remcos | f598d0d709c87d2a6411cec416a9eb92ccbfd2c335d9a3e2ea15d363588c3c16

Analysis

max time kernel
299s
max time network
300s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 16:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PO2780.exe
Size

1.0MB
MD5

48bfcf08c8ba3d7f0621ad8ce7802157
SHA1

96661e0ba26e1a98cd9eedfba3f3817e281cf190
SHA256

f437abfad6088e7817b71f37ea5e3204c96e845f08dd9d524203c05609fb0699
SHA512

7d04360468985ada48d34781db3e3b6254a8ef14a1d13dabf8b5624881db52e3eac0379f4df7028ed33a92a2c288a79f72f69a18e3f9abe8d6b95fb106bbb553
SSDEEP

12288:aUimcBPOUDcc25O5Jht8rf2jtnVQM+9VdjlVdZBcbFgj54tOGZhGSqAFdUu7NzPg:v6msccSkjtGfg7o9ZBcZB8Gi+dTxjTE

Score

10^/10

remcos maharaba discovery execution rat

Malware Config

Extracted

Family

remcos

Botnet

MAHARABA

64.188.20.210:3800

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-W8QVO9
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3040	powershell.exe
2812	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2640 set thread context of 1260	2640	PO2780.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PO2780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PO2780.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2848	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2640	PO2780.exe
2640	PO2780.exe
2640	PO2780.exe
2640	PO2780.exe
2640	PO2780.exe
2640	PO2780.exe
2640	PO2780.exe
2640	PO2780.exe
3040	powershell.exe
2812	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2640	PO2780.exe
Token: SeDebugPrivilege	3040	powershell.exe
Token: SeDebugPrivilege	2812	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 3040	2640	PO2780.exe	30
PID 2640 wrote to memory of 3040	2640	PO2780.exe	30
PID 2640 wrote to memory of 3040	2640	PO2780.exe	30
PID 2640 wrote to memory of 3040	2640	PO2780.exe	30
PID 2640 wrote to memory of 2812	2640	PO2780.exe	32
PID 2640 wrote to memory of 2812	2640	PO2780.exe	32
PID 2640 wrote to memory of 2812	2640	PO2780.exe	32
PID 2640 wrote to memory of 2812	2640	PO2780.exe	32
PID 2640 wrote to memory of 2848	2640	PO2780.exe	34
PID 2640 wrote to memory of 2848	2640	PO2780.exe	34
PID 2640 wrote to memory of 2848	2640	PO2780.exe	34
PID 2640 wrote to memory of 2848	2640	PO2780.exe	34
PID 2640 wrote to memory of 1260	2640	PO2780.exe	36
PID 2640 wrote to memory of 1260	2640	PO2780.exe	36
PID 2640 wrote to memory of 1260	2640	PO2780.exe	36
PID 2640 wrote to memory of 1260	2640	PO2780.exe	36
PID 2640 wrote to memory of 1260	2640	PO2780.exe	36
PID 2640 wrote to memory of 1260	2640	PO2780.exe	36
PID 2640 wrote to memory of 1260	2640	PO2780.exe	36
PID 2640 wrote to memory of 1260	2640	PO2780.exe	36
PID 2640 wrote to memory of 1260	2640	PO2780.exe	36
PID 2640 wrote to memory of 1260	2640	PO2780.exe	36
PID 2640 wrote to memory of 1260	2640	PO2780.exe	36
PID 2640 wrote to memory of 1260	2640	PO2780.exe	36
PID 2640 wrote to memory of 1260	2640	PO2780.exe	36

C:\Users\Admin\AppData\Local\Temp\PO2780.exe
"C:\Users\Admin\AppData\Local\Temp\PO2780.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO2780.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DocvnlNWbmRb.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2812
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DocvnlNWbmRb" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8102.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2848
- C:\Users\Admin\AppData\Local\Temp\PO2780.exe
  "C:\Users\Admin\AppData\Local\Temp\PO2780.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp8102.tmp

Filesize
1KB

MD5
d08bd84ec1935780509ed46ba13cb3b6

SHA1
0c4925f5282c23bca8da27490a3dd6b66c18f14b

SHA256
0c11bd94eab9e47b48ca4aa9dd82e9d16e894ba691fce509fcd0096984d962cd

SHA512
f086b6a404a99908fbb24aece47fb84f42c39465e92f15b2000c2ae51cf22c8a8c18c7cab387ae2abfcc0861076983865a582c9099d61fcb75ba2622f7e0215e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
3950324c216bc365102548d22c4bb0f6

SHA1
6165fec3d3559de6010faaf2f6313edbad8f6eda

SHA256
191db6a58e0cc6ea10138cfdb20388003b68bb5571065bbbab4349c30c60e838

SHA512
e2607c38372abc5ed48ef9c9f29bd16dd2663bb7e70c0e8214b5cac87c887ae35ae177f45fd47dcd45f71c2540b7a27b1f8039895b0955c5b08fae92c5b3437f

Download Submit
memory/1260-23-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-62-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-63-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-21-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-59-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-58-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-56-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-19-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-54-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-39-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-38-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-37-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1260-33-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-31-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-29-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-28-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-25-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-36-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-52-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-47-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-41-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-42-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-43-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-46-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-53-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-48-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-49-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-51-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1260-50-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2640-40-0x0000000074950000-0x000000007503E000-memory.dmp

Filesize
6.9MB

Download
memory/2640-3-0x0000000000580000-0x0000000000598000-memory.dmp

Filesize
96KB

Download
memory/2640-0-0x000000007495E000-0x000000007495F000-memory.dmp

Filesize
4KB

Download
memory/2640-1-0x0000000000BE0000-0x0000000000CEC000-memory.dmp

Filesize
1.0MB

Download
memory/2640-2-0x0000000074950000-0x000000007503E000-memory.dmp

Filesize
6.9MB

Download
memory/2640-6-0x00000000050A0000-0x000000000515E000-memory.dmp

Filesize
760KB

Download
memory/2640-5-0x0000000074950000-0x000000007503E000-memory.dmp

Filesize
6.9MB

Download
memory/2640-4-0x000000007495E000-0x000000007495F000-memory.dmp

Filesize
4KB

Download