remcos | c90a0fb8a56eca48898e4f48ff836c8525530cd298b71f7e2eaae1f52ef230ec

Analysis

max time kernel
144s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/10/2024, 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Backdoor.exe
Size

92KB
MD5

64c1e35efba1614b4d6c3d13df87fd21
SHA1

c4896625fafb8f2af036feeba37eccd408721f1e
SHA256

c90a0fb8a56eca48898e4f48ff836c8525530cd298b71f7e2eaae1f52ef230ec
SHA512

66ef1b09553c286085c8008cfae9707b76e2db5f24d061481e9a39c07d8aa9b7d250e10c66b57d30b227738cb5ec7c659b663ef26dfb98c05c637d1b5c7e9335
SSDEEP

1536:IhhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6Pr3:OhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+0

Score

10^/10

remcos host discovery evasion persistence rat trojan

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

nxadafer-31488.portmap.host:31488

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
WinDLLExcutor.exe
copy_folder
WinDLL
delete_file
true
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%WinDir%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
WinDLL
keylog_path
%WinDir%\System32
mouse_option
false
mutex
remcos_scjkzyzdtiyoonh
screenshot_crypt
true
screenshot_flag
true
screenshot_folder
ScreenCapture
screenshot_path
%WinDir%
screenshot_time
30
startup_value
WinDLL
take_screenshot_option
false
take_screenshot_time
5

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Windows\\WinDLL\\WinDLLExcutor.exe\""	WinDLLExcutor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\WinDLL\\WinDLLExcutor.exe\""	Backdoor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe, \"C:\\Windows\\WinDLL\\WinDLLExcutor.exe\""	Backdoor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\WinDLL\\WinDLLExcutor.exe\""	WinDLLExcutor.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	WinDLLExcutor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinDLL = "\"C:\\Windows\\WinDLL\\WinDLLExcutor.exe\""	WinDLLExcutor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Backdoor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\WinDLL = "\"C:\\Windows\\WinDLL\\WinDLLExcutor.exe\""	Backdoor.exe

Deletes itself 1 IoCs

pid	Process
2556	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2760	WinDLLExcutor.exe

Loads dropped DLL 2 IoCs

pid	Process
2556	cmd.exe
2556	cmd.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDLL = "\"C:\\Windows\\WinDLL\\WinDLLExcutor.exe\""	Backdoor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinDLL = "\"C:\\Windows\\WinDLL\\WinDLLExcutor.exe\""	WinDLLExcutor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinDLL = "\"C:\\Windows\\WinDLL\\WinDLLExcutor.exe\""	WinDLLExcutor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinDLL = "\"C:\\Windows\\WinDLL\\WinDLLExcutor.exe\""	Backdoor.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	WinDLLExcutor.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	Backdoor.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\WinDLL\WinDLLExcutor.exe	Backdoor.exe
File opened for modification	C:\Windows\WinDLL\WinDLLExcutor.exe	Backdoor.exe
File opened for modification	C:\Windows\WinDLL	Backdoor.exe
File opened for modification	C:\Windows\ScreenCapture\0.png	WinDLLExcutor.exe
File created	C:\Windows\ScreenCapture\0.dat	WinDLLExcutor.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinDLLExcutor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Backdoor.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2584	PING.EXE

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2996	reg.exe
2616	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2584	PING.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2760	WinDLLExcutor.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2760	WinDLLExcutor.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2760	WinDLLExcutor.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2780	2748	Backdoor.exe	30
PID 2748 wrote to memory of 2780	2748	Backdoor.exe	30
PID 2748 wrote to memory of 2780	2748	Backdoor.exe	30
PID 2748 wrote to memory of 2780	2748	Backdoor.exe	30
PID 2748 wrote to memory of 2556	2748	Backdoor.exe	32
PID 2748 wrote to memory of 2556	2748	Backdoor.exe	32
PID 2748 wrote to memory of 2556	2748	Backdoor.exe	32
PID 2748 wrote to memory of 2556	2748	Backdoor.exe	32
PID 2748 wrote to memory of 2556	2748	Backdoor.exe	32
PID 2748 wrote to memory of 2556	2748	Backdoor.exe	32
PID 2748 wrote to memory of 2556	2748	Backdoor.exe	32
PID 2780 wrote to memory of 2996	2780	cmd.exe	34
PID 2780 wrote to memory of 2996	2780	cmd.exe	34
PID 2780 wrote to memory of 2996	2780	cmd.exe	34
PID 2780 wrote to memory of 2996	2780	cmd.exe	34
PID 2556 wrote to memory of 2584	2556	cmd.exe	35
PID 2556 wrote to memory of 2584	2556	cmd.exe	35
PID 2556 wrote to memory of 2584	2556	cmd.exe	35
PID 2556 wrote to memory of 2584	2556	cmd.exe	35
PID 2556 wrote to memory of 2760	2556	cmd.exe	36
PID 2556 wrote to memory of 2760	2556	cmd.exe	36
PID 2556 wrote to memory of 2760	2556	cmd.exe	36
PID 2556 wrote to memory of 2760	2556	cmd.exe	36
PID 2760 wrote to memory of 2596	2760	WinDLLExcutor.exe	37
PID 2760 wrote to memory of 2596	2760	WinDLLExcutor.exe	37
PID 2760 wrote to memory of 2596	2760	WinDLLExcutor.exe	37
PID 2760 wrote to memory of 2596	2760	WinDLLExcutor.exe	37
PID 2596 wrote to memory of 2616	2596	cmd.exe	40
PID 2596 wrote to memory of 2616	2596	cmd.exe	40
PID 2596 wrote to memory of 2616	2596	cmd.exe	40
PID 2596 wrote to memory of 2616	2596	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\Backdoor.exe
"C:\Users\Admin\AppData\Local\Temp\Backdoor.exe"
1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Adds Run key to start application
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\cmd.exe
  /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2996
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\SysWOW64\PING.EXE
    PING 127.0.0.1 -n 2
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2584
- - C:\Windows\WinDLL\WinDLLExcutor.exe
    "C:\Windows\WinDLL\WinDLLExcutor.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Adds policy Run key to start application
    - Executes dropped EXE
    - Adds Run key to start application
    - Modifies WinLogon
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Windows\SysWOW64\cmd.exe
      /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2596
    - - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.bat

Filesize
140B

MD5
7e921a52b52b2552da02d7cdac18e88c

SHA1
1c700f70b6d6770b76e49454c3fd061c689121d8

SHA256
a632f031e7b3c05a9e80724c0e731ba88169fda4608454125ba0467206611777

SHA512
246ecfac60f7f20228c778dc3d84aafd58ca6eaf697a5f448faef4800b0c19ee63ce0956ba43e3050017ff9854ee0bd5b99309f0846b3ea391fe98725e87c681

Download Submit
\Windows\WinDLL\WinDLLExcutor.exe

Filesize
92KB

MD5
64c1e35efba1614b4d6c3d13df87fd21

SHA1
c4896625fafb8f2af036feeba37eccd408721f1e

SHA256
c90a0fb8a56eca48898e4f48ff836c8525530cd298b71f7e2eaae1f52ef230ec

SHA512
66ef1b09553c286085c8008cfae9707b76e2db5f24d061481e9a39c07d8aa9b7d250e10c66b57d30b227738cb5ec7c659b663ef26dfb98c05c637d1b5c7e9335

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads