Malware Analysis Report

2025-01-02 03:29

Sample ID 240723-qpxl5ascrp
Target c000c20f354b21e121f89647fcc8ce60N.exe
SHA256 710c780494b8c14c5f9167014ea8d75638d506c5dd674c5ce9aa95a3b991e001
Tags
remcos persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

710c780494b8c14c5f9167014ea8d75638d506c5dd674c5ce9aa95a3b991e001

Threat Level: Known bad

The file c000c20f354b21e121f89647fcc8ce60N.exe was found to be: Known bad.

Malicious Activity Summary

remcos persistence rat

Remcos

Remcos family

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious use of SetWindowsHookEx

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-23 13:26

Signatures

Remcos family

remcos

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-23 13:26

Reported

2024-07-23 13:28

Platform

win7-20240708-en

Max time kernel

118s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c000c20f354b21e121f89647fcc8ce60N.exe"

Signatures

Remcos

rat remcos

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\msword = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\msword.exe\"" C:\Users\Admin\AppData\Local\Temp\c000c20f354b21e121f89647fcc8ce60N.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\msword = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\msword.exe\"" C:\Users\Admin\AppData\Roaming\remcos\msword.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2776 set thread context of 2736 N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe C:\Windows\SysWOW64\svchost.exe

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2640 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\c000c20f354b21e121f89647fcc8ce60N.exe C:\Windows\SysWOW64\WScript.exe
PID 2640 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\c000c20f354b21e121f89647fcc8ce60N.exe C:\Windows\SysWOW64\WScript.exe
PID 2640 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\c000c20f354b21e121f89647fcc8ce60N.exe C:\Windows\SysWOW64\WScript.exe
PID 2640 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\c000c20f354b21e121f89647fcc8ce60N.exe C:\Windows\SysWOW64\WScript.exe
PID 2764 wrote to memory of 2364 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2764 wrote to memory of 2364 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2764 wrote to memory of 2364 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2764 wrote to memory of 2364 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2364 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\remcos\msword.exe
PID 2364 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\remcos\msword.exe
PID 2364 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\remcos\msword.exe
PID 2364 wrote to memory of 2776 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\remcos\msword.exe
PID 2776 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe C:\Windows\SysWOW64\svchost.exe
PID 2776 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe C:\Windows\SysWOW64\svchost.exe
PID 2776 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe C:\Windows\SysWOW64\svchost.exe
PID 2776 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe C:\Windows\SysWOW64\svchost.exe
PID 2776 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe C:\Windows\SysWOW64\svchost.exe
PID 2776 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe C:\Windows\SysWOW64\svchost.exe
PID 2776 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe C:\Windows\SysWOW64\svchost.exe
PID 2776 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe C:\Windows\SysWOW64\svchost.exe
PID 2776 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe C:\Windows\SysWOW64\svchost.exe
PID 2776 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe C:\Windows\SysWOW64\svchost.exe
PID 2776 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c000c20f354b21e121f89647fcc8ce60N.exe

"C:\Users\Admin\AppData\Local\Temp\c000c20f354b21e121f89647fcc8ce60N.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\msword.exe"

C:\Users\Admin\AppData\Roaming\remcos\msword.exe

C:\Users\Admin\AppData\Roaming\remcos\msword.exe

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe

Network

Country Destination Domain Proto
US 23.105.131.212:9000 tcp
US 23.105.131.212:9000 tcp
US 23.105.131.212:9010 tcp
US 23.105.131.212:9010 tcp
US 23.105.131.212:9000 tcp
US 23.105.131.212:9000 tcp

Files

C:\Users\Admin\AppData\Local\Temp\install.vbs

MD5 60a2d14228422987348aff9cd2af3567
SHA1 3e5a1e1905a81e94c42f2116f328da58d1d36d83
SHA256 ba41f84546b3aff28026a3a4712108f5a1c1beb3f563ce9c23c3aa24d13a4984
SHA512 bb2daee546c4e0e0e39393eee243fbf246ccc64db80e1c57abc4dae0464b23e3f4e6cb588cf7383717aa6b4aa2b1af96af0af3946dca072c99d77aa5825a1d83

\Users\Admin\AppData\Roaming\remcos\msword.exe

MD5 c000c20f354b21e121f89647fcc8ce60
SHA1 e10422339e88143cd8187562fc2cf344d6ad5e4d
SHA256 710c780494b8c14c5f9167014ea8d75638d506c5dd674c5ce9aa95a3b991e001
SHA512 ca90781ebebe9f95468a0abcb40dc64ec38312c8154f53f67b83a2bd588076436f0e32fc1e3156234e0ad29b8a92e512997cd28dc9686a23a5088a7c4ed29772

memory/2736-9-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2736-11-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2736-22-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2736-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2736-19-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2736-17-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2736-15-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2736-13-0x0000000000400000-0x0000000000420000-memory.dmp

memory/2736-23-0x0000000000400000-0x0000000000420000-memory.dmp

C:\Users\Admin\AppData\Roaming\remcos\logs.dat

MD5 b157450411cb20c064a1dbd0abed2a78
SHA1 dc8d36a42f3577f2d1a9ee9b70b918e8562b6081
SHA256 037bf0df7b230a32a6357eebd8cfcccd55ef032d474ec7453a97ede1abc8bed2
SHA512 68903924a6e4618737a68ecdab4a488f28d90f54d26f2f79a1fccb19d116b0ab8d4cc980897229db1fb732cb6b6c315ce13c9e079e3a93f72efce19da4c34ca6

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-23 13:26

Reported

2024-07-23 13:29

Platform

win10v2004-20240709-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c000c20f354b21e121f89647fcc8ce60N.exe"

Signatures

Remcos

rat remcos

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\c000c20f354b21e121f89647fcc8ce60N.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msword = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\msword.exe\"" C:\Users\Admin\AppData\Local\Temp\c000c20f354b21e121f89647fcc8ce60N.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msword = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\msword.exe\"" C:\Users\Admin\AppData\Roaming\remcos\msword.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2128 set thread context of 3684 N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe C:\Windows\SysWOW64\svchost.exe

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\c000c20f354b21e121f89647fcc8ce60N.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 432 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\c000c20f354b21e121f89647fcc8ce60N.exe C:\Windows\SysWOW64\WScript.exe
PID 432 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\c000c20f354b21e121f89647fcc8ce60N.exe C:\Windows\SysWOW64\WScript.exe
PID 432 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\c000c20f354b21e121f89647fcc8ce60N.exe C:\Windows\SysWOW64\WScript.exe
PID 2952 wrote to memory of 4836 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2952 wrote to memory of 4836 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2952 wrote to memory of 4836 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4836 wrote to memory of 2128 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\remcos\msword.exe
PID 4836 wrote to memory of 2128 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\remcos\msword.exe
PID 4836 wrote to memory of 2128 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\remcos\msword.exe
PID 2128 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe C:\Windows\SysWOW64\svchost.exe
PID 2128 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe C:\Windows\SysWOW64\svchost.exe
PID 2128 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe C:\Windows\SysWOW64\svchost.exe
PID 2128 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe C:\Windows\SysWOW64\svchost.exe
PID 2128 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe C:\Windows\SysWOW64\svchost.exe
PID 2128 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe C:\Windows\SysWOW64\svchost.exe
PID 2128 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe C:\Windows\SysWOW64\svchost.exe
PID 2128 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe C:\Windows\SysWOW64\svchost.exe
PID 2128 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe C:\Windows\SysWOW64\svchost.exe
PID 2128 wrote to memory of 3684 N/A C:\Users\Admin\AppData\Roaming\remcos\msword.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\c000c20f354b21e121f89647fcc8ce60N.exe

"C:\Users\Admin\AppData\Local\Temp\c000c20f354b21e121f89647fcc8ce60N.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\remcos\msword.exe"

C:\Users\Admin\AppData\Roaming\remcos\msword.exe

C:\Users\Admin\AppData\Roaming\remcos\msword.exe

C:\Windows\SysWOW64\svchost.exe

C:\Windows\SysWOW64\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 23.105.131.212:9000 tcp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 23.105.131.212:9000 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 23.105.131.212:9010 tcp
US 8.8.8.8:53 240.143.123.92.in-addr.arpa udp
US 23.105.131.212:9010 tcp
US 23.105.131.212:9000 tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 23.105.131.212:9000 tcp

Files

C:\Users\Admin\AppData\Local\Temp\install.vbs

MD5 60a2d14228422987348aff9cd2af3567
SHA1 3e5a1e1905a81e94c42f2116f328da58d1d36d83
SHA256 ba41f84546b3aff28026a3a4712108f5a1c1beb3f563ce9c23c3aa24d13a4984
SHA512 bb2daee546c4e0e0e39393eee243fbf246ccc64db80e1c57abc4dae0464b23e3f4e6cb588cf7383717aa6b4aa2b1af96af0af3946dca072c99d77aa5825a1d83

C:\Users\Admin\AppData\Roaming\remcos\msword.exe

MD5 c000c20f354b21e121f89647fcc8ce60
SHA1 e10422339e88143cd8187562fc2cf344d6ad5e4d
SHA256 710c780494b8c14c5f9167014ea8d75638d506c5dd674c5ce9aa95a3b991e001
SHA512 ca90781ebebe9f95468a0abcb40dc64ec38312c8154f53f67b83a2bd588076436f0e32fc1e3156234e0ad29b8a92e512997cd28dc9686a23a5088a7c4ed29772

memory/3684-8-0x0000000000400000-0x0000000000420000-memory.dmp

memory/3684-10-0x0000000000400000-0x0000000000420000-memory.dmp

memory/3684-11-0x0000000000400000-0x0000000000420000-memory.dmp

C:\Users\Admin\AppData\Roaming\remcos\logs.dat

MD5 9923d0a2bea55059030e7375a3c9816e
SHA1 16b457c9fcc6cfcb169bc247a1cd04a6f6dca33b
SHA256 e05dfbf0aad34d1f2e472767e69607a656435ee262ecb15071ecc029744c8c06
SHA512 8b14575a54a582f8619faca37d8c22b1e7f640d148b2f78c93e9b5200c43277c1cea7027178cc02d751094a72060978a5f0d0cb727075a78ca8f4fc97862c214