remcos | f044abe5c941e83bf5abab9e660b534a6b9ee4d6e9dabee19a281388723640f7

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f044abe5c941e83bf5abab9e660b534a6b9ee4d6e9dabee19a281388723640f7.exe
Size

436KB
MD5

cea819cb80922060d4e7933c5ed1a115
SHA1

21d923c46765bb3051e4b3e4149e80acb27bae2a
SHA256

f044abe5c941e83bf5abab9e660b534a6b9ee4d6e9dabee19a281388723640f7
SHA512

0dfed89157435400860101503ab72e6746809d37eb35677a3a3d98ff36a3be6f2788eca8939c8b2a3c7cf673fdde8d928be9b4b04eff74ab7dfc4bb9442d2f0d
SSDEEP

1536:hrSfzDdxy+UpwwJaqr7DAqGWidi6t2XPVM59HfPqA7/axJ2:yDdgdWwrvxKi6t359HaAj5

Score

10^/10

remcos texas discovery persistence rat

Malware Config

Extracted

Family

remcos

Botnet

TEXAS

ventana7883.con-ip.com:1835

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
registros.dat
keylog_flag
false
keylog_folder
dataole
mouse_option
false
mutex
bnshs2-NFPHZ5
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Capturas de pantalla
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 764 created 3436	764	f044abe5c941e83bf5abab9e660b534a6b9ee4d6e9dabee19a281388723640f7.exe	56

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Jhszggxdy = "C:\\Users\\Admin\\AppData\\Roaming\\Jhszggxdy.exe"	f044abe5c941e83bf5abab9e660b534a6b9ee4d6e9dabee19a281388723640f7.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 764 set thread context of 964	764	f044abe5c941e83bf5abab9e660b534a6b9ee4d6e9dabee19a281388723640f7.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f044abe5c941e83bf5abab9e660b534a6b9ee4d6e9dabee19a281388723640f7.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
764	f044abe5c941e83bf5abab9e660b534a6b9ee4d6e9dabee19a281388723640f7.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	764	f044abe5c941e83bf5abab9e660b534a6b9ee4d6e9dabee19a281388723640f7.exe
Token: SeDebugPrivilege	764	f044abe5c941e83bf5abab9e660b534a6b9ee4d6e9dabee19a281388723640f7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
964	InstallUtil.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 964	764	f044abe5c941e83bf5abab9e660b534a6b9ee4d6e9dabee19a281388723640f7.exe	87
PID 764 wrote to memory of 964	764	f044abe5c941e83bf5abab9e660b534a6b9ee4d6e9dabee19a281388723640f7.exe	87
PID 764 wrote to memory of 964	764	f044abe5c941e83bf5abab9e660b534a6b9ee4d6e9dabee19a281388723640f7.exe	87
PID 764 wrote to memory of 964	764	f044abe5c941e83bf5abab9e660b534a6b9ee4d6e9dabee19a281388723640f7.exe	87
PID 764 wrote to memory of 964	764	f044abe5c941e83bf5abab9e660b534a6b9ee4d6e9dabee19a281388723640f7.exe	87
PID 764 wrote to memory of 964	764	f044abe5c941e83bf5abab9e660b534a6b9ee4d6e9dabee19a281388723640f7.exe	87
PID 764 wrote to memory of 964	764	f044abe5c941e83bf5abab9e660b534a6b9ee4d6e9dabee19a281388723640f7.exe	87
PID 764 wrote to memory of 964	764	f044abe5c941e83bf5abab9e660b534a6b9ee4d6e9dabee19a281388723640f7.exe	87
PID 764 wrote to memory of 964	764	f044abe5c941e83bf5abab9e660b534a6b9ee4d6e9dabee19a281388723640f7.exe	87
PID 764 wrote to memory of 964	764	f044abe5c941e83bf5abab9e660b534a6b9ee4d6e9dabee19a281388723640f7.exe	87
PID 764 wrote to memory of 964	764	f044abe5c941e83bf5abab9e660b534a6b9ee4d6e9dabee19a281388723640f7.exe	87
PID 764 wrote to memory of 964	764	f044abe5c941e83bf5abab9e660b534a6b9ee4d6e9dabee19a281388723640f7.exe	87

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3436
- C:\Users\Admin\AppData\Local\Temp\f044abe5c941e83bf5abab9e660b534a6b9ee4d6e9dabee19a281388723640f7.exe
  "C:\Users\Admin\AppData\Local\Temp\f044abe5c941e83bf5abab9e660b534a6b9ee4d6e9dabee19a281388723640f7.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:764
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\dataole\registros.dat

Filesize
144B

MD5
68eb3a0c37ee4c8dba1ccc1b41c75e5a

SHA1
d554a63e6b9f09d5ebe6096db68bbce0f03b913a

SHA256
4b091072f6a2889fdc0280e64fbc6ddca30154a7f17e018cda841c14b424adaf

SHA512
ad4c4a259ebc6c4811f7c2cc4d67e772c2d4c83988add238f2509c67fe75749b30fb0b50392b4429e1e14d788a99b10c81e7652916422153a09b511285666ff7

Download Submit
memory/764-0-0x000000007516E000-0x000000007516F000-memory.dmp

Filesize
4KB

Download
memory/764-1-0x0000000000A80000-0x0000000000AF0000-memory.dmp

Filesize
448KB

Download
memory/764-2-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/764-3-0x0000000005F80000-0x000000000609E000-memory.dmp

Filesize
1.1MB

Download
memory/764-15-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-11-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-45-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-51-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-49-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-43-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-41-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-39-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-37-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-35-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-33-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-29-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-27-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-25-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-23-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-21-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-19-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-17-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-9-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-7-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-5-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-47-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-31-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-13-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-4-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-55-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-65-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-67-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-63-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-61-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-59-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-57-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-53-0x0000000005F80000-0x0000000006098000-memory.dmp

Filesize
1.1MB

Download
memory/764-1078-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/764-1079-0x0000000006340000-0x00000000063D8000-memory.dmp

Filesize
608KB

Download
memory/764-1080-0x00000000062A0000-0x00000000062EC000-memory.dmp

Filesize
304KB

Download
memory/764-1081-0x0000000006B60000-0x0000000007104000-memory.dmp

Filesize
5.6MB

Download
memory/764-1082-0x0000000006440000-0x0000000006494000-memory.dmp

Filesize
336KB

Download
memory/764-1085-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/764-1089-0x000000007516E000-0x000000007516F000-memory.dmp

Filesize
4KB

Download
memory/764-1090-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/764-1088-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/764-1094-0x0000000075160000-0x0000000075910000-memory.dmp

Filesize
7.7MB

Download
memory/964-1095-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/964-1110-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download