remcos | 5394613c9b681a8f6735bbe9b0fcaafeb79c165211d9c1d202cb4372404b0df1

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 20:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
11_deb64ed.exe
Size 1.2MB
Sample240722-y2pfaawcph
SHA256 5394613c9b681a8f6735bbe9b0fcaafeb79c165211d9c1d202cb4372404b0df1
MD5 9f5ac77b66807ac0b2e0cedb9bb26491
SHA1 d14a0038aabc6db37349438db80ddc907cd45e5c
SHA512 acc60556ccc4d146604ac859c3c1d127bfc48127489791d013c78b041889a5d5d3e79132c54add761d3ec63025f06e5c62f8e4b88d11f3979af8360f21aa149b
SSDEEP 24576:dAHnh+eWsN3skA4RV1Hom2KXMmHabuOq6jyl6Jp8vlzNXA/EEK0CwQAb5:8h+ZkldoPK8YabuOqqyJlzG40x
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost collection rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

kamharidas.duckdns.org:30405

Attributes

audio_folder
MicRecords
audio_path
%Temp%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
aabbc
mouse_option
false
mutex
Rmc-WM84X2
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/4268-82-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/3188-79-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/2072-89-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/4268-82-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/3188-79-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs	name.exe

Executes dropped EXE 7 IoCs

pid	Process
4652	name.exe
4228	name.exe
4264	name.exe
3404	name.exe
3188	name.exe
4268	name.exe
2072	name.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	name.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0007000000023470-13.dat	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4264 set thread context of 3188	4264	name.exe	97
PID 4264 set thread context of 4268	4264	name.exe	98
PID 4264 set thread context of 2072	4264	name.exe	99

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3188	name.exe
3188	name.exe
2072	name.exe
2072	name.exe
3188	name.exe
3188	name.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
4264	name.exe
4264	name.exe
4264	name.exe
4264	name.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2072	name.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4264	name.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4264	name.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3668 wrote to memory of 4652	3668	11_deb64ed.exe	87
PID 3668 wrote to memory of 4652	3668	11_deb64ed.exe	87
PID 3668 wrote to memory of 4652	3668	11_deb64ed.exe	87
PID 4652 wrote to memory of 4228	4652	name.exe	88
PID 4652 wrote to memory of 4228	4652	name.exe	88
PID 4652 wrote to memory of 4228	4652	name.exe	88
PID 4228 wrote to memory of 4264	4228	name.exe	89
PID 4228 wrote to memory of 4264	4228	name.exe	89
PID 4228 wrote to memory of 4264	4228	name.exe	89
PID 4264 wrote to memory of 3404	4264	name.exe	96
PID 4264 wrote to memory of 3404	4264	name.exe	96
PID 4264 wrote to memory of 3404	4264	name.exe	96
PID 4264 wrote to memory of 3188	4264	name.exe	97
PID 4264 wrote to memory of 3188	4264	name.exe	97
PID 4264 wrote to memory of 3188	4264	name.exe	97
PID 4264 wrote to memory of 3188	4264	name.exe	97
PID 4264 wrote to memory of 4268	4264	name.exe	98
PID 4264 wrote to memory of 4268	4264	name.exe	98
PID 4264 wrote to memory of 4268	4264	name.exe	98
PID 4264 wrote to memory of 4268	4264	name.exe	98
PID 4264 wrote to memory of 2072	4264	name.exe	99
PID 4264 wrote to memory of 2072	4264	name.exe	99
PID 4264 wrote to memory of 2072	4264	name.exe	99
PID 4264 wrote to memory of 2072	4264	name.exe	99

C:\Users\Admin\AppData\Local\Temp\11_deb64ed.exe
"C:\Users\Admin\AppData\Local\Temp\11_deb64ed.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3668
- C:\Users\Admin\AppData\Local\directory\name.exe
  "C:\Users\Admin\AppData\Local\Temp\11_deb64ed.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Users\Admin\AppData\Local\directory\name.exe
    "C:\Users\Admin\AppData\Local\directory\name.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4228
  - - C:\Users\Admin\AppData\Local\directory\name.exe
      "C:\Users\Admin\AppData\Local\directory\name.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4264
    - - C:\Users\Admin\AppData\Local\directory\name.exe
        
        C:\Users\Admin\AppData\Local\directory\name.exe /stext "C:\Users\Admin\AppData\Local\Temp\qtzhimgnyazccobazyvnzrldeperkpumv"
        5⤵
        Executes dropped EXE
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\directory\name.exe
        
        C:\Users\Admin\AppData\Local\directory\name.exe /stext "C:\Users\Admin\AppData\Local\Temp\qtzhimgnyazccobazyvnzrldeperkpumv"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\directory\name.exe
        
        C:\Users\Admin\AppData\Local\directory\name.exe /stext "C:\Users\Admin\AppData\Local\Temp\awezj"
        5⤵
        Executes dropped EXE
        Accesses Microsoft Outlook accounts
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\directory\name.exe
        
        C:\Users\Admin\AppData\Local\directory\name.exe /stext "C:\Users\Admin\AppData\Local\Temp\cqrskxci"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aut86F3.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut86F3.tmp
Size 410KB
SHA256 1c2c7b4c4ad93b82054743f451e835b5693cd8187788adfb2716d553b374e9c0
MD5 6e04db821dd4d8d4cb84d4a4abb2a6a5
SHA1 3dba851d124e730deb0512f5bb83912a62f6eb4c
SHA512 e336e6ed91437459cd9a2f3ce4334144887132fbf79fb4259aa627e0c54100d4201985e96c054db9e214f7926bc7d089a5a2cb63490dafcd400cea782ae0d1a0
SSDEEP 12288:NzXiqZpWqiClUopjNrKiQgF1EclRBKohWaM4N:NbdZUCxZ2i1FSclRBov4N
MD5 SHA1 SHA512 SSDEEP

Submit Download

aut8742.tmp

Path C:\Users\Admin\AppData\Local\Temp\aut8742.tmp
Size 9KB
SHA256 d79893e241d8c03c8941c5de73eabbcbdc86f0ab10b9f65395e51f5f53bc8f7c
MD5 5856f9c763ec6a545fe2000c32b86fdf
SHA1 3a095ca0e852dc4f5443354d28a651fa9c094a1a
SHA512 a042f612dadf007e3df9cf1e648b90fb871d51ed402bd819e431393d2c4f908997642ad8931cbb6cff648e057d6baf2e0e7f08941734f2b8e18b3cea9e8fdfd4
SSDEEP 192:ZfyK5mQmlyEAZFFtG3M0EM9i5oNOXfDMVI/mOBs:Ry4fIyV480t9zNOPgOOos
MD5 SHA1 SHA512 SSDEEP

Submit Download

definitization

Path C:\Users\Admin\AppData\Local\Temp\definitization
Size 256KB
SHA256 1c2ca600c3aa1d8b71f97412e4bb06935e5777277ea0d2c17dfa3906d21a7cf3
MD5 0855bc6e0c231cba29ca3a7476ccc313
SHA1 9d86ccd791430f668917910652a3d7960fee1d1e
SHA512 d8ab6a1a7081e808b8cd5eac84a356575325500719890e4d0883c17379f01df6304a99c514e3369cba475020875deec4876acab884cddf9d7f74c3cca2b66486
SSDEEP 6144:obVvqqcTuyj5Y7E22iNk0HyA9iaYbL12f:qd0j5YY22avHiaYbwf
MD5 SHA1 SHA512 SSDEEP

Submit Download

definitization

Path C:\Users\Admin\AppData\Local\Temp\definitization
Size 384KB
SHA256 90077db1877f3d64b13d75aacc3814498ba43c88c4d1c0c1d5d8410b9799fbfd
MD5 5b5786ff2ffa7b8268f0b6a17badb591
SHA1 365abba7778002d7af24c4f25561750edce17492
SHA512 8c1febf1221d973c5469152a65cea441dd28926c57c6698a5b85ba8452d25e1a94192c25e5eeaef34d4c027a77cfa08410ae89f0128934e30166a6e4183d26d3
SSDEEP 6144:obVvqqcTuyj5Y7E22iNk0HyA9iaYbL12ZNFpFU5OQE7lyIHV+DN1dOREy:qd0j5YY22avHiaYbw5pFNoYVUQr
MD5 SHA1 SHA512 SSDEEP

Submit Download

definitization

Path C:\Users\Admin\AppData\Local\Temp\definitization
Size 482KB
SHA256 364021ae32de84e3d74015bcf3e0cb1f95a0988ac3abfda5e19339cdd8757de6
MD5 4bc5d44ea30d0c9a454ced19096cf58a
SHA1 47f2d2e312a29caa68b1f83cf11a9d1681b31ade
SHA512 7981cfbe1d9e1f2dffa4dc4c8b6de4311c0db2b1390ca09344fa897264f5cf943cede47f6ce5f0cbfe56dd432c27d2c630a8dbd9d81dfcb643f3e067089ba9cc
SSDEEP 12288:qd0j5YY22avHiaYbw5pFNoYVUQT5nF0e6:qgYYsCg5pbKe0e6
MD5 SHA1 SHA512 SSDEEP

Submit Download

qtzhimgnyazccobazyvnzrldeperkpumv

Path C:\Users\Admin\AppData\Local\Temp\qtzhimgnyazccobazyvnzrldeperkpumv
Size 4KB
SHA256 c8b9cad5602932ea51b923f39f4b2d9aedf1f4915880d89032ab6636acaf9bea
MD5 982ebb238759653970e22ee9fad24470
SHA1 15fca6be8cc4a276c9f70a73f28c52c3b0eead15
SHA512 c8777edf0dd3e72e0cf3bb89db2bc7856fed0eeca7199806fec341e9168899e3b700c73a6b2e7cb0e8ccc5523116d6ecfde5c9ebcc83288a162dd1b0ea78201b
SSDEEP 48:wvvv0QfxfvvcQfxfdvv0QfxBvv0Qfxakvv0Qf7:mv5xvhp1v5Pv5bv57
MD5 SHA1 SHA512 SSDEEP

Submit Download

unprickly

Path C:\Users\Admin\AppData\Local\Temp\unprickly
Size 28KB
SHA256 f17cd078f72143aaa4213038a0cc9e14735ddd5f1384b6ba502fa1ee3c914259
MD5 9ef3e9aafd67f6c56305759f5a0af933
SHA1 63797a87cf880d7cbeddaab1e0eea2a94a8434d2
SHA512 427edb40970d764d632d54ab4d8e85c99c1b0750d75a7f0765cdce38e31073b32fbed58a9b0e236c18f9de31e6181228c5cb04b7cd906c9bc6ab8e51c981fd1b
SSDEEP 192:aIU0YzxURqp0msY+B5LeDE49yry+a9ydKct6lTKzCaCLD1LXVBvbcENwwZUU1r10:rYzxrp0kEaIyfLXDXurxdZnz69p509
MD5 SHA1 SHA512 SSDEEP

Submit Download

name.exe

Path C:\Users\Admin\AppData\Local\directory\name.exe
Size 1.2MB
SHA256 5394613c9b681a8f6735bbe9b0fcaafeb79c165211d9c1d202cb4372404b0df1
MD5 9f5ac77b66807ac0b2e0cedb9bb26491
SHA1 d14a0038aabc6db37349438db80ddc907cd45e5c
SHA512 acc60556ccc4d146604ac859c3c1d127bfc48127489791d013c78b041889a5d5d3e79132c54add761d3ec63025f06e5c62f8e4b88d11f3979af8360f21aa149b
SSDEEP 24576:dAHnh+eWsN3skA4RV1Hom2KXMmHabuOq6jyl6Jp8vlzNXA/EEK0CwQAb5:8h+ZkldoPK8YabuOqqyJlzG40x
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2072-89-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2072-88-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2072-86-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3188-75-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3188-77-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3188-79-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3668-10-0x0000000004080000-0x0000000004084000-memory.dmp

Download

memory/4264-58-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4264-54-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4264-65-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4264-66-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4264-64-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4264-68-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4264-73-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4264-62-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4264-100-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4264-101-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4264-61-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4264-60-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4264-99-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4264-63-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4264-59-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4264-55-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4264-57-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4264-92-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/4264-96-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/4264-95-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/4264-97-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4264-98-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/4268-78-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4268-82-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/4268-81-0x0000000000400000-0x0000000000462000-memory.dmp

Download