Overview

overview

10

Static

static

10

remcos_a.exe

windows10-2004-x64

Analysis

  • max time kernel
    222s
  • max time network
    224s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-09-2024 21:15

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    remcos_a.exe

  • Size

    469KB

  • MD5

    48f4a8f633bf5535811c23a81d8d8506

  • SHA1

    c2a98525bfda82421cb8670db223b19acef31f23

  • SHA256

    9ec9c4c81c67d6628d141981a7020bb7ded83b4c40ff693870cd98eaebf74912

  • SHA512

    7903c322d886bcffc06a9310ba451b0f0eac53d2acedf45b544548ae3656ef477b5a03a86d54452d65461957df4c643082338119bdeb0f2303f528daf0642e29

  • SSDEEP

    12288:Wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSOn9:uiLJbpI7I2WhQqZ7O9

Score
10/10
hawkeyeremcosremotehostdiscoveryevasionkeyloggerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

192.168.1.56:13970

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    Windows32.exe

  • copy_folder

    Health

  • delete_file

    true

  • hide_file

    true

  • hide_keylog_file

    true

  • install_flag

    true

  • install_path

    %WinDir%\System32

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    filer32

  • keylog_path

    %WinDir%\System32

  • mouse_option

    false

  • mutex

    Rmc-36XJ31

  • screenshot_crypt

    true

  • screenshot_flag

    true

  • screenshot_folder

    Screenshots

  • screenshot_path

    %WinDir%\System32

  • screenshot_time

    10

  • startup_value

    WindowsHealth

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye
  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Adds policy Run key to start application 2 TTPs 6 IoCs
    persistence
  • Manipulates Digital Signatures 1 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Drops file in System32 directory 64 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 37 IoCs
  • Modifies registry key 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\remcos_a.exe
    "C:\Users\Admin\AppData\Local\Temp\remcos_a.exe"
    1⤵
    • Adds policy Run key to start application
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3548
    • C:\Windows\SysWOW64\cmd.exe
      /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3108
      • C:\Windows\SysWOW64\reg.exe
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        3⤵
        • UAC bypass
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:1804
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4968
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c "C:\Windows\SysWOW64\Health\Windows32.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2032
        • C:\Windows\SysWOW64\Health\Windows32.exe
          C:\Windows\SysWOW64\Health\Windows32.exe
          4⤵
          • Adds policy Run key to start application
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:2016
          • C:\Windows\SysWOW64\cmd.exe
            /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1636
            • C:\Windows\SysWOW64\reg.exe
              C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
              6⤵
              • UAC bypass
              • System Location Discovery: System Language Discovery
              • Modifies registry key
              PID:2368
          • \??\c:\program files (x86)\internet explorer\iexplore.exe
            "c:\program files (x86)\internet explorer\iexplore.exe"
            5⤵
            • Adds policy Run key to start application
            • Adds Run key to start application
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4828
            • C:\Windows\SysWOW64\cmd.exe
              /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2836
              • C:\Windows\SysWOW64\reg.exe
                C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                7⤵
                • UAC bypass
                • System Location Discovery: System Language Discovery
                • Modifies registry key
                PID:2224
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              6⤵
                PID:1948
              • C:\Windows\SysWOW64\dxdiag.exe
                "C:\Windows\System32\dxdiag.exe" /t C:\Users\Admin\AppData\Local\Temp\sysinfo.txt
                6⤵
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Checks SCSI registry key(s)
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:4328
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\destroyer.bat" "
                6⤵
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:688
                • C:\Windows\SysWOW64\attrib.exe
                  attrib -r -s -h "C:\Windows\System32\*.*"
                  7⤵
                  • Manipulates Digital Signatures
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Views/modifies file attributes
                  PID:3592
                • C:\Windows\SysWOW64\attrib.exe
                  attrib -r -s -h "C:\Windows\*.*"
                  7⤵
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Views/modifies file attributes
                  PID:4992
                • C:\Windows\SysWOW64\format.com
                  format c: /s /q
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Enumerates system info in registry
                  PID:2964
                • C:\Windows\SysWOW64\shutdown.exe
                  shutdown /r /t 0
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3136
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x4 /state0:0xa39bc855 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:4552

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    2
    T1547

    Registry Run Keys / Startup Folder

    2
    T1547.001

    Privilege Escalation

    Abuse Elevation Control Mechanism

    1
    T1548

    Bypass User Account Control

    1
    T1548.002

    Boot or Logon Autostart Execution

    2
    T1547

    Registry Run Keys / Startup Folder

    2
    T1547.001

    Defense Evasion

    Abuse Elevation Control Mechanism

    1
    T1548

    Bypass User Account Control

    1
    T1548.002

    Hide Artifacts

    1
    T1564

    Hidden Files and Directories

    1
    T1564.001

    Impair Defenses

    1
    T1562

    Disable or Modify Tools

    1
    T1562.001

    Modify Registry

    4
    T1112

    Credential Access

    Discovery

    Peripheral Device Discovery

    1
    T1120

    Query Registry

    3
    T1012

    System Information Discovery

    4
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Lateral Movement

    Collection

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\install.vbs
      Filesize

      530B

      MD5

      6784c2405607c045981319c5fd5b43c9

      SHA1

      2b4e2992215cc6446b74a19b90837576bc3f9d75

      SHA256

      af1a632c6db106051517586cc70e10329d95fe4222fe2770f69c4ee05c2bb8ce

      SHA512

      aedb8b3a48f13290761383a8ccb4027f81a657cc8fb7e1b9d5e92ec8f42f16e3cefeb06d6cd40f65d6a1f0747794983eb3321b42a21d3362a3925f685ddc2e0c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\sysinfo.txt
      Filesize

      84KB

      MD5

      7400e5a9105ab8f9cebb5f9c03db83e6

      SHA1

      9be1318716ba3d50e53fb426b7d838223d03f692

      SHA256

      287e59e8dfa9398f884b2e711835ccd97307c5b3a79b3c35dd8a11965095799b

      SHA512

      e1cf3925a1c3d030e9f1e0fe1354fc98d915322ca3806173c4e1b35061377df2eafa7d6f4035cdb3fa37a11e7a39e4a01dd1ce28181ed3e516b652919b0b8f42

      Download Submit

    • C:\Windows\SysWOW64\Health\Windows32.exe
      Filesize

      469KB

      MD5

      48f4a8f633bf5535811c23a81d8d8506

      SHA1

      c2a98525bfda82421cb8670db223b19acef31f23

      SHA256

      9ec9c4c81c67d6628d141981a7020bb7ded83b4c40ff693870cd98eaebf74912

      SHA512

      7903c322d886bcffc06a9310ba451b0f0eac53d2acedf45b544548ae3656ef477b5a03a86d54452d65461957df4c643082338119bdeb0f2303f528daf0642e29

      Download Submit

    • C:\Windows\SysWOW64\filer32\logs.dat
      Filesize

      346B

      MD5

      568dcd13150154e19be389f08871f6f3

      SHA1

      5e597b90f2a63b1e1b99ca8075f99135b5e0b0de

      SHA256

      575fb743383b9e9c7ab64ccac416ec18dae12fe49acd195fafd16eece28fe585

      SHA512

      f2297fc200e98f4c43d86e59b211ff045eb616461044fa3b2c12c0ca5276f760dab8a08be914977f9eb30345e0ab81549118d8d4c33bd1614d3fe7b7c4d1283d

      Download Submit

    • C:\destroyer.bat
      Filesize

      302B

      MD5

      737fb9f41efffbf88c3c7b110d265b40

      SHA1

      32c6386afaefdea4a5ded8dbd52d3884f1c5f92c

      SHA256

      a53746b1b3065b36bab58b6a8f4d5f4cd11dd3b0a5d85fd697d19cacc79951d1

      SHA512

      2e4c11b48abd58c9315d48aa1f5b97e631cab0fbed21b9ad8c0c05e5562690aa1319461dd5fd9fd063fd081781b28178daa7a7cb7d408e1fe95e5a1f13cae441

      Download Submit

    • memory/1948-19-0x0000000001080000-0x00000000010FF000-memory.dmp

      Filesize

      508KB

      Download

    • memory/1948-20-0x0000000001080000-0x00000000010FF000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4328-51-0x0000000002300000-0x0000000002301000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4328-50-0x0000000002300000-0x0000000002301000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4328-52-0x0000000002300000-0x0000000002301000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4328-53-0x0000000002300000-0x0000000002301000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4328-54-0x0000000002300000-0x0000000002301000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4328-49-0x0000000002300000-0x0000000002301000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4328-55-0x0000000002300000-0x0000000002301000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4328-45-0x0000000002300000-0x0000000002301000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4328-44-0x0000000002300000-0x0000000002301000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4328-43-0x0000000002300000-0x0000000002301000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4828-25-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-79-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-41-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-42-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-33-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-32-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-31-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-30-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-23-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-24-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-21-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-16-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-12-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-11-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-10-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-72-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-78-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-39-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-83-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-88-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-89-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-96-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-97-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-100-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-101-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-103-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-104-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-109-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-110-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-112-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-115-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-121-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download

    • memory/4828-9-0x00000000013B0000-0x000000000142F000-memory.dmp

      Filesize

      508KB

      Download