remcos | 9663758105ed0b4131d3cf8f4d45228aa59fdb90ccb0acc4f5332697e7bf5263

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 01:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LisectAVT_2403002C_7.exe
Size 844KB
Sample240725-b9ff1sthnc
SHA256 9663758105ed0b4131d3cf8f4d45228aa59fdb90ccb0acc4f5332697e7bf5263
MD5 1614a8c9c56593373f8a1b31b8e8d415
SHA1 3c9625fb2bc850309a2d419a9830700d08d0aa14
SHA512 3e5c789c8fe1409753d76a935eef997e0cd82227d2a6aa24efa9a64f7fe2ac64cc7fee7fa2c56a3825ba49bc49d7d018e775d158020339336dd89d8eeef864e5
SSDEEP 12288:sp4+EpVjZsEpt4Q8gn/pu6JnTzk9Sv+LWK+WGnsVNvlkYkBCdonHi6NQkt8YfhvN:m4Fpl+yD8c/sXwnmYk4HtSkt8WhMUP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos 7272626 discovery evasion execution persistence rat trojan

Malware Config

Extracted

Family

remcos

Botnet

7272626

windowsserverfebarch.duckdns.org:5841

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
72626-GNX3E4
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2652	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
2704	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
2264	cmd.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	LisectAVT_2403002C_7.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2704 set thread context of 2776	2704	svchost.exe	44

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2812	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2820	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
1984	LisectAVT_2403002C_7.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe
2704	svchost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1984	LisectAVT_2403002C_7.exe
Token: SeDebugPrivilege	2704	svchost.exe
Token: SeDebugPrivilege	2652	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2256	1984	LisectAVT_2403002C_7.exe	31
PID 1984 wrote to memory of 2256	1984	LisectAVT_2403002C_7.exe	31
PID 1984 wrote to memory of 2256	1984	LisectAVT_2403002C_7.exe	31
PID 1984 wrote to memory of 2264	1984	LisectAVT_2403002C_7.exe	33
PID 1984 wrote to memory of 2264	1984	LisectAVT_2403002C_7.exe	33
PID 1984 wrote to memory of 2264	1984	LisectAVT_2403002C_7.exe	33
PID 2264 wrote to memory of 2812	2264	cmd.exe	35
PID 2264 wrote to memory of 2812	2264	cmd.exe	35
PID 2264 wrote to memory of 2812	2264	cmd.exe	35
PID 2256 wrote to memory of 2820	2256	cmd.exe	36
PID 2256 wrote to memory of 2820	2256	cmd.exe	36
PID 2256 wrote to memory of 2820	2256	cmd.exe	36
PID 2264 wrote to memory of 2704	2264	cmd.exe	37
PID 2264 wrote to memory of 2704	2264	cmd.exe	37
PID 2264 wrote to memory of 2704	2264	cmd.exe	37
PID 2704 wrote to memory of 2652	2704	svchost.exe	38
PID 2704 wrote to memory of 2652	2704	svchost.exe	38
PID 2704 wrote to memory of 2652	2704	svchost.exe	38
PID 2704 wrote to memory of 2696	2704	svchost.exe	40
PID 2704 wrote to memory of 2696	2704	svchost.exe	40
PID 2704 wrote to memory of 2696	2704	svchost.exe	40
PID 2704 wrote to memory of 2696	2704	svchost.exe	40
PID 2704 wrote to memory of 2592	2704	svchost.exe	41
PID 2704 wrote to memory of 2592	2704	svchost.exe	41
PID 2704 wrote to memory of 2592	2704	svchost.exe	41
PID 2704 wrote to memory of 2592	2704	svchost.exe	41
PID 2704 wrote to memory of 2592	2704	svchost.exe	41
PID 2704 wrote to memory of 2592	2704	svchost.exe	41
PID 2704 wrote to memory of 2592	2704	svchost.exe	41
PID 2704 wrote to memory of 2592	2704	svchost.exe	41
PID 2704 wrote to memory of 2592	2704	svchost.exe	41
PID 2704 wrote to memory of 2592	2704	svchost.exe	41
PID 2704 wrote to memory of 2592	2704	svchost.exe	41
PID 2704 wrote to memory of 2592	2704	svchost.exe	41
PID 2704 wrote to memory of 1004	2704	svchost.exe	42
PID 2704 wrote to memory of 1004	2704	svchost.exe	42
PID 2704 wrote to memory of 1004	2704	svchost.exe	42
PID 2704 wrote to memory of 1004	2704	svchost.exe	42
PID 2704 wrote to memory of 1004	2704	svchost.exe	42
PID 2704 wrote to memory of 1004	2704	svchost.exe	42
PID 2704 wrote to memory of 1004	2704	svchost.exe	42
PID 2704 wrote to memory of 1004	2704	svchost.exe	42
PID 2704 wrote to memory of 1004	2704	svchost.exe	42
PID 2704 wrote to memory of 1004	2704	svchost.exe	42
PID 2704 wrote to memory of 1004	2704	svchost.exe	42
PID 2704 wrote to memory of 2908	2704	svchost.exe	43
PID 2704 wrote to memory of 2908	2704	svchost.exe	43
PID 2704 wrote to memory of 2908	2704	svchost.exe	43
PID 2704 wrote to memory of 2908	2704	svchost.exe	43
PID 2704 wrote to memory of 2908	2704	svchost.exe	43
PID 2704 wrote to memory of 2908	2704	svchost.exe	43
PID 2704 wrote to memory of 2908	2704	svchost.exe	43
PID 2704 wrote to memory of 2908	2704	svchost.exe	43
PID 2704 wrote to memory of 2908	2704	svchost.exe	43
PID 2704 wrote to memory of 2908	2704	svchost.exe	43
PID 2704 wrote to memory of 2908	2704	svchost.exe	43
PID 2704 wrote to memory of 2908	2704	svchost.exe	43
PID 2704 wrote to memory of 2776	2704	svchost.exe	44
PID 2704 wrote to memory of 2776	2704	svchost.exe	44
PID 2704 wrote to memory of 2776	2704	svchost.exe	44
PID 2704 wrote to memory of 2776	2704	svchost.exe	44
PID 2704 wrote to memory of 2776	2704	svchost.exe	44
PID 2704 wrote to memory of 2776	2704	svchost.exe	44
PID 2704 wrote to memory of 2776	2704	svchost.exe	44

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002C_7.exe
"C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002C_7.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2820
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpF316.tmp.bat""
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2812
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2704
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\svchost.exe" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2652
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
      4⤵
      PID:2696
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
      4⤵
      PID:2592
  - - C:\Windows\System32\calc.exe
      "C:\Windows\System32\calc.exe"
      4⤵
      PID:1004
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      4⤵
      PID:2908
  - - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2776
  - - C:\Program Files (x86)\Windows Media Player\wmplayer.exe
      "C:\Program Files (x86)\Windows Media Player\wmplayer.exe"
      4⤵
      PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpF316.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpF316.tmp.bat
Size 151B
SHA256 800ae8cc016c51a2a28867493080a1665946ec39cd778511a2ff2c969ac84226
MD5 282cb5f267c9f77b576856666214a0e4
SHA1 09c22c18f2d4ca21fa2e783f96e9023c3b7302ca
SHA512 7c7132d5f91068b7c8f13b238b2dd737ec8028a6acf0d36d1c19d4c78a1d4f37fac182e21b6bcf574a57d5db34d60699545214bdc41ccd89614e1c83caed8d0e
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path \Users\Admin\AppData\Roaming\svchost.exe
Size 844KB
SHA256 9663758105ed0b4131d3cf8f4d45228aa59fdb90ccb0acc4f5332697e7bf5263
MD5 1614a8c9c56593373f8a1b31b8e8d415
SHA1 3c9625fb2bc850309a2d419a9830700d08d0aa14
SHA512 3e5c789c8fe1409753d76a935eef997e0cd82227d2a6aa24efa9a64f7fe2ac64cc7fee7fa2c56a3825ba49bc49d7d018e775d158020339336dd89d8eeef864e5
SSDEEP 12288:sp4+EpVjZsEpt4Q8gn/pu6JnTzk9Sv+LWK+WGnsVNvlkYkBCdonHi6NQkt8YfhvN:m4Fpl+yD8c/sXwnmYk4HtSkt8WhMUP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1984-0-0x000007FEF5E13000-0x000007FEF5E14000-memory.dmp

Download

memory/1984-1-0x0000000000110000-0x000000000011C000-memory.dmp

Download

memory/1984-2-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Download

memory/1984-3-0x000000001AC10000-0x000000001ACE0000-memory.dmp

Download

memory/1984-4-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Download

memory/1984-14-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Download

memory/2592-32-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2592-40-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2592-38-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2592-36-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2592-34-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2592-30-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2592-28-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2592-26-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2652-24-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Download

memory/2652-25-0x0000000002860000-0x0000000002868000-memory.dmp

Download

memory/2704-19-0x0000000001060000-0x000000000106C000-memory.dmp

Download

memory/2776-92-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2776-93-0x0000000000400000-0x000000000047F000-memory.dmp

Download