remcos | 74eff35aee68f271e0a9882e41d44abf8f82d058ee4755ddd0832bdc674c520b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
74eff35aee68f271e0a9882e41d44abf8f82d058ee4755ddd0832bdc674c520b.exe
Size 766KB
Sample240719-tc6aaascrf
SHA256 74eff35aee68f271e0a9882e41d44abf8f82d058ee4755ddd0832bdc674c520b
MD5 330ec924eb2c5b6726993dd0afb7a7af
SHA1 bd8504d626e13b440f19ccb04123603f7da65b5e
SHA512 7d10eb498d42b4250e1210bfa35756e969c213194f61f7ff7037fad8ee402bfc50eff171b7aa808fc34ba856438eaa1ef10d5447d66bb3ab8e5c2064db3dab90
SSDEEP 12288:4YV6MorX7qzuC3QHO9FQVHPF51jgcoEMtbmYYdnD/yozPfi7pBcnKA4nuGYMOSwX:XBXu9HGaVHNMpAD6ozPfyankuVs4oTeB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost collection rat spyware stealer upx

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

107.175.229.139:8823

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-2BGC0K
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Detected Nirsoft tools 6 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/4592-53-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/2980-69-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/3656-65-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/3656-60-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/4592-52-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4592-71-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/3656-65-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral2/memory/3656-60-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4592-53-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/4592-52-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/4592-71-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\totted.vbs	totted.exe

Executes dropped EXE 9 IoCs

pid	Process
3572	totted.exe
4592	totted.exe
3472	totted.exe
3452	totted.exe
3652	totted.exe
4388	totted.exe
3656	totted.exe
3120	totted.exe
2980	totted.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4524-0-0x0000000000C20000-0x0000000000DCB000-memory.dmp	upx
behavioral2/files/0x000700000002344c-14.dat	upx
behavioral2/memory/4524-16-0x0000000000C20000-0x0000000000DCB000-memory.dmp	upx
behavioral2/memory/3572-17-0x0000000000E60000-0x000000000100B000-memory.dmp	upx
behavioral2/memory/3472-50-0x0000000000E60000-0x000000000100B000-memory.dmp	upx
behavioral2/memory/3572-80-0x0000000000E60000-0x000000000100B000-memory.dmp	upx

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	totted.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4524-16-0x0000000000C20000-0x0000000000DCB000-memory.dmp	autoit_exe
behavioral2/memory/3572-80-0x0000000000E60000-0x000000000100B000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3572 set thread context of 4592	3572	totted.exe	90
PID 3572 set thread context of 3656	3572	totted.exe	95
PID 3572 set thread context of 2980	3572	totted.exe	97

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4592	totted.exe
4592	totted.exe
2980	totted.exe
2980	totted.exe
4592	totted.exe
4592	totted.exe

Suspicious behavior: MapViewOfSection 8 IoCs

pid	Process
3572	totted.exe
3572	totted.exe
3572	totted.exe
3572	totted.exe
3572	totted.exe
3572	totted.exe
3572	totted.exe
3572	totted.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2980	totted.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 3572	4524	74eff35aee68f271e0a9882e41d44abf8f82d058ee4755ddd0832bdc674c520b.exe	87
PID 4524 wrote to memory of 3572	4524	74eff35aee68f271e0a9882e41d44abf8f82d058ee4755ddd0832bdc674c520b.exe	87
PID 4524 wrote to memory of 3572	4524	74eff35aee68f271e0a9882e41d44abf8f82d058ee4755ddd0832bdc674c520b.exe	87
PID 3572 wrote to memory of 4592	3572	totted.exe	90
PID 3572 wrote to memory of 4592	3572	totted.exe	90
PID 3572 wrote to memory of 4592	3572	totted.exe	90
PID 3572 wrote to memory of 4592	3572	totted.exe	90
PID 3572 wrote to memory of 3472	3572	totted.exe	91
PID 3572 wrote to memory of 3472	3572	totted.exe	91
PID 3572 wrote to memory of 3472	3572	totted.exe	91
PID 3572 wrote to memory of 3452	3572	totted.exe	92
PID 3572 wrote to memory of 3452	3572	totted.exe	92
PID 3572 wrote to memory of 3452	3572	totted.exe	92
PID 3572 wrote to memory of 3652	3572	totted.exe	93
PID 3572 wrote to memory of 3652	3572	totted.exe	93
PID 3572 wrote to memory of 3652	3572	totted.exe	93
PID 3572 wrote to memory of 4388	3572	totted.exe	94
PID 3572 wrote to memory of 4388	3572	totted.exe	94
PID 3572 wrote to memory of 4388	3572	totted.exe	94
PID 3572 wrote to memory of 3656	3572	totted.exe	95
PID 3572 wrote to memory of 3656	3572	totted.exe	95
PID 3572 wrote to memory of 3656	3572	totted.exe	95
PID 3572 wrote to memory of 3656	3572	totted.exe	95
PID 3572 wrote to memory of 3120	3572	totted.exe	96
PID 3572 wrote to memory of 3120	3572	totted.exe	96
PID 3572 wrote to memory of 3120	3572	totted.exe	96
PID 3572 wrote to memory of 2980	3572	totted.exe	97
PID 3572 wrote to memory of 2980	3572	totted.exe	97
PID 3572 wrote to memory of 2980	3572	totted.exe	97
PID 3572 wrote to memory of 2980	3572	totted.exe	97

C:\Users\Admin\AppData\Local\Temp\74eff35aee68f271e0a9882e41d44abf8f82d058ee4755ddd0832bdc674c520b.exe
"C:\Users\Admin\AppData\Local\Temp\74eff35aee68f271e0a9882e41d44abf8f82d058ee4755ddd0832bdc674c520b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Users\Admin\AppData\Local\molebut\totted.exe
  "C:\Users\Admin\AppData\Local\Temp\74eff35aee68f271e0a9882e41d44abf8f82d058ee4755ddd0832bdc674c520b.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3572
- - C:\Users\Admin\AppData\Local\molebut\totted.exe
    C:\Users\Admin\AppData\Local\molebut\totted.exe /stext "C:\Users\Admin\AppData\Local\Temp\xlsyqlihx"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4592
- - C:\Users\Admin\AppData\Local\molebut\totted.exe
    C:\Users\Admin\AppData\Local\molebut\totted.exe /stext "C:\Users\Admin\AppData\Local\Temp\znyqretilgvhe"
    3⤵
    - Executes dropped EXE
    PID:3472
- - C:\Users\Admin\AppData\Local\molebut\totted.exe
    C:\Users\Admin\AppData\Local\molebut\totted.exe /stext "C:\Users\Admin\AppData\Local\Temp\znyqretilgvhe"
    3⤵
    - Executes dropped EXE
    PID:3452
- - C:\Users\Admin\AppData\Local\molebut\totted.exe
    C:\Users\Admin\AppData\Local\molebut\totted.exe /stext "C:\Users\Admin\AppData\Local\Temp\znyqretilgvhe"
    3⤵
    - Executes dropped EXE
    PID:3652
- - C:\Users\Admin\AppData\Local\molebut\totted.exe
    C:\Users\Admin\AppData\Local\molebut\totted.exe /stext "C:\Users\Admin\AppData\Local\Temp\znyqretilgvhe"
    3⤵
    - Executes dropped EXE
    PID:4388
- - C:\Users\Admin\AppData\Local\molebut\totted.exe
    C:\Users\Admin\AppData\Local\molebut\totted.exe /stext "C:\Users\Admin\AppData\Local\Temp\znyqretilgvhe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook accounts
    PID:3656
- - C:\Users\Admin\AppData\Local\molebut\totted.exe
    C:\Users\Admin\AppData\Local\molebut\totted.exe /stext "C:\Users\Admin\AppData\Local\Temp\khljrodczonmpppa"
    3⤵
    - Executes dropped EXE
    PID:3120
- - C:\Users\Admin\AppData\Local\molebut\totted.exe
    C:\Users\Admin\AppData\Local\molebut\totted.exe /stext "C:\Users\Admin\AppData\Local\Temp\khljrodczonmpppa"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 0097b0663f598c951e9364a1df7fb0e13cba7d92bdd86d0c5ac831e4d22bc329
MD5 79d3e42c209f75ee113be657e1b57c26
SHA1 0074b3685fa64d33ad09145b2e06b5561ca554e6
SHA512 7f3303d549cb3b4efa7078b885c61ddd9205c6b531bf8853d9edcc764a66deed4b294987e3081f9da48be70dc259c1c8158bf7ae44e5453fbb0d17b7f60b4b58
MD5 SHA1 SHA512

Submit Download

misrun

Path C:\Users\Admin\AppData\Local\Temp\misrun
Size 482KB
SHA256 9449d898172bbc4318947d8954b152903ac5dacf146a2a823a5ea10422321529
MD5 7bbbcffaf739d0128b2c0fc7e0990d88
SHA1 793953162ba65fbba0641f1cc233af88be1da349
SHA512 b4ed4a2501c71a1ebc9be284fa9cff8bfb05c7ad9da7c6f3a022d777f87e4d647662c1c367078a3ae015b235c063a68058e8ad8120e722c088ff34c22a986973
SSDEEP 12288:5YDUcK7lA6dPsEpKxP4nxC2iD8aMQEam2lpKYLO7FpYgjATYOh:5YDJK7lA6DnvQEUfHgFy8AXh
MD5 SHA1 SHA512 SSDEEP

Submit Download

shrugged

Path C:\Users\Admin\AppData\Local\Temp\shrugged
Size 28KB
SHA256 d3145cf44daf689d9e100ad7090a62cb86b40a58e42ba7a41756bd48f25ca2c0
MD5 3aed04ca23b5faf55a981b7c48e90dcd
SHA1 390a3e6804c22e1e3b7e5ff2f8f93d65316bc6f2
SHA512 b28aef3dccbe820ddfd990ab0d7ccd61fd3efd04d5ebc027c236d17b94e463eab6bcecda298d1c6fefb3a8ac24009731b938a672cc1f60d36da54b281a0664e8
SSDEEP 192:aIU0YzxURqp0m5Y+25yeDE49yry+a9ydKKqQlwuzmPLD1LXVBvbcENwwZUU1r1Yn:rYzxrp0FwaI0XLXDXZZRdXZ8d4509
MD5 SHA1 SHA512 SSDEEP

Submit Download

xlsyqlihx

Path C:\Users\Admin\AppData\Local\Temp\xlsyqlihx
Size 4KB
SHA256 39778b2ce19d6da1270a9bc5b408bed7e44e95d033db5e2debe433d3f4222d45
MD5 2d92eeffc6bb97ea5f0d952d2afc233b
SHA1 b9d25454ff381311f4b27114b3ba3a089231010e
SHA512 a5bd0252e0a852dbdedb6f7afca5dc043703071da82e6a03e114de8752084b9d2fa439f1151b3bec10bc693dab679ff2933f41a5befaf143a375d3bbe0f85e07
SSDEEP 48:wvvv0QrxfvvcQrxfdvv0QrxBvv0Qrxakvv0Qr7:mvdxvFp1vdPvdbvd7
MD5 SHA1 SHA512 SSDEEP

Submit Download

totted.exe

Path C:\Users\Admin\AppData\Local\molebut\totted.exe
Size 766KB
SHA256 74eff35aee68f271e0a9882e41d44abf8f82d058ee4755ddd0832bdc674c520b
MD5 330ec924eb2c5b6726993dd0afb7a7af
SHA1 bd8504d626e13b440f19ccb04123603f7da65b5e
SHA512 7d10eb498d42b4250e1210bfa35756e969c213194f61f7ff7037fad8ee402bfc50eff171b7aa808fc34ba856438eaa1ef10d5447d66bb3ab8e5c2064db3dab90
SSDEEP 12288:4YV6MorX7qzuC3QHO9FQVHPF51jgcoEMtbmYYdnD/yozPfi7pBcnKA4nuGYMOSwX:XBXu9HGaVHNMpAD6ozPfyankuVs4oTeB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2980-66-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2980-68-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2980-69-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3472-50-0x0000000000E60000-0x000000000100B000-memory.dmp

Download

memory/3572-83-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3572-78-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3572-38-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3572-39-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3572-40-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3572-42-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3572-41-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3572-44-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3572-131-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3572-36-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3572-37-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3572-35-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3572-32-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3572-17-0x0000000000E60000-0x000000000100B000-memory.dmp

Download

memory/3572-108-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3572-98-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3572-97-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3572-87-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3572-130-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3572-120-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3572-119-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3572-86-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3572-73-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/3572-77-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/3572-76-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/3572-109-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3572-80-0x0000000000E60000-0x000000000100B000-memory.dmp

Download

memory/3656-56-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3656-59-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3656-60-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3656-65-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4524-0-0x0000000000C20000-0x0000000000DCB000-memory.dmp

Download

memory/4524-16-0x0000000000C20000-0x0000000000DCB000-memory.dmp

Download

memory/4524-11-0x0000000001690000-0x0000000001694000-memory.dmp

Download

memory/4592-53-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4592-71-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4592-48-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4592-52-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4592-45-0x0000000000400000-0x0000000000478000-memory.dmp

Download