remcos | d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230

Analysis

max time kernel
148s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MalwareBazaar.exe
Size 2.3MB
Sample240722-rbae4ssapq
SHA256 d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230
MD5 2a65843b474feff5256bd673b4ff88ae
SHA1 0c80fb17f84d478941ab4d51fddcccaf274da31d
SHA512 7f8a5a684273a031b648129870d493c9a2d63838a8179b8ce32e2c94f956c1a1196ef404d346e6ca42016489fa949b985bc598111dde0249c64c12a668b77292
SSDEEP 49152:E2u/BMdg532rpsjCMqigjns2+a95PlpiH9MzMrcgt4hzNriBldyQJ/MqmG:DrpEZI0BnlJNh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos dollar man collection rat

Malware Config

Extracted

Family

remcos

Botnet

Dollar Man

178.23.190.118:52499

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-SJ9MVF
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Detected Nirsoft tools 8 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/4424-32-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4124-31-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4424-33-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4512-30-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/4124-29-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/4424-28-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/4512-26-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/4124-38-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4512-30-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral2/memory/4512-26-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/4124-31-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/4124-29-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/4124-38-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	regsvcs.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4464 set thread context of 3116	4464	MalwareBazaar.exe	85
PID 3116 set thread context of 4124	3116	regsvcs.exe	94
PID 3116 set thread context of 4512	3116	regsvcs.exe	96
PID 3116 set thread context of 4424	3116	regsvcs.exe	99

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4424	regsvcs.exe
4424	regsvcs.exe
4124	regsvcs.exe
4124	regsvcs.exe
4124	regsvcs.exe
4124	regsvcs.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
3116	regsvcs.exe
3116	regsvcs.exe
3116	regsvcs.exe
3116	regsvcs.exe
3116	regsvcs.exe
3116	regsvcs.exe
3116	regsvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4424	regsvcs.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3116	regsvcs.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 3116	4464	MalwareBazaar.exe	85
PID 4464 wrote to memory of 3116	4464	MalwareBazaar.exe	85
PID 4464 wrote to memory of 3116	4464	MalwareBazaar.exe	85
PID 4464 wrote to memory of 3116	4464	MalwareBazaar.exe	85
PID 4464 wrote to memory of 3116	4464	MalwareBazaar.exe	85
PID 4464 wrote to memory of 3116	4464	MalwareBazaar.exe	85
PID 4464 wrote to memory of 3116	4464	MalwareBazaar.exe	85
PID 4464 wrote to memory of 3116	4464	MalwareBazaar.exe	85
PID 4464 wrote to memory of 3116	4464	MalwareBazaar.exe	85
PID 4464 wrote to memory of 3116	4464	MalwareBazaar.exe	85
PID 4464 wrote to memory of 3116	4464	MalwareBazaar.exe	85
PID 4464 wrote to memory of 3116	4464	MalwareBazaar.exe	85
PID 3116 wrote to memory of 2308	3116	regsvcs.exe	93
PID 3116 wrote to memory of 2308	3116	regsvcs.exe	93
PID 3116 wrote to memory of 2308	3116	regsvcs.exe	93
PID 3116 wrote to memory of 4124	3116	regsvcs.exe	94
PID 3116 wrote to memory of 4124	3116	regsvcs.exe	94
PID 3116 wrote to memory of 4124	3116	regsvcs.exe	94
PID 3116 wrote to memory of 4124	3116	regsvcs.exe	94
PID 3116 wrote to memory of 1256	3116	regsvcs.exe	95
PID 3116 wrote to memory of 1256	3116	regsvcs.exe	95
PID 3116 wrote to memory of 1256	3116	regsvcs.exe	95
PID 3116 wrote to memory of 4512	3116	regsvcs.exe	96
PID 3116 wrote to memory of 4512	3116	regsvcs.exe	96
PID 3116 wrote to memory of 4512	3116	regsvcs.exe	96
PID 3116 wrote to memory of 4512	3116	regsvcs.exe	96
PID 3116 wrote to memory of 5076	3116	regsvcs.exe	97
PID 3116 wrote to memory of 5076	3116	regsvcs.exe	97
PID 3116 wrote to memory of 5076	3116	regsvcs.exe	97
PID 3116 wrote to memory of 2368	3116	regsvcs.exe	98
PID 3116 wrote to memory of 2368	3116	regsvcs.exe	98
PID 3116 wrote to memory of 2368	3116	regsvcs.exe	98
PID 3116 wrote to memory of 4424	3116	regsvcs.exe	99
PID 3116 wrote to memory of 4424	3116	regsvcs.exe	99
PID 3116 wrote to memory of 4424	3116	regsvcs.exe	99
PID 3116 wrote to memory of 4424	3116	regsvcs.exe	99

C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe
"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe /stext "C:\Users\Admin\AppData\Local\Temp\pdqwp"
    3⤵
    PID:2308
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe /stext "C:\Users\Admin\AppData\Local\Temp\pdqwp"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4124
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe /stext "C:\Users\Admin\AppData\Local\Temp\sfvoijji"
    3⤵
    PID:1256
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe /stext "C:\Users\Admin\AppData\Local\Temp\sfvoijji"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:4512
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe /stext "C:\Users\Admin\AppData\Local\Temp\czbhibubvapb"
    3⤵
    PID:5076
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe /stext "C:\Users\Admin\AppData\Local\Temp\czbhibubvapb"
    3⤵
    PID:2368
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe /stext "C:\Users\Admin\AppData\Local\Temp\czbhibubvapb"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 e83dd25175762f338a235a50bc155895597b4d1741fb0f275f2b60759918e645
MD5 16ef359bccd3fa0e3163c5075e1394cf
SHA1 aef3f4948446712ea1c157b5273aa5643a7e2810
SHA512 e6ef5d41b5e9e1855176c0ac34032376e78858d720635a6b4f15535cc5a79be4c1fe83519a58cac93cb4e407bdc8ef2bfde4dbb0ec16bb1497f9b4195f2e5bc4
MD5 SHA1 SHA512

Submit Download

pdqwp

Path C:\Users\Admin\AppData\Local\Temp\pdqwp
Size 4KB
SHA256 5163d0e849d5d39f1e8beb9d13beea8240d532dff6f28433522148628007af06
MD5 71e3611290752b1a114e303d84e3987f
SHA1 210794023f369235615743c802fce5055961ee6e
SHA512 d0235dd58f9038009e44c4847535f2bb652f093418fdfd890c01b4b9d8981df3a31e4a89f9099c226becbfe8541015d60f6b852165241d08cb8795d93dd2eb09
SSDEEP 48:wvvv0QUxfvvcQUxfdvv0QUxBvv0QUxakvv0QU7:mvuxv2p1vuPvubvu7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3116-44-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/3116-49-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3116-3-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3116-7-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3116-8-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3116-10-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3116-9-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3116-11-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3116-12-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3116-14-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3116-16-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3116-17-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3116-77-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3116-78-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3116-70-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3116-69-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3116-62-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3116-61-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3116-53-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3116-54-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3116-4-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3116-1-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3116-45-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3116-43-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/3116-0-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/3116-40-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/3116-2-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4124-38-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4124-18-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4124-22-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4124-31-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4124-29-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4424-33-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4424-27-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4424-28-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4424-32-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4424-24-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4512-30-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4512-23-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4512-26-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4512-20-0x0000000000400000-0x0000000000462000-memory.dmp

Download