Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12-08-2024 20:51
Behavioral task
behavioral1
Sample
remcos_a.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
remcos_a.exe
Resource
win10v2004-20240802-en
General
-
Target
remcos_a.exe
-
Size
483KB
-
MD5
3f36f84b4e51cafed0c967c2cc116f8f
-
SHA1
49df4cd659e4e38d6a841fed8acd6a00d9a98b23
-
SHA256
b5d4fa666ad01922b1bca3c725a33ed3a269dcb26ea51f59a4cda26a37ccbd9c
-
SHA512
1b7cc5b652c95664d10084f6bb2727e9f7366c74474b39433a0c14e213d4ff4ce25a2aea1833b987edaa3d2de7a534cda56b21a330ff4aca95a2fa93fcd46877
-
SSDEEP
6144:wTz+c6KHYBhDc1RGJdv//NkUn+N5Bkf/0TELRvIZPjbsAOZZBAXccrlT4:wTlrYw1RUh3NFn+N5WfIQIjbs/ZB+T4
Malware Config
Extracted
remcos
RemoteHost
k-peterson.gl.at.ply.gg:64076
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
Windows.exe
-
copy_folder
Windows
-
delete_file
false
-
hide_file
true
-
hide_keylog_file
false
-
install_flag
true
-
install_path
%WinDir%\System32
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-0E62CJ
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
-
Processes:
reg.exereg.exereg.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Executes dropped EXE 1 IoCs
Processes:
Windows.exepid Process 2840 Windows.exe -
Loads dropped DLL 2 IoCs
Processes:
remcos_a.exepid Process 2712 remcos_a.exe 2712 remcos_a.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
remcos_a.exeWindows.exeiexplore.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-0E62CJ = "\"C:\\Windows\\SysWOW64\\Windows\\Windows.exe\"" remcos_a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-0E62CJ = "\"C:\\Windows\\SysWOW64\\Windows\\Windows.exe\"" remcos_a.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-0E62CJ = "\"C:\\Windows\\SysWOW64\\Windows\\Windows.exe\"" Windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-0E62CJ = "\"C:\\Windows\\SysWOW64\\Windows\\Windows.exe\"" Windows.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-0E62CJ = "\"C:\\Windows\\SysWOW64\\Windows\\Windows.exe\"" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-0E62CJ = "\"C:\\Windows\\SysWOW64\\Windows\\Windows.exe\"" iexplore.exe -
Drops file in System32 directory 3 IoCs
Processes:
remcos_a.exedescription ioc Process File created C:\Windows\SysWOW64\Windows\Windows.exe remcos_a.exe File opened for modification C:\Windows\SysWOW64\Windows\Windows.exe remcos_a.exe File opened for modification C:\Windows\SysWOW64\Windows remcos_a.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Windows.exeiexplore.exedescription pid Process procid_target PID 2840 set thread context of 2784 2840 Windows.exe 35 PID 2784 set thread context of 1060 2784 iexplore.exe 40 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
reg.execmd.exereg.execmd.exereg.execmd.exeremcos_a.exeWindows.exeiexplore.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language remcos_a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Windows.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe -
Modifies registry key 1 TTPs 3 IoCs
Processes:
reg.exereg.exereg.exepid Process 2808 reg.exe 1104 reg.exe 2564 reg.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Windows.exepid Process 2840 Windows.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid Process 2784 iexplore.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
Windows.exeiexplore.exepid Process 2840 Windows.exe 2784 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid Process 2784 iexplore.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
remcos_a.execmd.exeWindows.exeiexplore.execmd.execmd.exedescription pid Process procid_target PID 2712 wrote to memory of 2812 2712 remcos_a.exe 30 PID 2712 wrote to memory of 2812 2712 remcos_a.exe 30 PID 2712 wrote to memory of 2812 2712 remcos_a.exe 30 PID 2712 wrote to memory of 2812 2712 remcos_a.exe 30 PID 2812 wrote to memory of 2808 2812 cmd.exe 32 PID 2812 wrote to memory of 2808 2812 cmd.exe 32 PID 2812 wrote to memory of 2808 2812 cmd.exe 32 PID 2812 wrote to memory of 2808 2812 cmd.exe 32 PID 2712 wrote to memory of 2840 2712 remcos_a.exe 33 PID 2712 wrote to memory of 2840 2712 remcos_a.exe 33 PID 2712 wrote to memory of 2840 2712 remcos_a.exe 33 PID 2712 wrote to memory of 2840 2712 remcos_a.exe 33 PID 2840 wrote to memory of 2752 2840 Windows.exe 34 PID 2840 wrote to memory of 2752 2840 Windows.exe 34 PID 2840 wrote to memory of 2752 2840 Windows.exe 34 PID 2840 wrote to memory of 2752 2840 Windows.exe 34 PID 2840 wrote to memory of 2784 2840 Windows.exe 35 PID 2840 wrote to memory of 2784 2840 Windows.exe 35 PID 2840 wrote to memory of 2784 2840 Windows.exe 35 PID 2840 wrote to memory of 2784 2840 Windows.exe 35 PID 2840 wrote to memory of 2784 2840 Windows.exe 35 PID 2784 wrote to memory of 2604 2784 iexplore.exe 37 PID 2784 wrote to memory of 2604 2784 iexplore.exe 37 PID 2784 wrote to memory of 2604 2784 iexplore.exe 37 PID 2784 wrote to memory of 2604 2784 iexplore.exe 37 PID 2604 wrote to memory of 1104 2604 cmd.exe 39 PID 2604 wrote to memory of 1104 2604 cmd.exe 39 PID 2604 wrote to memory of 1104 2604 cmd.exe 39 PID 2604 wrote to memory of 1104 2604 cmd.exe 39 PID 2784 wrote to memory of 1060 2784 iexplore.exe 40 PID 2784 wrote to memory of 1060 2784 iexplore.exe 40 PID 2784 wrote to memory of 1060 2784 iexplore.exe 40 PID 2784 wrote to memory of 1060 2784 iexplore.exe 40 PID 2784 wrote to memory of 1060 2784 iexplore.exe 40 PID 2752 wrote to memory of 2564 2752 cmd.exe 41 PID 2752 wrote to memory of 2564 2752 cmd.exe 41 PID 2752 wrote to memory of 2564 2752 cmd.exe 41 PID 2752 wrote to memory of 2564 2752 cmd.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\remcos_a.exe"C:\Users\Admin\AppData\Local\Temp\remcos_a.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2808
-
-
-
C:\Windows\SysWOW64\Windows\Windows.exe"C:\Windows\SysWOW64\Windows\Windows.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2564
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"3⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f5⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1104
-
-
-
C:\Windows\SysWOW64\svchost.exesvchost.exe4⤵PID:1060
-
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
230B
MD552e834164e22b4bedc5fc7a392fb0d12
SHA1cf2e9c227720e029d507db638440108847492c18
SHA2560548f1987eae108599531abad36782ffd8baa5d57782bcb0f6b1c95c09f2c628
SHA512cb7e2129f9752e2f2daab38f635d1a55b6316cb17a56eb84e79c922149472c5e8ed1e07bc07098d87228c753632cd1667fdf42b80811dd22025c5cf08c7a1cae
-
Filesize
483KB
MD53f36f84b4e51cafed0c967c2cc116f8f
SHA149df4cd659e4e38d6a841fed8acd6a00d9a98b23
SHA256b5d4fa666ad01922b1bca3c725a33ed3a269dcb26ea51f59a4cda26a37ccbd9c
SHA5121b7cc5b652c95664d10084f6bb2727e9f7366c74474b39433a0c14e213d4ff4ce25a2aea1833b987edaa3d2de7a534cda56b21a330ff4aca95a2fa93fcd46877