remcos | d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230

Analysis

max time kernel
148s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23/07/2024, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230.exe
Size 2.3MB
Sample240723-wtcemsvdqd
SHA256 d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230
MD5 2a65843b474feff5256bd673b4ff88ae
SHA1 0c80fb17f84d478941ab4d51fddcccaf274da31d
SHA512 7f8a5a684273a031b648129870d493c9a2d63838a8179b8ce32e2c94f956c1a1196ef404d346e6ca42016489fa949b985bc598111dde0249c64c12a668b77292
SSDEEP 49152:E2u/BMdg532rpsjCMqigjns2+a95PlpiH9MzMrcgt4hzNriBldyQJ/MqmG:DrpEZI0BnlJNh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos dollar man collection credential_access discovery rat stealer

Malware Config

Extracted

Family

remcos

Botnet

Dollar Man

178.23.190.118:52499

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-SJ9MVF
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Detected Nirsoft tools 8 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/3320-24-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/3320-31-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/2448-27-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/2448-26-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/3580-23-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/3580-22-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/3320-21-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/3580-35-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/2448-27-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral2/memory/2448-26-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/3580-23-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/3580-22-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/3580-35-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	msbuild.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2820 set thread context of 5052	2820	d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230.exe	85
PID 5052 set thread context of 3580	5052	msbuild.exe	91
PID 5052 set thread context of 2448	5052	msbuild.exe	92
PID 5052 set thread context of 3320	5052	msbuild.exe	93

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msbuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msbuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msbuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msbuild.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3580	msbuild.exe
3580	msbuild.exe
3320	msbuild.exe
3320	msbuild.exe
3580	msbuild.exe
3580	msbuild.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
5052	msbuild.exe
5052	msbuild.exe
5052	msbuild.exe
5052	msbuild.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3320	msbuild.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5052	msbuild.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 5052	2820	d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230.exe	85
PID 2820 wrote to memory of 5052	2820	d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230.exe	85
PID 2820 wrote to memory of 5052	2820	d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230.exe	85
PID 2820 wrote to memory of 5052	2820	d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230.exe	85
PID 2820 wrote to memory of 5052	2820	d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230.exe	85
PID 2820 wrote to memory of 5052	2820	d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230.exe	85
PID 2820 wrote to memory of 5052	2820	d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230.exe	85
PID 2820 wrote to memory of 5052	2820	d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230.exe	85
PID 2820 wrote to memory of 5052	2820	d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230.exe	85
PID 2820 wrote to memory of 5052	2820	d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230.exe	85
PID 2820 wrote to memory of 5052	2820	d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230.exe	85
PID 2820 wrote to memory of 5052	2820	d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230.exe	85
PID 5052 wrote to memory of 4844	5052	msbuild.exe	90
PID 5052 wrote to memory of 4844	5052	msbuild.exe	90
PID 5052 wrote to memory of 4844	5052	msbuild.exe	90
PID 5052 wrote to memory of 3580	5052	msbuild.exe	91
PID 5052 wrote to memory of 3580	5052	msbuild.exe	91
PID 5052 wrote to memory of 3580	5052	msbuild.exe	91
PID 5052 wrote to memory of 3580	5052	msbuild.exe	91
PID 5052 wrote to memory of 2448	5052	msbuild.exe	92
PID 5052 wrote to memory of 2448	5052	msbuild.exe	92
PID 5052 wrote to memory of 2448	5052	msbuild.exe	92
PID 5052 wrote to memory of 2448	5052	msbuild.exe	92
PID 5052 wrote to memory of 3320	5052	msbuild.exe	93
PID 5052 wrote to memory of 3320	5052	msbuild.exe	93
PID 5052 wrote to memory of 3320	5052	msbuild.exe	93
PID 5052 wrote to memory of 3320	5052	msbuild.exe	93

C:\Users\Admin\AppData\Local\Temp\d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230.exe
"C:\Users\Admin\AppData\Local\Temp\d07cfaeced4e8bba1c9fdc8006dc80105cf654759c4d74d4d2d2964a0f6e9230.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe /stext "C:\Users\Admin\AppData\Local\Temp\jqlmgcthzgbu"
    3⤵
    PID:4844
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe /stext "C:\Users\Admin\AppData\Local\Temp\jqlmgcthzgbu"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3580
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe /stext "C:\Users\Admin\AppData\Local\Temp\lkqfhvebnouzywn"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:2448
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe /stext "C:\Users\Admin\AppData\Local\Temp\vmwqinpcjwmmilbkrnb"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 309bdf56c375d2dfa18b56cc903f3183efbf6ecea90515eb859fd014bfc69997
MD5 7af9d62c9372c2b106eb81c8dd5375ea
SHA1 1e8c29df6d62621fd0bfba1783c6e2a76e16ca23
SHA512 86fd57e0b5beb08f88f8c8901d11ec1c80de7c07c0e6290d0e91301d8cffda04fcf3ff881d3b56d7b5ea42922f4ad7c9a51d60ab798cd31a9502ce5d5f4e0296
MD5 SHA1 SHA512

Submit Download

jqlmgcthzgbu

Path C:\Users\Admin\AppData\Local\Temp\jqlmgcthzgbu
Size 4KB
SHA256 c26d371c3209dea4e8cb298ab279746f0209643a1ef95ff627e2cfe193be838b
MD5 1d22632ab7786a15873206bd9aeaaf47
SHA1 f982816e813cfdd43ad3339fa6ca7bf2425651e7
SHA512 456ee2bf5faefb56b5c9864ecb340293412c0ab50d47ff8ead5b0db88f3e61e74278a46063d4b816e1143020344add8bfd8f6baac142d984693e0d7be72e4ae0
SSDEEP 48:wvvv0Q6xfvvcQ6xfdvv0Q6xBvv0Q6xakvv0Q67:mvIxvQp1vIPvIbvI7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2448-25-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2448-27-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2448-14-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/2448-26-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3320-21-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3320-20-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3320-17-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3320-24-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3320-31-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3580-22-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3580-23-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3580-13-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3580-18-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3580-35-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/5052-12-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5052-40-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/5052-11-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5052-10-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5052-9-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5052-8-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5052-7-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5052-4-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5052-33-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5052-3-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5052-2-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5052-37-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/5052-41-0x0000000010000000-0x0000000010019000-memory.dmp

Download

memory/5052-0-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5052-42-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5052-44-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5052-45-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5052-49-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5052-1-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5052-53-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5052-54-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5052-61-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5052-62-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5052-69-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5052-70-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5052-77-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/5052-78-0x0000000000400000-0x0000000000482000-memory.dmp

Download