b1b455ecc136e4845
SHA512 d6464e122e6eb02d0d32dec6866555bcfe1b644382eda79b6242f93b39df70071a9eb92c66817e2c1cf2d0b7a7bdf09c12b52e21471e56b2bf4ac7c3745332d9
SSDEEP 12288:ppB778QH0fay4iJDieHNq5lVnsUc/Nb2JF5xXwGp94GEXHMY1E7LgHPPkqM7E6:bBWkithtq5jsT/9mb9PUsv7LMPZM7E6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost collection execution rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

37.120.235.122:2269

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-F9KCYW
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/1168-97-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4644-98-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/1168-97-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/5092-96-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4644-98-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1624	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	proof of payment.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	proof of payment.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4048 set thread context of 4204	4048	proof of payment.exe	104
PID 4204 set thread context of 4644	4204	proof of payment.exe	108
PID 4204 set thread context of 1168	4204	proof of payment.exe	110
PID 4204 set thread context of 5092	4204	proof of payment.exe	111

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
456	schtasks.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4048	proof of payment.exe
4048	proof of payment.exe
4048	proof of payment.exe
4048	proof of payment.exe
4048	proof of payment.exe
4048	proof of payment.exe
4048	proof of payment.exe
4048	proof of payment.exe
4048	proof of payment.exe
4048	proof of payment.exe
1624	powershell.exe
1624	powershell.exe
1624	powershell.exe
4644	proof of payment.exe
4644	proof of payment.exe
5092	proof of payment.exe
5092	proof of payment.exe
4644	proof of payment.exe
4644	proof of payment.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
4204	proof of payment.exe
4204	proof of payment.exe
4204	proof of payment.exe
4204	proof of payment.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4048	proof of payment.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	5092	proof of payment.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4204	proof of payment.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 1624	4048	proof of payment.exe	97
PID 4048 wrote to memory of 1624	4048	proof of payment.exe	97
PID 4048 wrote to memory of 1624	4048	proof of payment.exe	97
PID 4048 wrote to memory of 456	4048	proof of payment.exe	99
PID 4048 wrote to memory of 456	4048	proof of payment.exe	99
PID 4048 wrote to memory of 456	4048	proof of payment.exe	99
PID 4048 wrote to memory of 232	4048	proof of payment.exe	101
PID 4048 wrote to memory of 232	4048	proof of payment.exe	101
PID 4048 wrote to memory of 232	4048	proof of payment.exe	101
PID 4048 wrote to memory of 3192	4048	proof of payment.exe	102
PID 4048 wrote to memory of 3192	4048	proof of payment.exe	102
PID 4048 wrote to memory of 3192	4048	proof of payment.exe	102
PID 4048 wrote to memory of 1004	4048	proof of payment.exe	103
PID 4048 wrote to memory of 1004	4048	proof of payment.exe	103
PID 4048 wrote to memory of 1004	4048	proof of payment.exe	103
PID 4048 wrote to memory of 4204	4048	proof of payment.exe	104
PID 4048 wrote to memory of 4204	4048	proof of payment.exe	104
PID 4048 wrote to memory of 4204	4048	proof of payment.exe	104
PID 4048 wrote to memory of 4204	4048	proof of payment.exe	104
PID 4048 wrote to memory of 4204	4048	proof of payment.exe	104
PID 4048 wrote to memory of 4204	4048	proof of payment.exe	104
PID 4048 wrote to memory of 4204	4048	proof of payment.exe	104
PID 4048 wrote to memory of 4204	4048	proof of payment.exe	104
PID 4048 wrote to memory of 4204	4048	proof of payment.exe	104
PID 4048 wrote to memory of 4204	4048	proof of payment.exe	104
PID 4048 wrote to memory of 4204	4048	proof of payment.exe	104
PID 4048 wrote to memory of 4204	4048	proof of payment.exe	104
PID 4204 wrote to memory of 4644	4204	proof of payment.exe	108
PID 4204 wrote to memory of 4644	4204	proof of payment.exe	108
PID 4204 wrote to memory of 4644	4204	proof of payment.exe	108
PID 4204 wrote to memory of 4644	4204	proof of payment.exe	108
PID 4204 wrote to memory of 4736	4204	proof of payment.exe	109
PID 4204 wrote to memory of 4736	4204	proof of payment.exe	109
PID 4204 wrote to memory of 4736	4204	proof of payment.exe	109
PID 4204 wrote to memory of 1168	4204	proof of payment.exe	110
PID 4204 wrote to memory of 1168	4204	proof of payment.exe	110
PID 4204 wrote to memory of 1168	4204	proof of payment.exe	110
PID 4204 wrote to memory of 1168	4204	proof of payment.exe	110
PID 4204 wrote to memory of 5092	4204	proof of payment.exe	111
PID 4204 wrote to memory of 5092	4204	proof of payment.exe	111
PID 4204 wrote to memory of 5092	4204	proof of payment.exe	111
PID 4204 wrote to memory of 5092	4204	proof of payment.exe	111

C:\Users\Admin\AppData\Local\Temp\proof of payment.exe
"C:\Users\Admin\AppData\Local\Temp\proof of payment.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\NvbYSEq.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1624
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NvbYSEq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2546.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:456
- C:\Users\Admin\AppData\Local\Temp\proof of payment.exe
  "C:\Users\Admin\AppData\Local\Temp\proof of payment.exe"
  2⤵
  PID:232
- C:\Users\Admin\AppData\Local\Temp\proof of payment.exe
  "C:\Users\Admin\AppData\Local\Temp\proof of payment.exe"
  2⤵
  PID:3192
- C:\Users\Admin\AppData\Local\Temp\proof of payment.exe
  "C:\Users\Admin\AppData\Local\Temp\proof of payment.exe"
  2⤵
  PID:1004
- C:\Users\Admin\AppData\Local\Temp\proof of payment.exe
  "C:\Users\Admin\AppData\Local\Temp\proof of payment.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Users\Admin\AppData\Local\Temp\proof of payment.exe
    "C:\Users\Admin\AppData\Local\Temp\proof of payment.exe" /stext "C:\Users\Admin\AppData\Local\Temp\reaqpeihclm"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4644
- - C:\Users\Admin\AppData\Local\Temp\proof of payment.exe
    "C:\Users\Admin\AppData\Local\Temp\proof of payment.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tyfiqxtbqterexm"
    3⤵
    PID:4736
- - C:\Users\Admin\AppData\Local\Temp\proof of payment.exe
    "C:\Users\Admin\AppData\Local\Temp\proof of payment.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tyfiqxtbqterexm"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\proof of payment.exe
    "C:\Users\Admin\AppData\Local\Temp\proof of payment.exe" /stext "C:\Users\Admin\AppData\Local\Temp\dbtbrhddebwvhdiumg"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3768 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 333fef104bbd71fc57c972a47f37e95a1c7fad31a598e3d5e37870b0076a9833
MD5 7d8a1e8f4145904df3735af090fa5689
SHA1 56fb1be2547a7e0804f56c49665113d42928fb84
SHA512 e68bbf4a731b10eb15816c7582f024c8e7fc63112de079971c973fc921d8ebc9477230c921d7bcd464c6f77472ac2b28abfc784bd60bbb2847185426964a9860
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_hqrjkgl3.5po.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hqrjkgl3.5po.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

reaqpeihclm

Path C:\Users\Admin\AppData\Local\Temp\reaqpeihclm
Size 4KB
SHA256 7176ca3d0196ec46f178107fdb587adaef3f6ea65daa80eccd2371a515880e04
MD5 10fa8ec140c204486092fb161e567ec7
SHA1 4d63e1f8df3afefedb19df73d7ee5f3b1e7b6473
SHA512 9db4eeb3f07d8d0579f75f3426c91156809152d8c1a37c9a27bf159888f6dd97f1212ac80f5bbb17e4d86f3087c512ccba2ca50a2db07d071370bd36364e1f76
SSDEEP 48:wvvv05xfvvc5xfdvv05xBvv05xakvv057:mvAxvYp1vAPvAbvA7
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp2546.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp2546.tmp
Size 1KB
SHA256 7cfaeaaf2aded86a0e01be6419b1f6d06f2227cc26203ba128f6a2080140e76d
MD5 a4941ab0ccbef83e4e5677d4f48a738a
SHA1 8efebe485d302f7ff2f6745a5bc0587b76d36701
SHA512 839970a3c75e11f07aa467486761ded770e5013abd64b6db505841bb88dcf25f2e3ebf29e8e043ee3a181cbe5392dc810647eb5a1ffcfd00b2866723b69246ec
MD5 SHA1 SHA512

Submit Download

memory/1168-97-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1168-94-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1168-91-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/1624-87-0x00000000744E0000-0x0000000074C90000-memory.dmp

Download

memory/1624-47-0x0000000005D30000-0x0000000005D7C000-memory.dmp

Download

memory/1624-83-0x0000000007330000-0x0000000007338000-memory.dmp

Download

memory/1624-82-0x0000000007350000-0x000000000736A000-memory.dmp

Download

memory/1624-81-0x0000000007250000-0x0000000007264000-memory.dmp

Download

memory/1624-16-0x00000000744E0000-0x0000000074C90000-memory.dmp

Download

memory/1624-17-0x0000000002400000-0x0000000002436000-memory.dmp

Download

memory/1624-18-0x00000000744E0000-0x0000000074C90000-memory.dmp

Download

memory/1624-67-0x0000000006F00000-0x0000000006FA3000-memory.dmp

Download

memory/1624-20-0x0000000004DC0000-0x00000000053E8000-memory.dmp

Download

memory/1624-80-0x0000000007240000-0x000000000724E000-memory.dmp

Download

memory/1624-77-0x0000000007210000-0x0000000007221000-memory.dmp

Download

memory/1624-76-0x0000000007290000-0x0000000007326000-memory.dmp

Download

memory/1624-74-0x0000000007080000-0x000000000708A000-memory.dmp

Download

memory/1624-68-0x0000000007670000-0x0000000007CEA000-memory.dmp

Download

memory/1624-27-0x0000000005430000-0x0000000005452000-memory.dmp

Download

memory/1624-19-0x00000000744E0000-0x0000000074C90000-memory.dmp

Download

memory/1624-29-0x00000000055D0000-0x0000000005636000-memory.dmp

Download

memory/1624-30-0x00000000056B0000-0x0000000005716000-memory.dmp

Download

memory/1624-66-0x0000000006290000-0x00000000062AE000-memory.dmp

Download

memory/1624-56-0x0000000070CA0000-0x0000000070CEC000-memory.dmp

Download

memory/1624-55-0x00000000062D0000-0x0000000006302000-memory.dmp

Download

memory/1624-69-0x0000000006340000-0x000000000635A000-memory.dmp

Download

memory/1624-45-0x0000000005720000-0x0000000005A74000-memory.dmp

Download

memory/1624-46-0x0000000004A40000-0x0000000004A5E000-memory.dmp

Download

memory/4048-7-0x00000000064D0000-0x00000000064DE000-memory.dmp

Download

memory/4048-1-0x00000000003F0000-0x00000000004D8000-memory.dmp

Download

memory/4048-2-0x00000000053B0000-0x0000000005954000-memory.dmp

Download

memory/4048-3-0x0000000004EA0000-0x0000000004F32000-memory.dmp

Download

memory/4048-4-0x00000000744E0000-0x0000000074C90000-memory.dmp

Download

memory/4048-5-0x0000000005030000-0x000000000503A000-memory.dmp

Download

memory/4048-0-0x00000000744EE000-0x00000000744EF000-memory.dmp

Download

memory/4048-10-0x0000000008C90000-0x0000000008D2C000-memory.dmp

Download

memory/4048-6-0x0000000005160000-0x0000000005178000-memory.dmp

Download

memory/4048-9-0x0000000006560000-0x0000000006620000-memory.dmp

Download

memory/4048-15-0x00000000744EE000-0x00000000744EF000-memory.dmp

Download

memory/4048-8-0x00000000064E0000-0x00000000064F6000-memory.dmp

Download

memory/4048-26-0x00000000744E0000-0x0000000074C90000-memory.dmp

Download

memory/4204-28-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4204-51-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4204-22-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4204-23-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4204-78-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4204-79-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4204-25-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4204-71-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4204-84-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4204-31-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4204-34-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4204-40-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4204-53-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4204-138-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4204-52-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4204-137-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4204-130-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4204-73-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4204-129-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4204-50-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4204-122-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4204-121-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4204-49-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4204-110-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/4204-114-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/4204-113-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/4204-115-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4204-117-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4644-98-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4644-92-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4644-90-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/5092-96-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5092-95-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5092-93-0x0000000000400000-0x0000000000424000-memory.dmp

Download