remcos | 29d902ba17d8bd84b1c395c525761706761caf55825046dbb848406689c10c67

Analysis

max time kernel
94s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
18/06/2024, 19:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
29d902ba17d8bd84b1c395c525761706761caf55825046dbb848406689c10c67.exe
Size 1.6MB
Sample240618-ygzerazbmp
SHA256 29d902ba17d8bd84b1c395c525761706761caf55825046dbb848406689c10c67
MD5 f38093a70e17308a896fe3504b5a02a0
SHA1 d0aa15a6f3664a6dab891b7d5f29e5841df03a4b
SHA512 fbe96ad6688a11c2b1b50977562b668a7f1df15ae0f08fbfea1cc393fdeaf080ba32398418f5377b4948bf7f49f18845e8c7ee041b53ea596530d0198df666af
SSDEEP 24576:/D39v74lfGQrFUspugRNJI2DJ53J/J/L5dJPj8/jc:/p7E+QrFUBgq2h
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos host persistence rat

Malware Config

Extracted

Family

remcos

Botnet

Host

213.183.58.19:4000

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
read.dat
keylog_flag
false
keylog_folder
CastC
keylog_path
%AppData%
mouse_option
false
mutex
remcos_sccafsoidz
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	29d902ba17d8bd84b1c395c525761706761caf55825046dbb848406689c10c67.exe

Executes dropped EXE 2 IoCs

pid	Process
2640	sbietrcl.exe
1884	sbietrcl.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\sbietrcl.exe"	29d902ba17d8bd84b1c395c525761706761caf55825046dbb848406689c10c67.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2640 set thread context of 1884	2640	sbietrcl.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4920	29d902ba17d8bd84b1c395c525761706761caf55825046dbb848406689c10c67.exe
4920	29d902ba17d8bd84b1c395c525761706761caf55825046dbb848406689c10c67.exe
4920	29d902ba17d8bd84b1c395c525761706761caf55825046dbb848406689c10c67.exe
4920	29d902ba17d8bd84b1c395c525761706761caf55825046dbb848406689c10c67.exe
4920	29d902ba17d8bd84b1c395c525761706761caf55825046dbb848406689c10c67.exe
4920	29d902ba17d8bd84b1c395c525761706761caf55825046dbb848406689c10c67.exe
2640	sbietrcl.exe
2640	sbietrcl.exe
2640	sbietrcl.exe
2640	sbietrcl.exe
2640	sbietrcl.exe
2640	sbietrcl.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4920	29d902ba17d8bd84b1c395c525761706761caf55825046dbb848406689c10c67.exe
Token: SeDebugPrivilege	2640	sbietrcl.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4920 wrote to memory of 2640	4920	29d902ba17d8bd84b1c395c525761706761caf55825046dbb848406689c10c67.exe	91
PID 4920 wrote to memory of 2640	4920	29d902ba17d8bd84b1c395c525761706761caf55825046dbb848406689c10c67.exe	91
PID 4920 wrote to memory of 2640	4920	29d902ba17d8bd84b1c395c525761706761caf55825046dbb848406689c10c67.exe	91
PID 2640 wrote to memory of 1884	2640	sbietrcl.exe	94
PID 2640 wrote to memory of 1884	2640	sbietrcl.exe	94
PID 2640 wrote to memory of 1884	2640	sbietrcl.exe	94
PID 2640 wrote to memory of 1884	2640	sbietrcl.exe	94
PID 2640 wrote to memory of 1884	2640	sbietrcl.exe	94
PID 2640 wrote to memory of 1884	2640	sbietrcl.exe	94
PID 2640 wrote to memory of 1884	2640	sbietrcl.exe	94
PID 2640 wrote to memory of 1884	2640	sbietrcl.exe	94
PID 2640 wrote to memory of 1884	2640	sbietrcl.exe	94

C:\Users\Admin\AppData\Local\Temp\29d902ba17d8bd84b1c395c525761706761caf55825046dbb848406689c10c67.exe
"C:\Users\Admin\AppData\Local\Temp\29d902ba17d8bd84b1c395c525761706761caf55825046dbb848406689c10c67.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"
    3⤵
    - Executes dropped EXE
    PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sbietrcl.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
Size 1.6MB
SHA256 eaa403bc548b954da161791c135db377e73f3a3901c8e447b502d3df5aa2c0d3
MD5 db5c0f019f553aeba32acd0084cd7931
SHA1 395b808fabd858943dd77eaad8ffbb03713a0a4c
SHA512 3d261eaebd03cc1fe4ac2a2cf6744933a0fe5de3c0eaf5a434c4c6743f7147eb28e80664f197d8254959add204b93fad859db369434489901b18c8e2d9d66d93
SSDEEP 24576:iD39v74lfGQrFUspugRNJI2DJ53J/J/L5dJPj8/je7:ip7E+QrFUBgq2r7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1884-34-0x0000000000580000-0x0000000000597000-memory.dmp

Download

memory/2640-29-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download

memory/2640-38-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download

memory/2640-32-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download

memory/2640-31-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download

memory/2640-30-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download

memory/4920-5-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download

memory/4920-28-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download

memory/4920-6-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download

memory/4920-0-0x00000000749C2000-0x00000000749C3000-memory.dmp

Download

memory/4920-2-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download

memory/4920-1-0x00000000749C0000-0x0000000074F71000-memory.dmp

Download