Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12-08-2024 05:56
Behavioral task
behavioral1
Sample
remcos_a.exe
Resource
win7-20240708-en
General
-
Target
remcos_a.exe
-
Size
483KB
-
MD5
a71c2ec29d24f8abfc5686b136f71f22
-
SHA1
01929dffa443b3d17d2c9f32e2efa31759aec136
-
SHA256
de06ee1f57bc4475cf0a9a7352b0ca51b31bee6aee54429982a6ab7bdf8795e9
-
SHA512
10de0945c8640a495b8c2617f55d2de75cd05b87f99a6e201bb2d12a9f522dc0536e161d64c5be5ea13672bc4492d3effa9f2b25540834e09e001d826b4dd565
-
SSDEEP
6144:wTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZBAXccriT4:wTlrYw1RUh3NFn+N5WfIQIjbs/ZBFT4
Malware Config
Extracted
remcos
RemoteHost
192.168.1.252:2404
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-39LPSU
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Processes:
reg.exereg.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
remcos_a.exeiexplore.exedescription pid Process procid_target PID 3680 set thread context of 400 3680 remcos_a.exe 85 PID 400 set thread context of 5032 400 iexplore.exe 89 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
remcos_a.exeiexplore.execmd.execmd.exereg.exereg.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcos_a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe -
Modifies registry key 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
remcos_a.exepid Process 3680 remcos_a.exe 3680 remcos_a.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
remcos_a.exeiexplore.exepid Process 3680 remcos_a.exe 400 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid Process 400 iexplore.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
remcos_a.exeiexplore.execmd.execmd.exedescription pid Process procid_target PID 3680 wrote to memory of 2328 3680 remcos_a.exe 84 PID 3680 wrote to memory of 2328 3680 remcos_a.exe 84 PID 3680 wrote to memory of 2328 3680 remcos_a.exe 84 PID 3680 wrote to memory of 400 3680 remcos_a.exe 85 PID 3680 wrote to memory of 400 3680 remcos_a.exe 85 PID 3680 wrote to memory of 400 3680 remcos_a.exe 85 PID 3680 wrote to memory of 400 3680 remcos_a.exe 85 PID 400 wrote to memory of 4684 400 iexplore.exe 87 PID 400 wrote to memory of 4684 400 iexplore.exe 87 PID 400 wrote to memory of 4684 400 iexplore.exe 87 PID 400 wrote to memory of 5032 400 iexplore.exe 89 PID 400 wrote to memory of 5032 400 iexplore.exe 89 PID 400 wrote to memory of 5032 400 iexplore.exe 89 PID 400 wrote to memory of 5032 400 iexplore.exe 89 PID 2328 wrote to memory of 4008 2328 cmd.exe 90 PID 2328 wrote to memory of 4008 2328 cmd.exe 90 PID 2328 wrote to memory of 4008 2328 cmd.exe 90 PID 4684 wrote to memory of 4536 4684 cmd.exe 91 PID 4684 wrote to memory of 4536 4684 cmd.exe 91 PID 4684 wrote to memory of 4536 4684 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\remcos_a.exe"C:\Users\Admin\AppData\Local\Temp\remcos_a.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4008
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:4536
-
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe3⤵PID:5032
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD577310a616b3510a28f59a91ae773df6c
SHA16870d45cd6eab3d31ad8c1a7080dfc40d6ad493e
SHA256a8b586fe82550ddeab02e21f99f0dd76b5a7b373ea9b5e8fdcbafbac4e1bf8f1
SHA51242dff0cb1f99a31fc60ed88a954b39459dc2b64874d30b9df5336d6a96830515ad456dd62fd0b97bb3e1f99cf19858d83c19f833cc9fc8ad248424e325e68d00