remcos | a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 02:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe
Size

911KB
MD5

2dac846348dd99ba41ca115317967970
SHA1

337e51258d6d9c2d1076be7e97e105e5372224e4
SHA256

a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709
SHA512

c6c993c13880209f7f68a356916a1703898c60b88178752327cbf77bb7946bebdcdcbf9c47eb3521db7a0f1d4943468e0969a335edd05174574b486dabef583c
SSDEEP

24576:TH8WHLjRWytfvM5//x9XmjAEeCjHXOYXohfX1mdI:wWHPM4n2//TmcEeCjv4hfU

Score

10^/10

remcos remotehost discovery execution rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

103.198.26.25:96

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-IPUJM4
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2912	powershell.exe
2824	powershell.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2308 set thread context of 2692	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
408	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe
2912	powershell.exe
2824	powershell.exe
2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	2824	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2912	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe	30
PID 2308 wrote to memory of 2912	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe	30
PID 2308 wrote to memory of 2912	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe	30
PID 2308 wrote to memory of 2912	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe	30
PID 2308 wrote to memory of 2824	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe	32
PID 2308 wrote to memory of 2824	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe	32
PID 2308 wrote to memory of 2824	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe	32
PID 2308 wrote to memory of 2824	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe	32
PID 2308 wrote to memory of 408	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe	34
PID 2308 wrote to memory of 408	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe	34
PID 2308 wrote to memory of 408	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe	34
PID 2308 wrote to memory of 408	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe	34
PID 2308 wrote to memory of 2692	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe	36
PID 2308 wrote to memory of 2692	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe	36
PID 2308 wrote to memory of 2692	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe	36
PID 2308 wrote to memory of 2692	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe	36
PID 2308 wrote to memory of 2692	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe	36
PID 2308 wrote to memory of 2692	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe	36
PID 2308 wrote to memory of 2692	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe	36
PID 2308 wrote to memory of 2692	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe	36
PID 2308 wrote to memory of 2692	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe	36
PID 2308 wrote to memory of 2692	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe	36
PID 2308 wrote to memory of 2692	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe	36
PID 2308 wrote to memory of 2692	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe	36
PID 2308 wrote to memory of 2692	2308	a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe	36

C:\Users\Admin\AppData\Local\Temp\a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe
"C:\Users\Admin\AppData\Local\Temp\a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\a4abb3ad06e430c4eb3680557906025432c8f112bcfa7fbeadab35a17a9bc709N.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2912
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kAjpbIGVx.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2824
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kAjpbIGVx" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDB42.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:408
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpDB42.tmp

Filesize
1KB

MD5
d0c836a2a9d9111c2d915b8595ffa497

SHA1
2546f722e6ef154d8e253f93bc209dc4e71403cf

SHA256
96af27d8b6d7d00d7b2aa4fc99dc547d5c209e41d158fd21b0d897b292c86c14

SHA512
0304c53659ab24db5aca28b3300ca738c942171e6f8604abb6295d933f95a9b280847a986d1e683e541cf7e17d8547d59d4bb7de525402a10317a83e2342060c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YIRSZH0NWBAAAZ3WFR8T.temp

Filesize
7KB

MD5
c229a142c0533669c7ca7a9d533bd671

SHA1
dbd0c2c1158d7a1676265aa008f8e797952deed8

SHA256
7a775f6e9e9067b5928d1d9036db14644b98a2a367d7b86f262499f46befc83f

SHA512
9def14adcc072c29fe1382013d67edf5b631414fcb2c8f8aa22d4f7608c4aae2b80e2a864fc99ce75d32d2cbad6d17216a1a63199b8d931e946946d65463ec96

Download Submit
memory/2308-0-0x00000000747FE000-0x00000000747FF000-memory.dmp

Filesize
4KB

Download
memory/2308-1-0x0000000001340000-0x000000000142A000-memory.dmp

Filesize
936KB

Download
memory/2308-2-0x00000000747F0000-0x0000000074EDE000-memory.dmp

Filesize
6.9MB

Download
memory/2308-3-0x0000000000450000-0x0000000000462000-memory.dmp

Filesize
72KB

Download
memory/2308-4-0x00000000747FE000-0x00000000747FF000-memory.dmp

Filesize
4KB

Download
memory/2308-5-0x00000000747F0000-0x0000000074EDE000-memory.dmp

Filesize
6.9MB

Download
memory/2308-6-0x00000000054E0000-0x00000000055A0000-memory.dmp

Filesize
768KB

Download
memory/2308-40-0x00000000747F0000-0x0000000074EDE000-memory.dmp

Filesize
6.9MB

Download
memory/2692-19-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-21-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-39-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-38-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-37-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-36-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-35-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2692-33-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-31-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-29-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-27-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-25-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-23-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-41-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-42-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-43-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-44-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-45-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-46-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-47-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-48-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-49-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-50-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-51-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-52-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-53-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-54-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-55-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-56-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-57-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-58-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-59-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-60-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-61-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-62-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-63-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-64-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-65-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-66-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-67-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-68-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-69-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-70-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-71-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-72-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-73-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-74-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-75-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-76-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-77-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-78-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-79-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-80-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-81-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-82-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2692-83-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download