remcos | e8aa95c6ae470b7631ac3b11a81e7f76fe0a0b10a6fafff1ab987e10438a3e0e

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24/09/2024, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CI-TLN0124796CMACGM.scr
Size 915KB
Sample240924-ca78eswcnf
SHA256 d00a443bf00b909b32fbd9894462283fca5788e28b96a9e729f43fc4f2ca585a
MD5 02d513fa3a4c04f1ffce97c25caccdff
SHA1 853948f7ff1d69a293c4f4617185c24b9859e6dd
SHA512 9a9b925e7d5acec5216ecb64f7352a8a27598106452984f08155f2bef640fe1ad93ff3a7869cacfaec2514641740c41fcc0e7e4f0172eaa7072c1c9c05087ab3
SSDEEP 24576:SgW2J4Sl29MaW6EEJJQEtTShtxMwwW7yUVzmoeli:SgjJYSoxtuDxZlyUVzmo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos generalwire-slaves discovery execution rat

Malware Config

Extracted

Family

remcos

Botnet

GeneralWire-Slaves

milliondollar23.duckdns.org:3984

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-TWU43D
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3044	powershell.exe
2608	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1992 set thread context of 2664	1992	CI-TLN0124796CMACGM.scr	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CI-TLN0124796CMACGM.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CI-TLN0124796CMACGM.scr

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2720	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1992	CI-TLN0124796CMACGM.scr
1992	CI-TLN0124796CMACGM.scr
1992	CI-TLN0124796CMACGM.scr
2608	powershell.exe
3044	powershell.exe
1992	CI-TLN0124796CMACGM.scr

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	CI-TLN0124796CMACGM.scr
Token: SeDebugPrivilege	2608	powershell.exe
Token: SeDebugPrivilege	3044	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2664	CI-TLN0124796CMACGM.scr

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 3044	1992	CI-TLN0124796CMACGM.scr	30
PID 1992 wrote to memory of 3044	1992	CI-TLN0124796CMACGM.scr	30
PID 1992 wrote to memory of 3044	1992	CI-TLN0124796CMACGM.scr	30
PID 1992 wrote to memory of 3044	1992	CI-TLN0124796CMACGM.scr	30
PID 1992 wrote to memory of 2608	1992	CI-TLN0124796CMACGM.scr	32
PID 1992 wrote to memory of 2608	1992	CI-TLN0124796CMACGM.scr	32
PID 1992 wrote to memory of 2608	1992	CI-TLN0124796CMACGM.scr	32
PID 1992 wrote to memory of 2608	1992	CI-TLN0124796CMACGM.scr	32
PID 1992 wrote to memory of 2720	1992	CI-TLN0124796CMACGM.scr	34
PID 1992 wrote to memory of 2720	1992	CI-TLN0124796CMACGM.scr	34
PID 1992 wrote to memory of 2720	1992	CI-TLN0124796CMACGM.scr	34
PID 1992 wrote to memory of 2720	1992	CI-TLN0124796CMACGM.scr	34
PID 1992 wrote to memory of 2632	1992	CI-TLN0124796CMACGM.scr	36
PID 1992 wrote to memory of 2632	1992	CI-TLN0124796CMACGM.scr	36
PID 1992 wrote to memory of 2632	1992	CI-TLN0124796CMACGM.scr	36
PID 1992 wrote to memory of 2632	1992	CI-TLN0124796CMACGM.scr	36
PID 1992 wrote to memory of 2664	1992	CI-TLN0124796CMACGM.scr	37
PID 1992 wrote to memory of 2664	1992	CI-TLN0124796CMACGM.scr	37
PID 1992 wrote to memory of 2664	1992	CI-TLN0124796CMACGM.scr	37
PID 1992 wrote to memory of 2664	1992	CI-TLN0124796CMACGM.scr	37
PID 1992 wrote to memory of 2664	1992	CI-TLN0124796CMACGM.scr	37
PID 1992 wrote to memory of 2664	1992	CI-TLN0124796CMACGM.scr	37
PID 1992 wrote to memory of 2664	1992	CI-TLN0124796CMACGM.scr	37
PID 1992 wrote to memory of 2664	1992	CI-TLN0124796CMACGM.scr	37
PID 1992 wrote to memory of 2664	1992	CI-TLN0124796CMACGM.scr	37
PID 1992 wrote to memory of 2664	1992	CI-TLN0124796CMACGM.scr	37
PID 1992 wrote to memory of 2664	1992	CI-TLN0124796CMACGM.scr	37
PID 1992 wrote to memory of 2664	1992	CI-TLN0124796CMACGM.scr	37
PID 1992 wrote to memory of 2664	1992	CI-TLN0124796CMACGM.scr	37

C:\Users\Admin\AppData\Local\Temp\CI-TLN0124796CMACGM.scr
"C:\Users\Admin\AppData\Local\Temp\CI-TLN0124796CMACGM.scr" /S
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\CI-TLN0124796CMACGM.scr"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3044
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LdtceRaylJq.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2608
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LdtceRaylJq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA9D6.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2720
- C:\Users\Admin\AppData\Local\Temp\CI-TLN0124796CMACGM.scr
  "C:\Users\Admin\AppData\Local\Temp\CI-TLN0124796CMACGM.scr"
  2⤵
  PID:2632
- C:\Users\Admin\AppData\Local\Temp\CI-TLN0124796CMACGM.scr
  "C:\Users\Admin\AppData\Local\Temp\CI-TLN0124796CMACGM.scr"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 144B
SHA256 da39eeb8e4d8318bf8194a9fd9785455c389054c3006ed155b510e1a8240deda
MD5 c74cd0a85798ef023d0c7ab8f5b16781
SHA1 2638879befab538f924c490c725c547394bdf16e
SHA512 0a80da0cbe2c9948d1fa874dd9b28ec49e945ade89cab9d57568dcba53900cedf2d736d312f3fe5b4f12dec4d2cc84fc1c16c0be5bbf921f5b18c8e71589c449
MD5 SHA1 SHA512

Submit Download

tmpA9D6.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpA9D6.tmp
Size 1KB
SHA256 0eb4f30282fbbe1c4b295f665f8e49a8f516f37a35746f8800476c80b823a8e0
MD5 57ca5d05927f4956c9d71f4c0507d168
SHA1 192239fc95358437f3e738e2dc9998423664dd78
SHA512 5f87e34c82235268aca321d5983f4f5dbc784f453bb5fb5204e9f0a03fac99dbd7b860e13d364ffa49d516f29efe37f8eee28320dd83e853b6ca1b4f62ad2c27
MD5 SHA1 SHA512

Submit Download

KAQWPGZDD37FUTI8U1US.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KAQWPGZDD37FUTI8U1US.temp
Size 7KB
SHA256 2ea8ad8c9abc38300a4a456ccc0ba771ca44617f440b9fa842c96df8b08249b8
MD5 926ec53f439d31dd34d04791acb9447e
SHA1 9749067795a48720d2eb1257bca653115675835c
SHA512 5d3ec376c159343c76878f252e3b00fbeb4f1c3b116396bd5c2ad6e259cbfa5ba8ba47ee785cc362e7f59746c293284b782ba82008396f4d467a31aaa09a4f43
SSDEEP 96:QZafCZPM8pnqvsqvJCwoTZafCZPM8pnqvsEHyqvJCworJeqOzQHfAN7+ewXlUV+:IvPdUo9vPdAHnorJeb6AN7+ewN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1992-0-0x000000007466E000-0x000000007466F000-memory.dmp

Download

memory/1992-1-0x0000000000820000-0x000000000090A000-memory.dmp

Download

memory/1992-2-0x0000000074660000-0x0000000074D4E000-memory.dmp

Download

memory/1992-3-0x0000000000350000-0x0000000000362000-memory.dmp

Download

memory/1992-4-0x000000007466E000-0x000000007466F000-memory.dmp

Download

memory/1992-5-0x0000000074660000-0x0000000074D4E000-memory.dmp

Download

memory/1992-6-0x00000000054E0000-0x00000000055A0000-memory.dmp

Download

memory/1992-42-0x0000000074660000-0x0000000074D4E000-memory.dmp

Download

memory/2664-41-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2664-46-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2664-31-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2664-29-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2664-25-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2664-36-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2664-37-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2664-19-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2664-38-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2664-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2664-33-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2664-23-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2664-45-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2664-27-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2664-47-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2664-48-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2664-50-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2664-21-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2664-55-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2664-56-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2664-63-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2664-64-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2664-71-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2664-72-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2664-79-0x0000000000400000-0x0000000000482000-memory.dmp

Download

memory/2664-80-0x0000000000400000-0x0000000000482000-memory.dmp

Download