remcos | 935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe
Size

944KB
MD5

b8d56a76c20f7112dad67dcf0ed7db76
SHA1

de67506c08d6fef79fff815e27cda68403980fc9
SHA256

935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea
SHA512

8211cd38a129df696ce6b5909990095c1762db549ca6c3781027c9394bb835812401237c669cdb72acb9941cf068fea1935719817bbe752a5a7df772293075ec
SSDEEP

12288:snC0mUwAF27PpvOvGrAl+5tbmzaCKqk0eua+ANHNAtFDQEa5g3M5JQCjXPpXylhd:KmUXFYpRrZ55jCKq/etMeDgc5PjN6cE

Score

10^/10

remcos mekus discovery execution rat

Malware Config

Extracted

Family

remcos

Botnet

mekus

dpm-sael.com:2017

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
meckus-ODY51K
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3036	powershell.exe
2768	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1940 set thread context of 2756	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	38

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2800	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe
1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe
1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe
1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe
2768	powershell.exe
3036	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe
Token: SeDebugPrivilege	2768	powershell.exe
Token: SeDebugPrivilege	3036	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2756	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 3036	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	31
PID 1940 wrote to memory of 3036	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	31
PID 1940 wrote to memory of 3036	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	31
PID 1940 wrote to memory of 3036	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	31
PID 1940 wrote to memory of 2768	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	33
PID 1940 wrote to memory of 2768	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	33
PID 1940 wrote to memory of 2768	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	33
PID 1940 wrote to memory of 2768	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	33
PID 1940 wrote to memory of 2800	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	34
PID 1940 wrote to memory of 2800	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	34
PID 1940 wrote to memory of 2800	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	34
PID 1940 wrote to memory of 2800	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	34
PID 1940 wrote to memory of 2316	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	37
PID 1940 wrote to memory of 2316	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	37
PID 1940 wrote to memory of 2316	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	37
PID 1940 wrote to memory of 2316	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	37
PID 1940 wrote to memory of 2756	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	38
PID 1940 wrote to memory of 2756	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	38
PID 1940 wrote to memory of 2756	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	38
PID 1940 wrote to memory of 2756	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	38
PID 1940 wrote to memory of 2756	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	38
PID 1940 wrote to memory of 2756	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	38
PID 1940 wrote to memory of 2756	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	38
PID 1940 wrote to memory of 2756	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	38
PID 1940 wrote to memory of 2756	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	38
PID 1940 wrote to memory of 2756	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	38
PID 1940 wrote to memory of 2756	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	38
PID 1940 wrote to memory of 2756	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	38
PID 1940 wrote to memory of 2756	1940	935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe	38

C:\Users\Admin\AppData\Local\Temp\935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe
"C:\Users\Admin\AppData\Local\Temp\935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3036
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RhFlTiIjgELLJp.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2768
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RhFlTiIjgELLJp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp15A3.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2800
- C:\Users\Admin\AppData\Local\Temp\935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe
  "C:\Users\Admin\AppData\Local\Temp\935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe"
  2⤵
  PID:2316
- C:\Users\Admin\AppData\Local\Temp\935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe
  "C:\Users\Admin\AppData\Local\Temp\935a99d2fbb4053dadbfe9da227f4019d0807785bb193e56e719b7583f49b1ea.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
fd422c35a56d60f2905a5ea5f7fd4f05

SHA1
1eb42d1b78f182e13993d1b3d2a85238f1685b6b

SHA256
a99ab518c7678d921bfc9571492f37e6165db13c641b54ea5e2e47c221939937

SHA512
5a87c7200b3c3a5d919f92d886657ff6564422ab6217b0caa6664fb7ded23db6db89761aaa2cde2c78b9a6f387226a3548ecc94d17047ac6f44c4cbd3c6fa96f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp15A3.tmp

Filesize
1KB

MD5
e603854458df621fc5147173f624aa06

SHA1
f7e80102233ef4a9ec57b791a323a5b23bed6ab6

SHA256
49f17035b2efb9fc6794c3300a64f9f247b6391efd255490cd0bdb3fe9b85cee

SHA512
8651e77d27574dae284060d8b56961a97c637d69e9af1214d7b37b317a46de1c8143de5d2abf3e79e5bfdf9a1416cdfd7504b71afefc497784c00e02e2fc5351

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
a9c42d610be5e4a8a6ec499243a19976

SHA1
877ba9349c4201fcc75de7fbb35350ca67d052b5

SHA256
b7cd1d26d861aec28dee8b581c9ca11bcd55b9d582397a8d06c169ca5775a22f

SHA512
6b3eb962b2216ac68844c298c86dfeb75ca666e606fb74696571b8d1c55eb6ef5a17e93ef4f3ee595c26ed5aa790e56a9bb35143f0b73c9896b04a01a614b065

Download Submit
memory/1940-0-0x000000007443E000-0x000000007443F000-memory.dmp

Filesize
4KB

Download
memory/1940-1-0x0000000000E40000-0x0000000000F32000-memory.dmp

Filesize
968KB

Download
memory/1940-2-0x0000000074430000-0x0000000074B1E000-memory.dmp

Filesize
6.9MB

Download
memory/1940-3-0x0000000000440000-0x0000000000458000-memory.dmp

Filesize
96KB

Download
memory/1940-4-0x000000007443E000-0x000000007443F000-memory.dmp

Filesize
4KB

Download
memory/1940-5-0x0000000074430000-0x0000000074B1E000-memory.dmp

Filesize
6.9MB

Download
memory/1940-6-0x0000000005500000-0x00000000055C0000-memory.dmp

Filesize
768KB

Download
memory/1940-42-0x0000000074430000-0x0000000074B1E000-memory.dmp

Filesize
6.9MB

Download
memory/2756-21-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-19-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-41-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-38-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-37-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-36-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2756-33-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-31-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-29-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-27-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-25-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-23-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-43-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-44-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-45-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-46-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-47-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-49-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-50-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-51-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-52-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-54-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-55-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-56-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-57-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-58-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-60-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-61-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-62-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-63-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-64-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-66-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-67-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-68-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-69-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-71-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-72-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-73-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-74-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-75-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-77-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-78-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-79-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-80-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-82-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-83-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-84-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-85-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-86-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-88-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-89-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-90-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2756-91-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download