remcos | 80edcbb7fe7717412d44ce9de1c35f8ff32a904668780ceda77578068b6c2d1f

Analysis

max time kernel
147s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 13:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New PO for Project - 00775 00875 02195.exe
Size 69KB
Sample240604-q3x5taaa36
SHA256 80edcbb7fe7717412d44ce9de1c35f8ff32a904668780ceda77578068b6c2d1f
MD5 a86be739b88c4383313d081143ee51d9
SHA1 6f5b145c0a226a71cec35a289659d23b3287f1e0
SHA512 9faf75defe55c3a4b4701c42a0e84a5e9a90a2e795b4bd62091bc99d88840798bcbd4e30978c517294ed39e65b5b0eaf29a0c30fd0136a08b6040f86bdd4dc16
SSDEEP 768:0SUfM9liEg5hJL+wrjescWIvBgggGZO7/lG9lbIkwBiBue6Jg3JDBrecyCBBAlrb:lliEg5hJLtrVcOxGKKf6q6lrrN+3bY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos host persistence rat

Malware Config

Extracted

Family

remcos

Botnet

host

144.208.127.241:1717

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-UZH3LZ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\New PO for Project - 00775 00875 02195 = "C:\\Users\\Admin\\Documents\\New PO for Project - 00775 00875 02195.pif"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3640 set thread context of 4080	3640	New PO for Project - 00775 00875 02195.exe	100

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe
3640	New PO for Project - 00775 00875 02195.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3640	New PO for Project - 00775 00875 02195.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4080	New PO for Project - 00775 00875 02195.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 4864	3640	New PO for Project - 00775 00875 02195.exe	89
PID 3640 wrote to memory of 4864	3640	New PO for Project - 00775 00875 02195.exe	89
PID 3640 wrote to memory of 4864	3640	New PO for Project - 00775 00875 02195.exe	89
PID 4864 wrote to memory of 2080	4864	cmd.exe	91
PID 4864 wrote to memory of 2080	4864	cmd.exe	91
PID 4864 wrote to memory of 2080	4864	cmd.exe	91
PID 3640 wrote to memory of 1800	3640	New PO for Project - 00775 00875 02195.exe	97
PID 3640 wrote to memory of 1800	3640	New PO for Project - 00775 00875 02195.exe	97
PID 3640 wrote to memory of 1800	3640	New PO for Project - 00775 00875 02195.exe	97
PID 3640 wrote to memory of 3812	3640	New PO for Project - 00775 00875 02195.exe	99
PID 3640 wrote to memory of 3812	3640	New PO for Project - 00775 00875 02195.exe	99
PID 3640 wrote to memory of 3812	3640	New PO for Project - 00775 00875 02195.exe	99
PID 3640 wrote to memory of 4080	3640	New PO for Project - 00775 00875 02195.exe	100
PID 3640 wrote to memory of 4080	3640	New PO for Project - 00775 00875 02195.exe	100
PID 3640 wrote to memory of 4080	3640	New PO for Project - 00775 00875 02195.exe	100
PID 3640 wrote to memory of 4080	3640	New PO for Project - 00775 00875 02195.exe	100
PID 3640 wrote to memory of 4080	3640	New PO for Project - 00775 00875 02195.exe	100
PID 3640 wrote to memory of 4080	3640	New PO for Project - 00775 00875 02195.exe	100
PID 3640 wrote to memory of 4080	3640	New PO for Project - 00775 00875 02195.exe	100
PID 3640 wrote to memory of 4080	3640	New PO for Project - 00775 00875 02195.exe	100
PID 3640 wrote to memory of 4080	3640	New PO for Project - 00775 00875 02195.exe	100
PID 3640 wrote to memory of 4080	3640	New PO for Project - 00775 00875 02195.exe	100
PID 3640 wrote to memory of 4080	3640	New PO for Project - 00775 00875 02195.exe	100
PID 3640 wrote to memory of 4080	3640	New PO for Project - 00775 00875 02195.exe	100

C:\Users\Admin\AppData\Local\Temp\New PO for Project - 00775 00875 02195.exe
"C:\Users\Admin\AppData\Local\Temp\New PO for Project - 00775 00875 02195.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO for Project - 00775 00875 02195" /t REG_SZ /F /D "C:\Users\Admin\Documents\New PO for Project - 00775 00875 02195.pif"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "New PO for Project - 00775 00875 02195" /t REG_SZ /F /D "C:\Users\Admin\Documents\New PO for Project - 00775 00875 02195.pif"
    3⤵
    - Adds Run key to start application
    PID:2080
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Copy "C:\Users\Admin\AppData\Local\Temp\New PO for Project - 00775 00875 02195.exe" "C:\Users\Admin\Documents\New PO for Project - 00775 00875 02195.pif"
  2⤵
  PID:1800
- C:\Users\Admin\AppData\Local\Temp\New PO for Project - 00775 00875 02195.exe
  "C:\Users\Admin\AppData\Local\Temp\New PO for Project - 00775 00875 02195.exe"
  2⤵
  PID:3812
- C:\Users\Admin\AppData\Local\Temp\New PO for Project - 00775 00875 02195.exe
  "C:\Users\Admin\AppData\Local\Temp\New PO for Project - 00775 00875 02195.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 19238945ad07aba26bc716cb38aebdc1cd80f54656928d634dc8536139d02f6f
MD5 382da61a8cf95f231887e8f14db31dc1
SHA1 1fc8579f424aecf321508be0fa2c66a210f6d791
SHA512 97ff59923a2be0878586b42a1250c4e341278d49679f4759711d631981031bf84e4eacb5d268d5c814093be471bbd5de54dcbd19ae08603824c4b247bef37441
MD5 SHA1 SHA512

Submit Download

memory/3640-6-0x0000000008D10000-0x0000000008DA8000-memory.dmp

Download

memory/3640-2-0x0000000005DD0000-0x0000000006374000-memory.dmp

Download

memory/3640-3-0x0000000005720000-0x00000000057B2000-memory.dmp

Download

memory/3640-4-0x00000000057D0000-0x00000000057DA000-memory.dmp

Download

memory/3640-5-0x0000000074670000-0x0000000074E20000-memory.dmp

Download

memory/3640-20-0x0000000005890000-0x00000000058A0000-memory.dmp

Download

memory/3640-7-0x0000000008F50000-0x0000000008FEC000-memory.dmp

Download

memory/3640-8-0x0000000008FF0000-0x0000000009056000-memory.dmp

Download

memory/3640-0-0x000000007467E000-0x000000007467F000-memory.dmp

Download

memory/3640-1-0x0000000000D30000-0x0000000000D46000-memory.dmp

Download

memory/3640-35-0x0000000005890000-0x00000000058A0000-memory.dmp

Download

memory/3640-31-0x0000000074670000-0x0000000074E20000-memory.dmp

Download

memory/3640-30-0x000000007467E000-0x000000007467F000-memory.dmp

Download

memory/4080-11-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4080-34-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4080-17-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4080-21-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4080-22-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4080-23-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4080-25-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4080-27-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4080-26-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4080-18-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4080-19-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4080-14-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4080-13-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4080-12-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4080-38-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4080-39-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4080-46-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4080-47-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4080-54-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4080-55-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4080-62-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4080-63-0x0000000000400000-0x0000000000482000-memory.dmp

Download