remcos | b8022e8002a8e01a6364fdcc6d53275b6edf3d196e36f0b4c9645de2570cfd48

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-09-2024 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8022e8002a8e01a6364fdcc6d53275b6edf3d196e36f0b4c9645de2570cfd48.exe
Size

1.5MB
MD5

bd6420aaf066a5b4533598417866bc67
SHA1

cf56376da61f4f34034fa4cc525e708052a5ecd3
SHA256

b8022e8002a8e01a6364fdcc6d53275b6edf3d196e36f0b4c9645de2570cfd48
SHA512

d9b394fc25949d552b64061810cd4452d24ee473c5755bada25b1db5ad35652a57b545c53c5e1dea88feac376b86e838a6b87886e9ad50e1f582eb2b985cda78
SSDEEP

24576:zqDEvCTbMWu7rQYlBQcBiT6rprG8auS2rwF3q65FE8wvsO5BaH3:zTvC/MTQYxsWR7auSY65G8wDKH

Score

10^/10

remcos remotehost collection credential_access discovery rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

192.210.150.26:8787

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-NKQ1SM
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/1548-89-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/800-88-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/3556-91-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/1548-89-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/800-88-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\antholite.vbs	antholite.exe

Executes dropped EXE 8 IoCs

pid	Process
2080	antholite.exe
448	antholite.exe
3652	antholite.exe
3608	antholite.exe
1156	antholite.exe
800	antholite.exe
1548	antholite.exe
3556	antholite.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	antholite.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000a000000023399-13.dat	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3608 set thread context of 800	3608	antholite.exe	96
PID 3608 set thread context of 1548	3608	antholite.exe	97
PID 3608 set thread context of 3556	3608	antholite.exe	98

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	antholite.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	antholite.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	antholite.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	antholite.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	antholite.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	antholite.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	antholite.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b8022e8002a8e01a6364fdcc6d53275b6edf3d196e36f0b4c9645de2570cfd48.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
800	antholite.exe
800	antholite.exe
3556	antholite.exe
3556	antholite.exe
800	antholite.exe
800	antholite.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3608	antholite.exe
3608	antholite.exe
3608	antholite.exe
3608	antholite.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3556	antholite.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
1044	b8022e8002a8e01a6364fdcc6d53275b6edf3d196e36f0b4c9645de2570cfd48.exe
1044	b8022e8002a8e01a6364fdcc6d53275b6edf3d196e36f0b4c9645de2570cfd48.exe
2080	antholite.exe
2080	antholite.exe
448	antholite.exe
448	antholite.exe
3652	antholite.exe
3652	antholite.exe
3608	antholite.exe
3608	antholite.exe

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
1044	b8022e8002a8e01a6364fdcc6d53275b6edf3d196e36f0b4c9645de2570cfd48.exe
1044	b8022e8002a8e01a6364fdcc6d53275b6edf3d196e36f0b4c9645de2570cfd48.exe
2080	antholite.exe
2080	antholite.exe
448	antholite.exe
448	antholite.exe
3652	antholite.exe
3652	antholite.exe
3608	antholite.exe
3608	antholite.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2080	1044	b8022e8002a8e01a6364fdcc6d53275b6edf3d196e36f0b4c9645de2570cfd48.exe	86
PID 1044 wrote to memory of 2080	1044	b8022e8002a8e01a6364fdcc6d53275b6edf3d196e36f0b4c9645de2570cfd48.exe	86
PID 1044 wrote to memory of 2080	1044	b8022e8002a8e01a6364fdcc6d53275b6edf3d196e36f0b4c9645de2570cfd48.exe	86
PID 2080 wrote to memory of 448	2080	antholite.exe	88
PID 2080 wrote to memory of 448	2080	antholite.exe	88
PID 2080 wrote to memory of 448	2080	antholite.exe	88
PID 448 wrote to memory of 3652	448	antholite.exe	91
PID 448 wrote to memory of 3652	448	antholite.exe	91
PID 448 wrote to memory of 3652	448	antholite.exe	91
PID 3652 wrote to memory of 3608	3652	antholite.exe	94
PID 3652 wrote to memory of 3608	3652	antholite.exe	94
PID 3652 wrote to memory of 3608	3652	antholite.exe	94
PID 3608 wrote to memory of 1156	3608	antholite.exe	95
PID 3608 wrote to memory of 1156	3608	antholite.exe	95
PID 3608 wrote to memory of 1156	3608	antholite.exe	95
PID 3608 wrote to memory of 800	3608	antholite.exe	96
PID 3608 wrote to memory of 800	3608	antholite.exe	96
PID 3608 wrote to memory of 800	3608	antholite.exe	96
PID 3608 wrote to memory of 800	3608	antholite.exe	96
PID 3608 wrote to memory of 1548	3608	antholite.exe	97
PID 3608 wrote to memory of 1548	3608	antholite.exe	97
PID 3608 wrote to memory of 1548	3608	antholite.exe	97
PID 3608 wrote to memory of 1548	3608	antholite.exe	97
PID 3608 wrote to memory of 3556	3608	antholite.exe	98
PID 3608 wrote to memory of 3556	3608	antholite.exe	98
PID 3608 wrote to memory of 3556	3608	antholite.exe	98
PID 3608 wrote to memory of 3556	3608	antholite.exe	98

C:\Users\Admin\AppData\Local\Temp\b8022e8002a8e01a6364fdcc6d53275b6edf3d196e36f0b4c9645de2570cfd48.exe
"C:\Users\Admin\AppData\Local\Temp\b8022e8002a8e01a6364fdcc6d53275b6edf3d196e36f0b4c9645de2570cfd48.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Users\Admin\AppData\Local\Cocles\antholite.exe
  "C:\Users\Admin\AppData\Local\Temp\b8022e8002a8e01a6364fdcc6d53275b6edf3d196e36f0b4c9645de2570cfd48.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Users\Admin\AppData\Local\Cocles\antholite.exe
    "C:\Users\Admin\AppData\Local\Cocles\antholite.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:448
  - - C:\Users\Admin\AppData\Local\Cocles\antholite.exe
      "C:\Users\Admin\AppData\Local\Cocles\antholite.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3652
    - - C:\Users\Admin\AppData\Local\Cocles\antholite.exe
        
        "C:\Users\Admin\AppData\Local\Cocles\antholite.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Cocles\antholite.exe
        
        C:\Users\Admin\AppData\Local\Cocles\antholite.exe /stext "C:\Users\Admin\AppData\Local\Temp\lnfhepzeswtbr"
        6⤵
        Executes dropped EXE
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Cocles\antholite.exe
        
        C:\Users\Admin\AppData\Local\Cocles\antholite.exe /stext "C:\Users\Admin\AppData\Local\Temp\lnfhepzeswtbr"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:800
      - C:\Users\Admin\AppData\Local\Cocles\antholite.exe
        
        C:\Users\Admin\AppData\Local\Cocles\antholite.exe /stext "C:\Users\Admin\AppData\Local\Temp\vpksfikfgeloblek"
        6⤵
        Executes dropped EXE
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:1548
      - C:\Users\Admin\AppData\Local\Cocles\antholite.exe
        
        C:\Users\Admin\AppData\Local\Cocles\antholite.exe /stext "C:\Users\Admin\AppData\Local\Temp\gjykfavzundtdrswbxp"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
38396d911fcb4fd7fac980f43e8c63f3

SHA1
62011226efe8831cfe36f53376edf124e25ef885

SHA256
b0278ab181367e847f398f85d790f048a6e07f3e092a8edaec3f0faf81838532

SHA512
f4db8b7d103a8f23adbaa75d1e4a8c8ccf2ba33a566bf3ccac9dd75b31a8dc5491192dfc945efd36499e31cf039cca61012ece237f6a70ff7194136c8fa06765

Download Submit
C:\Users\Admin\AppData\Local\Cocles\antholite.exe

Filesize
1.5MB

MD5
bd6420aaf066a5b4533598417866bc67

SHA1
cf56376da61f4f34034fa4cc525e708052a5ecd3

SHA256
b8022e8002a8e01a6364fdcc6d53275b6edf3d196e36f0b4c9645de2570cfd48

SHA512
d9b394fc25949d552b64061810cd4452d24ee473c5755bada25b1db5ad35652a57b545c53c5e1dea88feac376b86e838a6b87886e9ad50e1f582eb2b985cda78

Download Submit
C:\Users\Admin\AppData\Local\Temp\aut7EA6.tmp

Filesize
405KB

MD5
11aae4fd5c5dd736d1ded6e1080be299

SHA1
5d4480c33fbba3169b933e40e5a2dec8d6fa9438

SHA256
c1f96c9087aab6f63c94915d6ff46c4da0220d5f48ad89f7374dc1fda192adc2

SHA512
73390fc932054043695b572d12da490b0a1b2da9abe465062897ca25f5bfb885886566d02f8dd54cfaa6d7032a4845c7b5243a2dac07a3371459c5f7dce76d92

Download Submit
C:\Users\Admin\AppData\Local\Temp\aut7EC6.tmp

Filesize
14KB

MD5
345ed665a9ebb49ba899d0a62f389ea0

SHA1
68698dbaaae4983c38da2b14fbb1fec060d9d2e8

SHA256
294b6354f17d6d3dfeeb71c5c43fde0a3a52551b826614742d4dd4eb32ff6a37

SHA512
37af32bce9df05fed6190f44af5eb6c62f74f4d47ef44f9d893a9befca1fbcd378cf1ad5242abf5f9aa0701b5f4133539a415eabd094d240eab3430179cb9a39

Download Submit
C:\Users\Admin\AppData\Local\Temp\konked

Filesize
64KB

MD5
34f0bc577ae16511703b19bd12e57591

SHA1
dcf5fa90dbac8d10320eb7018238f1c20a94041c

SHA256
661e2663c2f193186da41dd45de6504a0e1512d37f479be808cf074c131a22e8

SHA512
fefb824b4e37e0feaf9f30c5e4eeb8215e195b05ebcd5900dc08f1c4c64e21f32d682107e4d0dbc8dcb9a5210895f9380f08f5e0a97807ef4f68d7c0393fbd31

Download Submit
C:\Users\Admin\AppData\Local\Temp\konked

Filesize
482KB

MD5
48005136bc147209ac8f408339c017e9

SHA1
2758101d2f96164a3e0cb62785223888946f53fa

SHA256
76e8c3c933c18bae6bb3cfbfa2aceb9db31c7862a56775de9ced8f1ec3a72f7f

SHA512
e0ac69de23c7354f61d634ba4064d63f54f75306dd06a15884d8c2da75908643db405fa430a84dbeb1af5e66c153c4d26e1006916f6879ba5bd9d8f9b459eaac

Download Submit
C:\Users\Admin\AppData\Local\Temp\lnfhepzeswtbr

Filesize
4KB

MD5
a7e181f6aa185be0ab0ca68b30406fe6

SHA1
58c86162658dc609615b8b6400f85c92506dfdc8

SHA256
c3071dc55b94db225d9c0f2c1b21c7e8f27dbfd168b85b7d618d8d19950e7ff2

SHA512
49969eb10e0bf7925940eb7374451f811658ef9ccfb83b86fb337c4d06c3ba17eb0181f598d9e0ec9ca25bfaf644209ac47b73d62ac924e73d03a4dcf8f8dd0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\seskin

Filesize
140KB

MD5
fc0250799241323e9f3a53f51f7df0f1

SHA1
f0d60dbf33047494014302b4ee8b438cc0380943

SHA256
0469ec50b7420320b46fb0a05c5d875de1ca110b2e18fbcb37860e2a6cd31982

SHA512
ccacaced5eb79a9920299599b34984788c2288bf07ce1a423668c5b4e56f4348cf7a6a29231a658fce07a40719897ee1dde428d4539a8007f6028b243f718661

Download Submit
memory/800-88-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/800-80-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/800-86-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1044-10-0x0000000002670000-0x0000000002674000-memory.dmp

Filesize
16KB

Download
memory/1548-87-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1548-89-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1548-82-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3556-84-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3556-91-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3556-90-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/3608-71-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3608-102-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3608-75-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3608-76-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3608-74-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3608-73-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3608-72-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3608-70-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3608-97-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3608-100-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3608-101-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/3608-78-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3608-106-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3608-107-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3608-67-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3608-114-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3608-115-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3608-122-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3608-123-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3608-131-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3608-130-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3608-138-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3608-139-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download