remcos | b5aefdeb0f451c2edd13b5d42cb64234f5b513997af891ae3f5c187d15701602

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b5aefdeb0f451c2edd13b5d42cb64234f5b513997af891ae3f5c187d15701602.exe
Size 619KB
Sample240724-danpfstglj
SHA256 b5aefdeb0f451c2edd13b5d42cb64234f5b513997af891ae3f5c187d15701602
MD5 eecdcad7501f2a7308d40820445e2aa9
SHA1 898a2f518726c6866ebd3583b634d8c0043f543d
SHA512 ff0c5db3c2fc1a8db8a536bcedcdb7406841d74400e3246fbbbea2450f5ed336257ec0b01d616105f0650f9e0be9bda93dec037f56b6845044146c8909cc4d05
SSDEEP 12288:7T5tGDZWWO4K0GFYSE+ZAaDNtde8N1LGayE3cqU2ricGtq:7T5QDZWb4K0GFYCZA4tde863Ew2G0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost collection credential_access discovery execution rat stealer

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

212.162.149.80:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-WVQ56B
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/3808-63-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/3588-62-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/3388-66-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/3588-62-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/3808-63-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Loads dropped DLL 1 IoCs

pid	Process
1912	b5aefdeb0f451c2edd13b5d42cb64234f5b513997af891ae3f5c187d15701602.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
756	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
564	powershell.exe
756	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 564 set thread context of 756	564	powershell.exe	96
PID 756 set thread context of 3808	756	wab.exe	97
PID 756 set thread context of 3588	756	wab.exe	98
PID 756 set thread context of 3388	756	wab.exe	102

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
564	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b5aefdeb0f451c2edd13b5d42cb64234f5b513997af891ae3f5c187d15701602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
564	powershell.exe
3808	wab.exe
3808	wab.exe
3388	wab.exe
3388	wab.exe
3808	wab.exe
3808	wab.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
564	powershell.exe
756	wab.exe
756	wab.exe
756	wab.exe
756	wab.exe
756	wab.exe
756	wab.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	564	powershell.exe
Token: SeDebugPrivilege	3388	wab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
756	wab.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 564	1912	b5aefdeb0f451c2edd13b5d42cb64234f5b513997af891ae3f5c187d15701602.exe	84
PID 1912 wrote to memory of 564	1912	b5aefdeb0f451c2edd13b5d42cb64234f5b513997af891ae3f5c187d15701602.exe	84
PID 1912 wrote to memory of 564	1912	b5aefdeb0f451c2edd13b5d42cb64234f5b513997af891ae3f5c187d15701602.exe	84
PID 564 wrote to memory of 756	564	powershell.exe	96
PID 564 wrote to memory of 756	564	powershell.exe	96
PID 564 wrote to memory of 756	564	powershell.exe	96
PID 564 wrote to memory of 756	564	powershell.exe	96
PID 564 wrote to memory of 756	564	powershell.exe	96
PID 756 wrote to memory of 3808	756	wab.exe	97
PID 756 wrote to memory of 3808	756	wab.exe	97
PID 756 wrote to memory of 3808	756	wab.exe	97
PID 756 wrote to memory of 3808	756	wab.exe	97
PID 756 wrote to memory of 3588	756	wab.exe	98
PID 756 wrote to memory of 3588	756	wab.exe	98
PID 756 wrote to memory of 3588	756	wab.exe	98
PID 756 wrote to memory of 3588	756	wab.exe	98
PID 756 wrote to memory of 2544	756	wab.exe	99
PID 756 wrote to memory of 2544	756	wab.exe	99
PID 756 wrote to memory of 2544	756	wab.exe	99
PID 756 wrote to memory of 4520	756	wab.exe	100
PID 756 wrote to memory of 4520	756	wab.exe	100
PID 756 wrote to memory of 4520	756	wab.exe	100
PID 756 wrote to memory of 3900	756	wab.exe	101
PID 756 wrote to memory of 3900	756	wab.exe	101
PID 756 wrote to memory of 3900	756	wab.exe	101
PID 756 wrote to memory of 3388	756	wab.exe	102
PID 756 wrote to memory of 3388	756	wab.exe	102
PID 756 wrote to memory of 3388	756	wab.exe	102
PID 756 wrote to memory of 3388	756	wab.exe	102

C:\Users\Admin\AppData\Local\Temp\b5aefdeb0f451c2edd13b5d42cb64234f5b513997af891ae3f5c187d15701602.exe
"C:\Users\Admin\AppData\Local\Temp\b5aefdeb0f451c2edd13b5d42cb64234f5b513997af891ae3f5c187d15701602.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle minimized " $Objectivism86=Get-Content 'C:\Users\Admin\AppData\Local\tugtelsers\Donnee.Dat';$Anticolic=$Objectivism86.SubString(56537,3);.$Anticolic($Objectivism86)"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Program Files (x86)\windows mail\wab.exe
    "C:\Program Files (x86)\windows mail\wab.exe"
    3⤵
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:756
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\foxofhwllffwrxaodykpvmindaereyo"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3808
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\qqch"
      4⤵
      Accesses Microsoft Outlook accounts
      System Location Discovery: System Language Discovery
      PID:3588
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\akirgrs"
      4⤵
      PID:2544
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\akirgrs"
      4⤵
      PID:4520
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\akirgrs"
      4⤵
      PID:3900
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\akirgrs"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 102B
SHA256 5269fa673d3f81b6ee4c7145644377f671294a1ba0f096cda54fc18e4dffc4a3
MD5 b19b9d7b0f58297b235fa3b05f3d2e32
SHA1 bfb42dab76aae78b9fc2322dc5705f892d14cc16
SHA512 0cab04b67405d9697cf46ee22cdf344e7964411b2948f0a7dc6587a4acd6a0a4b5bfb063db67b2b9ed690d9251af4dad53a3d51d80484ec9f899cc45ab89418f
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_1yfndqeh.lq0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1yfndqeh.lq0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

foxofhwllffwrxaodykpvmindaereyo

Path C:\Users\Admin\AppData\Local\Temp\foxofhwllffwrxaodykpvmindaereyo
Size 4KB
SHA256 99581e3fb78083e7edb6995aacc8c63d2c8e8814271fc3042cee08ee5858bef9
MD5 bb67cb4a1d558663b754221fc46df47d
SHA1 25c46e3fc8d2d615f37caf361bbe31a15808aaae
SHA512 7607a7963b0263d11eab96ea762d779d0ccb2173df2d57a14b02979b27118fb04d719723e9397103f1c3cdba14629c2179756a1f4c98ad75e1a0ea197e911d93
SSDEEP 48:wvvv0QvxfvvcQvxfdvv0QvxBvv0Qvxakvv0Qv7:mvpxvRp1vpPvpbvp7
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nseD0EE.tmp\nsExec.dll
Size 7KB
SHA256 14ebfa0711b48ec748b6e4985db4b99a827996ae44b28122d16f14d0d0f51bb6
MD5 84bcbefa5fe3d82647a15f135f22fb2a
SHA1 7c23a0c1a8b185f5af456dafa63a3c1207d8c1dc
SHA512 c0e4ca46be6892b2cec77992e809897bcb768e3436d9bd81e4f84f4f1da9ef123ae902783147d263ac8019c732f131654694ad4105888c1f310c7bce8844b7dd
SSDEEP 96:0Vl/7KOuFlKHMpXGu8FX6eT3sQk1u2QmIG4fa9IJ4V:0Vl+hSs2u85TTHkZQmgy9I0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Donnee.Dat

Path C:\Users\Admin\AppData\Local\tugtelsers\Donnee.Dat
Size 55KB
SHA256 0a34a8d31b119c3d015f57ac218e2bb0c710659b5f99dc9a12fd19d6480dd2f4
MD5 6adc76bec8a3a06e3a9569932e4252bf
SHA1 7b150339fc42e2737561b1a45b8ba9be77669443
SHA512 52b6d53ed579e88c0a848fadbdaa7ff94ed36732dc98088e9e1b4bb6b85f6825181feac57bccc165957a210b4c64fc847bcd0911386babc388e6d44a711f69e4
SSDEEP 1536:CxrW80tpiqbO3GraZnHjBTidChzhMiX3AYYv:C08E1aznHtiYhfABv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Varmeskabet.Api

Path C:\Users\Admin\AppData\Local\tugtelsers\Varmeskabet.Api
Size 302KB
SHA256 d9879e1a4217a17f14492a6425517968b3983226f47303480005cfbaf819d61f
MD5 5b50ee009a67a026ae91ca38a2d18663
SHA1 3ddf7820e3026ee8c93a469d919fa21f3a8c9e6c
SHA512 aee74a12a5cc3a40fe90e04fccb5b4505216ca18be6db1b1243f92526d6bc41d3e5c607d32ed59cfb1d0e2e54f65dff6bb283a21d658154bcc19b718c6e50d69
SSDEEP 6144:2ZLJ9yb/i3LyAc2yLk2aCW5wprVKv1jWZeB0a:2ZLG/i3LTyonCW5wpIv1jYa
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/564-48-0x0000000073950000-0x0000000074100000-memory.dmp

Download

memory/564-47-0x0000000073950000-0x0000000074100000-memory.dmp

Download

memory/564-18-0x0000000005D30000-0x0000000005D96000-memory.dmp

Download

memory/564-17-0x0000000073950000-0x0000000074100000-memory.dmp

Download

memory/564-25-0x0000000005E10000-0x0000000006164000-memory.dmp

Download

memory/564-31-0x0000000006430000-0x000000000647C000-memory.dmp

Download

memory/564-30-0x0000000006400000-0x000000000641E000-memory.dmp

Download

memory/564-32-0x00000000073E0000-0x0000000007476000-memory.dmp

Download

memory/564-33-0x00000000068E0000-0x00000000068FA000-memory.dmp

Download

memory/564-34-0x0000000006930000-0x0000000006952000-memory.dmp

Download

memory/564-35-0x0000000007C50000-0x00000000081F4000-memory.dmp

Download

memory/564-16-0x0000000005410000-0x0000000005432000-memory.dmp

Download

memory/564-37-0x0000000008880000-0x0000000008EFA000-memory.dmp

Download

memory/564-39-0x0000000073950000-0x0000000074100000-memory.dmp

Download

memory/564-40-0x0000000073950000-0x0000000074100000-memory.dmp

Download

memory/564-41-0x0000000073950000-0x0000000074100000-memory.dmp

Download

memory/564-15-0x0000000073950000-0x0000000074100000-memory.dmp

Download

memory/564-43-0x0000000073950000-0x0000000074100000-memory.dmp

Download

memory/564-45-0x0000000073950000-0x0000000074100000-memory.dmp

Download

memory/564-44-0x0000000008F00000-0x000000000B563000-memory.dmp

Download

memory/564-46-0x000000007395E000-0x000000007395F000-memory.dmp

Download

memory/564-12-0x000000007395E000-0x000000007395F000-memory.dmp

Download

memory/564-14-0x0000000005590000-0x0000000005BB8000-memory.dmp

Download

memory/564-50-0x0000000073950000-0x0000000074100000-memory.dmp

Download

memory/564-51-0x0000000073950000-0x0000000074100000-memory.dmp

Download

memory/564-13-0x0000000002E20000-0x0000000002E56000-memory.dmp

Download

memory/564-19-0x0000000005DA0000-0x0000000005E06000-memory.dmp

Download

memory/756-91-0x0000000001050000-0x00000000022A4000-memory.dmp

Download

memory/756-94-0x0000000001050000-0x00000000022A4000-memory.dmp

Download

memory/756-112-0x0000000001050000-0x00000000022A4000-memory.dmp

Download

memory/756-109-0x0000000001050000-0x00000000022A4000-memory.dmp

Download

memory/756-76-0x0000000020550000-0x0000000020569000-memory.dmp

Download

memory/756-73-0x0000000020550000-0x0000000020569000-memory.dmp

Download

memory/756-100-0x0000000001050000-0x00000000022A4000-memory.dmp

Download

memory/756-106-0x0000000001050000-0x00000000022A4000-memory.dmp

Download

memory/756-82-0x0000000001050000-0x00000000022A4000-memory.dmp

Download

memory/756-52-0x0000000001050000-0x00000000022A4000-memory.dmp

Download

memory/756-79-0x0000000001050000-0x00000000022A4000-memory.dmp

Download

memory/756-97-0x0000000001050000-0x00000000022A4000-memory.dmp

Download

memory/756-56-0x0000000001050000-0x00000000022A4000-memory.dmp

Download

memory/756-103-0x0000000001050000-0x00000000022A4000-memory.dmp

Download

memory/756-77-0x0000000020550000-0x0000000020569000-memory.dmp

Download

memory/756-88-0x0000000001050000-0x00000000022A4000-memory.dmp

Download

memory/756-85-0x0000000001050000-0x00000000022A4000-memory.dmp

Download

memory/3388-66-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3388-65-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3388-64-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3588-62-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3588-59-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3588-61-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3808-63-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3808-58-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3808-60-0x0000000000400000-0x0000000000478000-memory.dmp

Download