remcos | 9de8ed444c79048256d8bee246194210ce13da0cd9fd6233bbf49b3c38da9c85

Analysis

max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9de8ed444c79048256d8bee246194210ce13da0cd9fd6233bbf49b3c38da9c85.exe
Size 1.1MB
Sample240523-rr3ftseb9t
SHA256 9de8ed444c79048256d8bee246194210ce13da0cd9fd6233bbf49b3c38da9c85
MD5 3d63053839cc9d424e02fd767ec10780
SHA1 772bcd8e513d5bd36f5391e35e64b1fe529d2a23
SHA512 9ac0b979217e14d5b94c83f5b610beef3c1a1741dd3ae201627a9011451eae87ac348458b7df9421acaf03ba16dd2dc18d705e5661d990c06a4b0edbc5811d5a
SSDEEP 24576:b6G5oq6WlY5EQJbBCt598PkfzGwWPEXyqw:bPQrJChIP1q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost collection persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

107.175.229.139:8087

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-TLPQMO
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/208-26-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4692-25-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral2/memory/208-26-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/4692-25-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/2756-32-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	colorcpl.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pzuhzgxz = "C:\\Users\\Public\\Pzuhzgxz.url"	9de8ed444c79048256d8bee246194210ce13da0cd9fd6233bbf49b3c38da9c85.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4400 set thread context of 4692	4400	colorcpl.exe	96
PID 4400 set thread context of 208	4400	colorcpl.exe	97
PID 4400 set thread context of 2756	4400	colorcpl.exe	98

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	36	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	37	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3180	9de8ed444c79048256d8bee246194210ce13da0cd9fd6233bbf49b3c38da9c85.exe
3180	9de8ed444c79048256d8bee246194210ce13da0cd9fd6233bbf49b3c38da9c85.exe
4692	colorcpl.exe
4692	colorcpl.exe
2756	colorcpl.exe
2756	colorcpl.exe
4692	colorcpl.exe
4692	colorcpl.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
4400	colorcpl.exe
4400	colorcpl.exe
4400	colorcpl.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2756	colorcpl.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 3148	3180	9de8ed444c79048256d8bee246194210ce13da0cd9fd6233bbf49b3c38da9c85.exe	94
PID 3180 wrote to memory of 3148	3180	9de8ed444c79048256d8bee246194210ce13da0cd9fd6233bbf49b3c38da9c85.exe	94
PID 3180 wrote to memory of 3148	3180	9de8ed444c79048256d8bee246194210ce13da0cd9fd6233bbf49b3c38da9c85.exe	94
PID 3180 wrote to memory of 4400	3180	9de8ed444c79048256d8bee246194210ce13da0cd9fd6233bbf49b3c38da9c85.exe	95
PID 3180 wrote to memory of 4400	3180	9de8ed444c79048256d8bee246194210ce13da0cd9fd6233bbf49b3c38da9c85.exe	95
PID 3180 wrote to memory of 4400	3180	9de8ed444c79048256d8bee246194210ce13da0cd9fd6233bbf49b3c38da9c85.exe	95
PID 3180 wrote to memory of 4400	3180	9de8ed444c79048256d8bee246194210ce13da0cd9fd6233bbf49b3c38da9c85.exe	95
PID 4400 wrote to memory of 4692	4400	colorcpl.exe	96
PID 4400 wrote to memory of 4692	4400	colorcpl.exe	96
PID 4400 wrote to memory of 4692	4400	colorcpl.exe	96
PID 4400 wrote to memory of 4692	4400	colorcpl.exe	96
PID 4400 wrote to memory of 208	4400	colorcpl.exe	97
PID 4400 wrote to memory of 208	4400	colorcpl.exe	97
PID 4400 wrote to memory of 208	4400	colorcpl.exe	97
PID 4400 wrote to memory of 208	4400	colorcpl.exe	97
PID 4400 wrote to memory of 2756	4400	colorcpl.exe	98
PID 4400 wrote to memory of 2756	4400	colorcpl.exe	98
PID 4400 wrote to memory of 2756	4400	colorcpl.exe	98
PID 4400 wrote to memory of 2756	4400	colorcpl.exe	98

C:\Users\Admin\AppData\Local\Temp\9de8ed444c79048256d8bee246194210ce13da0cd9fd6233bbf49b3c38da9c85.exe
"C:\Users\Admin\AppData\Local\Temp\9de8ed444c79048256d8bee246194210ce13da0cd9fd6233bbf49b3c38da9c85.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\SysWOW64\extrac32.exe
  C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\Admin\AppData\Local\Temp\9de8ed444c79048256d8bee246194210ce13da0cd9fd6233bbf49b3c38da9c85.exe C:\\Users\\Public\\Libraries\\Pzuhzgxz.PIF
  2⤵
  PID:3148
- C:\Windows\SysWOW64\colorcpl.exe
  C:\Windows\System32\colorcpl.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Windows\SysWOW64\colorcpl.exe
    C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\owajtiohyaqjxlmzkctitxneiff"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4692
- - C:\Windows\SysWOW64\colorcpl.exe
    C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\yqnctbziuiiohradbngbwkanruplyj"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:208
- - C:\Windows\SysWOW64\colorcpl.exe
    C:\Windows\SysWOW64\colorcpl.exe /stext "C:\Users\Admin\AppData\Local\Temp\jstuutjciraajgwhkxtdhovesahuzuocv"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 146B
SHA256 7f5e106ed5b3c61ce0cf7070e60cf9cd496907a14e27438c5a26326c0245b392
MD5 37321a5c41dac573bc1c89de1c02a400
SHA1 b2f5018f34ad61e967e6b83ad34f94a632ba10dd
SHA512 61b28192030c7059d685456c7efd4f86bc0d1f8c2f57e68ec905e6a9c73f9c34433d5db6c1ee6d28ec04b622380142090cd1e9c93f052440af1a1ee28e8c4aff
MD5 SHA1 SHA512

Submit Download

owajtiohyaqjxlmzkctitxneiff

Path C:\Users\Admin\AppData\Local\Temp\owajtiohyaqjxlmzkctitxneiff
Size 4KB
SHA256 d3a2b4e44262cfbfb97652de5f54b36bfc525396d1d70dea03ab24c902dab8ef
MD5 a13985d129d8bf808cec12f9fe7b4ed3
SHA1 3981490aa1ce9401c4470f0277fda627d9236356
SHA512 5c990ca4e978b874e0863ad4bf1ccbe04499960d5c17fb16776297d22db5f168aa3a5a9863ec5a9f8286dda2f9fd96852f2dc2ef029c13ba659e33694c344887
SSDEEP 48:wvvv0axfvvcaxfdvv0axBvv0axakvv0a7:mv/xv3p1v/Pv/bv/7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/208-26-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/208-22-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/208-24-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2756-32-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2756-27-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2756-29-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3180-1-0x0000000000400000-0x000000000051D000-memory.dmp

Download

memory/3180-0-0x0000000002300000-0x0000000002301000-memory.dmp

Download

memory/4400-38-0x00000000166D0000-0x00000000166E9000-memory.dmp

Download

memory/4400-44-0x00000000162E0000-0x0000000016362000-memory.dmp

Download

memory/4400-69-0x00000000162E0000-0x0000000016362000-memory.dmp

Download

memory/4400-18-0x00000000162E0000-0x0000000016362000-memory.dmp

Download

memory/4400-17-0x00000000162E0000-0x0000000016362000-memory.dmp

Download

memory/4400-16-0x00000000162E0000-0x0000000016362000-memory.dmp

Download

memory/4400-62-0x00000000162E0000-0x0000000016362000-memory.dmp

Download

memory/4400-15-0x00000000162E0000-0x0000000016362000-memory.dmp

Download

memory/4400-11-0x00000000162E0000-0x0000000016362000-memory.dmp

Download

memory/4400-61-0x00000000162E0000-0x0000000016362000-memory.dmp

Download

memory/4400-14-0x00000000162E0000-0x0000000016362000-memory.dmp

Download

memory/4400-6-0x00000000044C0000-0x00000000054C0000-memory.dmp

Download

memory/4400-35-0x00000000166D0000-0x00000000166E9000-memory.dmp

Download

memory/4400-39-0x00000000166D0000-0x00000000166E9000-memory.dmp

Download

memory/4400-12-0x00000000162E0000-0x0000000016362000-memory.dmp

Download

memory/4400-40-0x00000000162E0000-0x0000000016362000-memory.dmp

Download

memory/4400-20-0x00000000162E0000-0x0000000016362000-memory.dmp

Download

memory/4400-45-0x00000000162E0000-0x0000000016362000-memory.dmp

Download

memory/4400-47-0x00000000162E0000-0x0000000016362000-memory.dmp

Download

memory/4400-8-0x00000000162E0000-0x0000000016362000-memory.dmp

Download

memory/4400-53-0x00000000162E0000-0x0000000016362000-memory.dmp

Download

memory/4692-21-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4692-25-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4692-23-0x0000000000400000-0x0000000000478000-memory.dmp

Download