Analysis
-
max time kernel
72s -
max time network
69s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12-08-2024 05:56
Behavioral task
behavioral1
Sample
remcos_a.exe
Resource
win7-20240708-en
General
-
Target
remcos_a.exe
-
Size
483KB
-
MD5
a71c2ec29d24f8abfc5686b136f71f22
-
SHA1
01929dffa443b3d17d2c9f32e2efa31759aec136
-
SHA256
de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9
-
SHA512
10de0945c8640a495b8c2617f55d2de75cd05b87f99a6e201bb2d12a9f522dc0536e161d64c5be5ea13672bc4492d3effa9f2b25540834e09e001d826b4dd565
-
SSDEEP
6144:wTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZBAXccriT4:wTlrYw1RUh3NFn+N5WfIQIjbs/ZBFT4
Malware Config
Extracted
remcos
RemoteHost
192.168.1.252:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-39LPSU
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Processes:
reg.exereg.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
remcos_a.exeiexplore.exedescription pid Process procid_target PID 2692 set thread context of 1664 2692 remcos_a.exe 31 PID 1664 set thread context of 1164 1664 iexplore.exe 36 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
remcos_a.execmd.exeiexplore.exereg.execmd.exereg.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcos_a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
remcos_a.exepid Process 2692 remcos_a.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
remcos_a.exeiexplore.exepid Process 2692 remcos_a.exe 1664 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid Process 1664 iexplore.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
remcos_a.execmd.exeiexplore.execmd.exedescription pid Process procid_target PID 2692 wrote to memory of 1068 2692 remcos_a.exe 30 PID 2692 wrote to memory of 1068 2692 remcos_a.exe 30 PID 2692 wrote to memory of 1068 2692 remcos_a.exe 30 PID 2692 wrote to memory of 1068 2692 remcos_a.exe 30 PID 2692 wrote to memory of 1664 2692 remcos_a.exe 31 PID 2692 wrote to memory of 1664 2692 remcos_a.exe 31 PID 2692 wrote to memory of 1664 2692 remcos_a.exe 31 PID 2692 wrote to memory of 1664 2692 remcos_a.exe 31 PID 2692 wrote to memory of 1664 2692 remcos_a.exe 31 PID 1068 wrote to memory of 2920 1068 cmd.exe 34 PID 1068 wrote to memory of 2920 1068 cmd.exe 34 PID 1068 wrote to memory of 2920 1068 cmd.exe 34 PID 1068 wrote to memory of 2920 1068 cmd.exe 34 PID 1664 wrote to memory of 1016 1664 iexplore.exe 33 PID 1664 wrote to memory of 1016 1664 iexplore.exe 33 PID 1664 wrote to memory of 1016 1664 iexplore.exe 33 PID 1664 wrote to memory of 1016 1664 iexplore.exe 33 PID 1016 wrote to memory of 2280 1016 cmd.exe 37 PID 1016 wrote to memory of 2280 1016 cmd.exe 37 PID 1016 wrote to memory of 2280 1016 cmd.exe 37 PID 1016 wrote to memory of 2280 1016 cmd.exe 37 PID 1664 wrote to memory of 1164 1664 iexplore.exe 36 PID 1664 wrote to memory of 1164 1664 iexplore.exe 36 PID 1664 wrote to memory of 1164 1664 iexplore.exe 36 PID 1664 wrote to memory of 1164 1664 iexplore.exe 36 PID 1664 wrote to memory of 1164 1664 iexplore.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\remcos_a.exe"C:\Users\Admin\AppData\Local\Temp\remcos_a.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2920
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2280
-
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:1164
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD5816fcf1d5c3a96e059728032a2547e54
SHA1307b21319e23f2541b59a4fde9d56b5fa2140fb9
SHA256404bf228af5660d34eb8b9ad14f74fe35c82c3fd38bce27b22119ec4d4b11303
SHA512318e9ee8bdbf245d5fcc8c7aaea677d66442f85b2d5a21ae2fd96b589f32c61757c85c3db24e45a04d06563c2164f4d9b02ca73a469fbebe81aa5053463efafa