remcos | 096b49b1a090bed6734ac03fc3aff67bd249a0040aa9bdbd4f0d8bbcdde760bf

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
18/07/2024, 06:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MalwareBazaar.exe
Size 1.5MB
Sample240718-g6xtsa1bpb
SHA256 096b49b1a090bed6734ac03fc3aff67bd249a0040aa9bdbd4f0d8bbcdde760bf
MD5 1b3bdc21a8aa04688c5a8a7001390b5d
SHA1 579a74f0bee2f65accff5810dffde1239da701db
SHA512 e5cb18a991672a9b5d910dcdc54e7c4e9e31ccceef293fccb043d606335c743c944783a2cf2b2ab7b1fd28fc5a8906a7ad9b0f1eeff537ad07a24a3b58f28339
SSDEEP 24576:a6nVMk+HIj90c6kkdWTyTqLA45DopywfIPQZ3YKb7hlV9CTs0bydWy2UE43YP0bo:ZVz7t11TAoAmDqR5Y27VwlPW2Luku6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos riches evasion execution persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RICHES

75.127.7.188:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
Intel22.exe
copy_folder
Intel22
delete_file
false
hide_file
true
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
intel22
keylog_path
%AppData%
mouse_option
false
mutex
Rmc-D3CYN5
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4724	powershell.exe
1176	powershell.exe
3824	powershell.exe
3916	powershell.exe
4256	powershell.exe
872	powershell.exe
4616	powershell.exe
4816	powershell.exe
4232	powershell.exe
3288	powershell.exe
3904	powershell.exe

Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	eoccfrsi.msc
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	MalwareBazaar.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 2 IoCs

pid	Process
2680	eoccfrsi.msc
624	RegSvcs.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Desktop Outlook = "C:\\Users\\Admin\\AppData\\Roaming\\awgo\\EOCCFR~1.EXE C:\\Users\\Admin\\AppData\\Roaming\\awgo\\lkjaaj.msc"	eoccfrsi.msc

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2680 set thread context of 624	2680	eoccfrsi.msc	121

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1532	ipconfig.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\Local Settings	MalwareBazaar.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
1176	powershell.exe
1176	powershell.exe
3824	powershell.exe
3824	powershell.exe
4724	powershell.exe
4724	powershell.exe
4816	powershell.exe
4816	powershell.exe
4232	powershell.exe
4232	powershell.exe
3288	powershell.exe
3288	powershell.exe
3824	powershell.exe
4816	powershell.exe
1176	powershell.exe
4724	powershell.exe
4232	powershell.exe
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
3288	powershell.exe
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc
2680	eoccfrsi.msc

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4724	powershell.exe
Token: SeDebugPrivilege	3824	powershell.exe
Token: SeDebugPrivilege	4816	powershell.exe
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeDebugPrivilege	1176	powershell.exe
Token: SeDebugPrivilege	3288	powershell.exe
Token: SeDebugPrivilege	3904	powershell.exe
Token: SeDebugPrivilege	3916	powershell.exe
Token: SeDebugPrivilege	4256	powershell.exe
Token: SeDebugPrivilege	4616	powershell.exe
Token: SeDebugPrivilege	872	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
624	RegSvcs.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 1996	3780	MalwareBazaar.exe	87
PID 3780 wrote to memory of 1996	3780	MalwareBazaar.exe	87
PID 3780 wrote to memory of 1996	3780	MalwareBazaar.exe	87
PID 1996 wrote to memory of 1912	1996	WScript.exe	94
PID 1996 wrote to memory of 1912	1996	WScript.exe	94
PID 1996 wrote to memory of 1912	1996	WScript.exe	94
PID 1996 wrote to memory of 1624	1996	WScript.exe	96
PID 1996 wrote to memory of 1624	1996	WScript.exe	96
PID 1996 wrote to memory of 1624	1996	WScript.exe	96
PID 1912 wrote to memory of 1532	1912	cmd.exe	98
PID 1912 wrote to memory of 1532	1912	cmd.exe	98
PID 1912 wrote to memory of 1532	1912	cmd.exe	98
PID 1624 wrote to memory of 2680	1624	cmd.exe	99
PID 1624 wrote to memory of 2680	1624	cmd.exe	99
PID 1624 wrote to memory of 2680	1624	cmd.exe	99
PID 2680 wrote to memory of 4816	2680	eoccfrsi.msc	100
PID 2680 wrote to memory of 4816	2680	eoccfrsi.msc	100
PID 2680 wrote to memory of 4816	2680	eoccfrsi.msc	100
PID 2680 wrote to memory of 4724	2680	eoccfrsi.msc	102
PID 2680 wrote to memory of 4724	2680	eoccfrsi.msc	102
PID 2680 wrote to memory of 4724	2680	eoccfrsi.msc	102
PID 2680 wrote to memory of 1176	2680	eoccfrsi.msc	104
PID 2680 wrote to memory of 1176	2680	eoccfrsi.msc	104
PID 2680 wrote to memory of 1176	2680	eoccfrsi.msc	104
PID 2680 wrote to memory of 3824	2680	eoccfrsi.msc	106
PID 2680 wrote to memory of 3824	2680	eoccfrsi.msc	106
PID 2680 wrote to memory of 3824	2680	eoccfrsi.msc	106
PID 2680 wrote to memory of 4232	2680	eoccfrsi.msc	108
PID 2680 wrote to memory of 4232	2680	eoccfrsi.msc	108
PID 2680 wrote to memory of 4232	2680	eoccfrsi.msc	108
PID 2680 wrote to memory of 3288	2680	eoccfrsi.msc	110
PID 2680 wrote to memory of 3288	2680	eoccfrsi.msc	110
PID 2680 wrote to memory of 3288	2680	eoccfrsi.msc	110
PID 2680 wrote to memory of 408	2680	eoccfrsi.msc	112
PID 2680 wrote to memory of 408	2680	eoccfrsi.msc	112
PID 2680 wrote to memory of 408	2680	eoccfrsi.msc	112
PID 1996 wrote to memory of 1652	1996	WScript.exe	114
PID 1996 wrote to memory of 1652	1996	WScript.exe	114
PID 1996 wrote to memory of 1652	1996	WScript.exe	114
PID 4724 wrote to memory of 3904	4724	powershell.exe	116
PID 4724 wrote to memory of 3904	4724	powershell.exe	116
PID 4724 wrote to memory of 3904	4724	powershell.exe	116
PID 3824 wrote to memory of 3916	3824	powershell.exe	117
PID 3824 wrote to memory of 3916	3824	powershell.exe	117
PID 3824 wrote to memory of 3916	3824	powershell.exe	117
PID 1176 wrote to memory of 4256	1176	powershell.exe	118
PID 1176 wrote to memory of 4256	1176	powershell.exe	118
PID 1176 wrote to memory of 4256	1176	powershell.exe	118
PID 4232 wrote to memory of 872	4232	powershell.exe	119
PID 4232 wrote to memory of 872	4232	powershell.exe	119
PID 4232 wrote to memory of 872	4232	powershell.exe	119
PID 3288 wrote to memory of 4616	3288	powershell.exe	120
PID 3288 wrote to memory of 4616	3288	powershell.exe	120
PID 3288 wrote to memory of 4616	3288	powershell.exe	120
PID 2680 wrote to memory of 624	2680	eoccfrsi.msc	121
PID 2680 wrote to memory of 624	2680	eoccfrsi.msc	121
PID 2680 wrote to memory of 624	2680	eoccfrsi.msc	121
PID 2680 wrote to memory of 624	2680	eoccfrsi.msc	121
PID 2680 wrote to memory of 624	2680	eoccfrsi.msc	121

C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe
"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\juix.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ipconfig /release
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /release
      4⤵
      Gathers network information
      PID:1532
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c eoccfrsi.msc lkjaaj.msc
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\eoccfrsi.msc
      eoccfrsi.msc lkjaaj.msc
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2680
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\RarSFX0
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4816
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -Command Add-MpPreference -ExclusionProcess 'RegSvcs.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4724
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionProcess RegSvcs.exe
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3904
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -Command Add-MpPreference -ExclusionExtension '.vbs'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1176
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionExtension .vbs
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4256
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -Command Add-MpPreference -ExclusionExtension '.vbe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3824
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionExtension .vbe
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3916
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -Command Add-MpPreference -ExclusionExtension '*.vbs'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4232
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionExtension *.vbs
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:872
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -Command Add-MpPreference -ExclusionExtension '*.vbe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3288
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionExtension *.vbe
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4616
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 30 /tn WindowsRepaire /tr "C:\Users\Admin\AppData\Roaming\awgo\EOCCFR~1.EXE C:\Users\Admin\AppData\Roaming\awgo\lkjaaj.msc"
        5⤵
        
        PID:408
    - - C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:624
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ipconfig /renew
    3⤵
    PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...