remcos | 6c4d9c5cec621f7011b2a5cc6ab33854a7b79f9dd063026dc10610c68d83dbf3

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-10-2024 08:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Purchase Order Braiconf SA – 16.10.2024.pif.exe
Size

1.2MB
MD5

934f1442e272b0ed71069f8139c5c123
SHA1

bf85d02e69ae51fabf72765fbf0a2561c9731537
SHA256

6c4d9c5cec621f7011b2a5cc6ab33854a7b79f9dd063026dc10610c68d83dbf3
SHA512

04bc23fe7773caabc571d34fbde40cdb16b87d0288cc566b607069c740220490ee257b77119785a9902808cd6ac6c15cc0dc72daa3091d0332cd16c53b90b2d5
SSDEEP

24576:bEO2KYzT3fNjnwgjbfHlMekUzGMbzZCHGuiYzsf/YvbFAA:bZ/Yz75jh9z79C/Sf

Score

10^/10

remcos makuo discovery rat

Malware Config

Extracted

Family

remcos

Botnet

makuo

remmyc.duckdns.org:57155

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-82JTYR
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3276 created 3508	3276	Purchase Order Braiconf SA – 16.10.2024.pif.exe	56

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Certificate.vbs	Purchase Order Braiconf SA – 16.10.2024.pif.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3276 set thread context of 2572	3276	Purchase Order Braiconf SA – 16.10.2024.pif.exe	87

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Purchase Order Braiconf SA – 16.10.2024.pif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3276	Purchase Order Braiconf SA – 16.10.2024.pif.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3276	Purchase Order Braiconf SA – 16.10.2024.pif.exe
Token: SeDebugPrivilege	3276	Purchase Order Braiconf SA – 16.10.2024.pif.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2572	InstallUtil.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 2572	3276	Purchase Order Braiconf SA – 16.10.2024.pif.exe	87
PID 3276 wrote to memory of 2572	3276	Purchase Order Braiconf SA – 16.10.2024.pif.exe	87
PID 3276 wrote to memory of 2572	3276	Purchase Order Braiconf SA – 16.10.2024.pif.exe	87
PID 3276 wrote to memory of 2572	3276	Purchase Order Braiconf SA – 16.10.2024.pif.exe	87
PID 3276 wrote to memory of 2572	3276	Purchase Order Braiconf SA – 16.10.2024.pif.exe	87
PID 3276 wrote to memory of 2572	3276	Purchase Order Braiconf SA – 16.10.2024.pif.exe	87
PID 3276 wrote to memory of 2572	3276	Purchase Order Braiconf SA – 16.10.2024.pif.exe	87
PID 3276 wrote to memory of 2572	3276	Purchase Order Braiconf SA – 16.10.2024.pif.exe	87
PID 3276 wrote to memory of 2572	3276	Purchase Order Braiconf SA – 16.10.2024.pif.exe	87
PID 3276 wrote to memory of 2572	3276	Purchase Order Braiconf SA – 16.10.2024.pif.exe	87
PID 3276 wrote to memory of 2572	3276	Purchase Order Braiconf SA – 16.10.2024.pif.exe	87
PID 3276 wrote to memory of 2572	3276	Purchase Order Braiconf SA – 16.10.2024.pif.exe	87

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3508
- C:\Users\Admin\AppData\Local\Temp\Purchase Order Braiconf SA – 16.10.2024.pif.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Order Braiconf SA – 16.10.2024.pif.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops startup file
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3276
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
aa177bebf565e8b8d74e77761731f69f

SHA1
d0f60e2608787361a2c3ae93e2f1a856b273d945

SHA256
f1e05a3eb1cec61987299be565b0ba84343b29641ffbcb7458606e7c6d695c1d

SHA512
4fc11ca28d37820e529400522279a000325bd9fc9b4990c0936981ae46516a848cf5b691fcf598d862be1fbd09a50b1548df692ef9e291423fdaba993e9cc7e0

Download Submit
memory/2572-1098-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2572-1111-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/3276-32-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-2-0x0000000005310000-0x0000000005436000-memory.dmp

Filesize
1.1MB

Download
memory/3276-10-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-12-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-68-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-66-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-64-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-62-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-60-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-58-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-54-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-52-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-50-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-48-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-46-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-44-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-30-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-40-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-38-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-36-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-34-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-0-0x000000007494E000-0x000000007494F000-memory.dmp

Filesize
4KB

Download
memory/3276-26-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-4-0x00000000054D0000-0x0000000005562000-memory.dmp

Filesize
584KB

Download
memory/3276-42-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-24-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-22-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-20-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-16-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-14-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-56-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-18-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-8-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-6-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-5-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-1079-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download
memory/3276-1080-0x0000000005570000-0x0000000005608000-memory.dmp

Filesize
608KB

Download
memory/3276-1081-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download
memory/3276-1082-0x0000000005460000-0x00000000054AC000-memory.dmp

Filesize
304KB

Download
memory/3276-1086-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download
memory/3276-1087-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download
memory/3276-1088-0x0000000005810000-0x0000000005864000-memory.dmp

Filesize
336KB

Download
memory/3276-3-0x00000000059E0000-0x0000000005F84000-memory.dmp

Filesize
5.6MB

Download
memory/3276-1099-0x0000000074940000-0x00000000750F0000-memory.dmp

Filesize
7.7MB

Download
memory/3276-28-0x0000000005310000-0x0000000005430000-memory.dmp

Filesize
1.1MB

Download
memory/3276-1-0x00000000007B0000-0x00000000008E2000-memory.dmp

Filesize
1.2MB

Download