Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 19:23
Static task
static1
Behavioral task
behavioral1
Sample
062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe
Resource
win10v2004-20240508-en
General
-
Target
062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe
-
Size
975KB
-
MD5
6bc3017aa0b572802c23e8fad4c7a612
-
SHA1
262fb0d7951854d4ba58ad2a38480fb0bbe4f6d1
-
SHA256
062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5
-
SHA512
86c6dd6d2786d01990d86b4b69d624aa373f441e4b25f6730071a5336eb32939874e8c9dd445330dfa33a5598c23c7427b6a741ecdc178678507fcab0a1b1354
-
SSDEEP
24576:8LZq8lDaXLp5C7UMUoloIG8h3IP8trNwNoZ:8oUDaXLnC7Ia68FCO
Malware Config
Extracted
remcos
RemoteHost
46.183.223.69:13452
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-UJROWN
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe -
Executes dropped EXE 3 IoCs
Processes:
remcos.exeremcos.exeremcos.exepid process 4272 remcos.exe 2752 remcos.exe 3768 remcos.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exeremcos.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-UJROWN = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-UJROWN = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-UJROWN = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" remcos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-UJROWN = "\"C:\\ProgramData\\Remcos\\remcos.exe\"" remcos.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exeremcos.exedescription pid process target process PID 4820 set thread context of 5072 4820 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 4272 set thread context of 3768 4272 remcos.exe remcos.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
remcos.exepid process 4272 remcos.exe 4272 remcos.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
remcos.exedescription pid process Token: SeDebugPrivilege 4272 remcos.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
remcos.exepid process 3768 remcos.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exeremcos.exedescription pid process target process PID 4820 wrote to memory of 5072 4820 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 4820 wrote to memory of 5072 4820 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 4820 wrote to memory of 5072 4820 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 4820 wrote to memory of 5072 4820 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 4820 wrote to memory of 5072 4820 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 4820 wrote to memory of 5072 4820 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 4820 wrote to memory of 5072 4820 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 4820 wrote to memory of 5072 4820 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 4820 wrote to memory of 5072 4820 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 4820 wrote to memory of 5072 4820 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 4820 wrote to memory of 5072 4820 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 4820 wrote to memory of 5072 4820 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe PID 5072 wrote to memory of 4272 5072 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe remcos.exe PID 5072 wrote to memory of 4272 5072 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe remcos.exe PID 5072 wrote to memory of 4272 5072 062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe remcos.exe PID 4272 wrote to memory of 2752 4272 remcos.exe remcos.exe PID 4272 wrote to memory of 2752 4272 remcos.exe remcos.exe PID 4272 wrote to memory of 2752 4272 remcos.exe remcos.exe PID 4272 wrote to memory of 3768 4272 remcos.exe remcos.exe PID 4272 wrote to memory of 3768 4272 remcos.exe remcos.exe PID 4272 wrote to memory of 3768 4272 remcos.exe remcos.exe PID 4272 wrote to memory of 3768 4272 remcos.exe remcos.exe PID 4272 wrote to memory of 3768 4272 remcos.exe remcos.exe PID 4272 wrote to memory of 3768 4272 remcos.exe remcos.exe PID 4272 wrote to memory of 3768 4272 remcos.exe remcos.exe PID 4272 wrote to memory of 3768 4272 remcos.exe remcos.exe PID 4272 wrote to memory of 3768 4272 remcos.exe remcos.exe PID 4272 wrote to memory of 3768 4272 remcos.exe remcos.exe PID 4272 wrote to memory of 3768 4272 remcos.exe remcos.exe PID 4272 wrote to memory of 3768 4272 remcos.exe remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe"C:\Users\Admin\AppData\Local\Temp\062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe"C:\Users\Admin\AppData\Local\Temp\062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Remcos\remcos.exe"C:\ProgramData\Remcos\remcos.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Remcos\remcos.exe"C:\ProgramData\Remcos\remcos.exe"4⤵
- Executes dropped EXE
-
C:\ProgramData\Remcos\remcos.exe"C:\ProgramData\Remcos\remcos.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Remcos\logs.datFilesize
144B
MD5daab2a43008f16c49048e5c6319ef5d0
SHA11baaced228b03e0b976fed98fb11b5dbbb78a0e1
SHA25628d90c39bc8b678a6641bf15d33aba8c9cb8b0513c34a77ba787729e7f4ce047
SHA512abe4c28a155d8a326865cdecde581a08cdb6d5996ce9620f33e23bcf2e2388cb531b1de287591d5e93a990a69261b3031b4548e36eb4cf4d02037a596aaa434f
-
C:\ProgramData\Remcos\remcos.exeFilesize
975KB
MD56bc3017aa0b572802c23e8fad4c7a612
SHA1262fb0d7951854d4ba58ad2a38480fb0bbe4f6d1
SHA256062a2cab613158f0f8ed1d090763270e7956407350767e47822828f076193cf5
SHA51286c6dd6d2786d01990d86b4b69d624aa373f441e4b25f6730071a5336eb32939874e8c9dd445330dfa33a5598c23c7427b6a741ecdc178678507fcab0a1b1354
-
memory/3768-53-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3768-73-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3768-66-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3768-61-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3768-59-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3768-54-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3768-72-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3768-67-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3768-48-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3768-47-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3768-37-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3768-41-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3768-40-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/3768-36-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/4272-29-0x0000000073B6E000-0x0000000073B6F000-memory.dmpFilesize
4KB
-
memory/4272-31-0x0000000073B60000-0x0000000074310000-memory.dmpFilesize
7.7MB
-
memory/4272-42-0x0000000073B60000-0x0000000074310000-memory.dmpFilesize
7.7MB
-
memory/4820-5-0x0000000074A10000-0x00000000751C0000-memory.dmpFilesize
7.7MB
-
memory/4820-9-0x00000000044E0000-0x00000000044F0000-memory.dmpFilesize
64KB
-
memory/4820-1-0x00000000000C0000-0x00000000001BA000-memory.dmpFilesize
1000KB
-
memory/4820-2-0x0000000005170000-0x0000000005714000-memory.dmpFilesize
5.6MB
-
memory/4820-3-0x0000000004AD0000-0x0000000004B62000-memory.dmpFilesize
584KB
-
memory/4820-0-0x0000000074A1E000-0x0000000074A1F000-memory.dmpFilesize
4KB
-
memory/4820-4-0x0000000004A70000-0x0000000004A7A000-memory.dmpFilesize
40KB
-
memory/4820-11-0x0000000007870000-0x000000000790C000-memory.dmpFilesize
624KB
-
memory/4820-10-0x0000000007710000-0x00000000077D0000-memory.dmpFilesize
768KB
-
memory/4820-17-0x0000000074A10000-0x00000000751C0000-memory.dmpFilesize
7.7MB
-
memory/4820-8-0x0000000004D00000-0x0000000004D0C000-memory.dmpFilesize
48KB
-
memory/4820-7-0x0000000004D40000-0x0000000004D62000-memory.dmpFilesize
136KB
-
memory/4820-6-0x0000000005D90000-0x0000000005E8A000-memory.dmpFilesize
1000KB
-
memory/5072-30-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/5072-12-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/5072-13-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/5072-15-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB
-
memory/5072-16-0x0000000000400000-0x0000000000482000-memory.dmpFilesize
520KB