remcos | 9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d.exe
Size 956KB
Sample240604-b4pgqsgh8v
SHA256 9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d
MD5 1729c7a8fa433e28bd4de61cc5317840
SHA1 4e93e38d13481d6bd2439613630976409b67983a
SHA512 6ab82b774b6b2b98edc7cdadb5eeb7c036756b70b28e532c688c49f27ba6982df819baf9be6978bf6c185e1ac267246a607f9c78ecbfd8ac71a8310b3d1a698b
SSDEEP 24576:LYHcfTz0jfyoKtfHdYUIscI0/TvsgUDO/C:Ukn0jfqHdYT0gUi/C
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

hostage345.duckdns.org:18670

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-7GSJ7O
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 21 IoCs

resource	yara_rule
behavioral2/memory/4764-11-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4764-12-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4764-14-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4764-16-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/4764-27-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1300-34-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1300-36-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1300-37-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1300-40-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1300-39-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1300-41-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1300-46-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1300-47-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1300-52-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1300-53-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1300-59-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1300-60-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1300-65-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1300-66-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1300-71-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral2/memory/1300-73-0x0000000000400000-0x0000000000482000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d.exe

Executes dropped EXE 2 IoCs

pid	Process
1988	remcos.exe
1300	remcos.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-7GSJ7O = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-7GSJ7O = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-7GSJ7O = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-7GSJ7O = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3336 set thread context of 4764	3336	9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d.exe	92
PID 1988 set thread context of 1300	1988	remcos.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1300	remcos.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1300	remcos.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1300	remcos.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 4764	3336	9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d.exe	92
PID 3336 wrote to memory of 4764	3336	9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d.exe	92
PID 3336 wrote to memory of 4764	3336	9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d.exe	92
PID 3336 wrote to memory of 4764	3336	9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d.exe	92
PID 3336 wrote to memory of 4764	3336	9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d.exe	92
PID 3336 wrote to memory of 4764	3336	9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d.exe	92
PID 3336 wrote to memory of 4764	3336	9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d.exe	92
PID 3336 wrote to memory of 4764	3336	9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d.exe	92
PID 3336 wrote to memory of 4764	3336	9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d.exe	92
PID 3336 wrote to memory of 4764	3336	9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d.exe	92
PID 3336 wrote to memory of 4764	3336	9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d.exe	92
PID 3336 wrote to memory of 4764	3336	9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d.exe	92
PID 4764 wrote to memory of 1988	4764	9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d.exe	93
PID 4764 wrote to memory of 1988	4764	9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d.exe	93
PID 4764 wrote to memory of 1988	4764	9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d.exe	93
PID 1988 wrote to memory of 1300	1988	remcos.exe	94
PID 1988 wrote to memory of 1300	1988	remcos.exe	94
PID 1988 wrote to memory of 1300	1988	remcos.exe	94
PID 1988 wrote to memory of 1300	1988	remcos.exe	94
PID 1988 wrote to memory of 1300	1988	remcos.exe	94
PID 1988 wrote to memory of 1300	1988	remcos.exe	94
PID 1988 wrote to memory of 1300	1988	remcos.exe	94
PID 1988 wrote to memory of 1300	1988	remcos.exe	94
PID 1988 wrote to memory of 1300	1988	remcos.exe	94
PID 1988 wrote to memory of 1300	1988	remcos.exe	94
PID 1988 wrote to memory of 1300	1988	remcos.exe	94
PID 1988 wrote to memory of 1300	1988	remcos.exe	94

C:\Users\Admin\AppData\Local\Temp\9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d.exe
"C:\Users\Admin\AppData\Local\Temp\9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Users\Admin\AppData\Local\Temp\9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d.exe
  "C:\Users\Admin\AppData\Local\Temp\9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\ProgramData\Remcos\remcos.exe
    "C:\ProgramData\Remcos\remcos.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1988
  - - C:\ProgramData\Remcos\remcos.exe
      "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:1300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\Remcos\logs.dat
Size 178B
SHA256 fab21e8043c522076a19dd6c6111f05839c94d8539fa3e87d63b3ca39c2f17b9
MD5 e9b4de378f1ed18da1e97b434b626d82
SHA1 52b0ec1eb439bf529385d813c7bf400c6d78b488
SHA512 9e0e1f8fba4a7d8764649fec675de60079a2187b3fcd8dfc90da263a581d6c89a1ff81d0929be2438f91a974d5448ecd3da12072cf164e1c78257855f398ea72
MD5 SHA1 SHA512

Submit Download

remcos.exe

Path C:\ProgramData\Remcos\remcos.exe
Size 956KB
SHA256 9962c1342cb0ac4e1af01df52f756b70992a0ced5a53e46f770a196033f3762d
MD5 1729c7a8fa433e28bd4de61cc5317840
SHA1 4e93e38d13481d6bd2439613630976409b67983a
SHA512 6ab82b774b6b2b98edc7cdadb5eeb7c036756b70b28e532c688c49f27ba6982df819baf9be6978bf6c185e1ac267246a607f9c78ecbfd8ac71a8310b3d1a698b
SSDEEP 24576:LYHcfTz0jfyoKtfHdYUIscI0/TvsgUDO/C:Ukn0jfqHdYT0gUi/C
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1300-52-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1300-71-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1300-65-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1300-60-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1300-59-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1300-53-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1300-34-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1300-66-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1300-47-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1300-46-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1300-41-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1300-39-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1300-40-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1300-37-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1300-73-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1300-36-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/1988-29-0x0000000074D7E000-0x0000000074D7F000-memory.dmp

Download

memory/1988-35-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/1988-30-0x0000000074D70000-0x0000000075520000-memory.dmp

Download

memory/3336-7-0x0000000006720000-0x000000000672C000-memory.dmp

Download

memory/3336-4-0x0000000005610000-0x000000000561A000-memory.dmp

Download

memory/3336-17-0x00000000753B0000-0x0000000075B60000-memory.dmp

Download

memory/3336-1-0x0000000000A60000-0x0000000000B56000-memory.dmp

Download

memory/3336-2-0x0000000005A60000-0x0000000006004000-memory.dmp

Download

memory/3336-3-0x0000000005550000-0x00000000055E2000-memory.dmp

Download

memory/3336-5-0x00000000753B0000-0x0000000075B60000-memory.dmp

Download

memory/3336-10-0x0000000007E10000-0x0000000007EAC000-memory.dmp

Download

memory/3336-9-0x00000000067A0000-0x0000000006860000-memory.dmp

Download

memory/3336-8-0x0000000006740000-0x0000000006750000-memory.dmp

Download

memory/3336-0-0x00000000753BE000-0x00000000753BF000-memory.dmp

Download

memory/3336-6-0x0000000007E00000-0x0000000007E16000-memory.dmp

Download

memory/4764-11-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4764-27-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4764-12-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4764-14-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4764-16-0x0000000000400000-0x0000000000482000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads