remcos | e5d4dd5cfd8214af02cc82d94a47a411df696b12e9ba94ad73193263b9527bb3

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/10/2024, 13:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

inspectionDocs1-pdf.exe
Size

487KB
MD5

01f1edaadf867c124fceea9dbfa1ed29
SHA1

d69c565e28e2f49cf04641c7777b31d15ba3bb96
SHA256

657047361a9c9c09c96808adbdcec56a17f7e5a5e11ea4565d88b6dcdb2a7fc6
SHA512

6b26c141c7152a12fa2c2ae0595dc148d0525c7e250ca32008764bddf35bfb0fa360c1adc6120de8fcc731a3e3ba5db70f4c221ef2b6fde2ef19619f7ec4bb3b
SSDEEP

12288:GKcpQDXSv1Bt/rs0MoyfMsSAHY7R/6s/nA4h:GlCS13Ly5SAHAR/6+nAC

Score

10^/10

remcos yavakosa discovery persistence rat

Malware Config

Extracted

Family

remcos

Botnet

Yavakosa

198.23.227.212:32583

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
yavascript.exe
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-T59BEJ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	inspectionDocs1-pdf.exe

Executes dropped EXE 1 IoCs

pid	Process
4656	yavascript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-T59BEJ = "\"C:\\Users\\Admin\\AppData\\Roaming\\yavascript.exe\""	inspectionDocs1-pdf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-T59BEJ = "\"C:\\Users\\Admin\\AppData\\Roaming\\yavascript.exe\""	yavascript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 30 IoCs

pid	pid_target	Process	procid_target
4728	432	WerFault.exe	84
2704	432	WerFault.exe	84
2060	432	WerFault.exe	84
1476	432	WerFault.exe	84
3024	432	WerFault.exe	84
2148	432	WerFault.exe	84
4708	432	WerFault.exe	84
2204	4656	WerFault.exe	100
3976	4656	WerFault.exe	100
2480	4656	WerFault.exe	100
1320	4656	WerFault.exe	100
2200	4656	WerFault.exe	100
1088	4656	WerFault.exe	100
1868	4656	WerFault.exe	100
872	4656	WerFault.exe	100
1560	4656	WerFault.exe	100
1568	4656	WerFault.exe	100
4328	4656	WerFault.exe	100
2016	4656	WerFault.exe	100
2604	4656	WerFault.exe	100
2068	4656	WerFault.exe	100
1900	4656	WerFault.exe	100
3612	4656	WerFault.exe	100
1716	4656	WerFault.exe	100
4748	4656	WerFault.exe	100
3036	4656	WerFault.exe	100
2212	4656	WerFault.exe	100
1096	4656	WerFault.exe	100
2328	4656	WerFault.exe	100
5040	4656	WerFault.exe	100

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	inspectionDocs1-pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yavascript.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 4656	432	inspectionDocs1-pdf.exe	100
PID 432 wrote to memory of 4656	432	inspectionDocs1-pdf.exe	100
PID 432 wrote to memory of 4656	432	inspectionDocs1-pdf.exe	100

C:\Users\Admin\AppData\Local\Temp\inspectionDocs1-pdf.exe
"C:\Users\Admin\AppData\Local\Temp\inspectionDocs1-pdf.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 1016
  2⤵
  - Program crash
  PID:4728
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 1048
  2⤵
  - Program crash
  PID:2704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 1156
  2⤵
  - Program crash
  PID:2060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 1048
  2⤵
  - Program crash
  PID:1476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 1048
  2⤵
  - Program crash
  PID:3024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 1180
  2⤵
  - Program crash
  PID:2148
- C:\Users\Admin\AppData\Roaming\yavascript.exe
  "C:\Users\Admin\AppData\Roaming\yavascript.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 668
    3⤵
    - Program crash
    PID:2204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 700
    3⤵
    - Program crash
    PID:3976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 752
    3⤵
    - Program crash
    PID:2480
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 776
    3⤵
    - Program crash
    PID:1320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 760
    3⤵
    - Program crash
    PID:2200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 948
    3⤵
    - Program crash
    PID:1088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 968
    3⤵
    - Program crash
    PID:1868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 1000
    3⤵
    - Program crash
    PID:872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 1020
    3⤵
    - Program crash
    PID:1560
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 1084
    3⤵
    - Program crash
    PID:1568
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 1168
    3⤵
    - Program crash
    PID:4328
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 708
    3⤵
    - Program crash
    PID:2016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 1228
    3⤵
    - Program crash
    PID:2604
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 984
    3⤵
    - Program crash
    PID:2068
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 1384
    3⤵
    - Program crash
    PID:1900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 748
    3⤵
    - Program crash
    PID:3612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 1420
    3⤵
    - Program crash
    PID:1716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 1384
    3⤵
    - Program crash
    PID:4748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 1416
    3⤵
    - Program crash
    PID:3036
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 880
    3⤵
    - Program crash
    PID:2212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 944
    3⤵
    - Program crash
    PID:1096
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 952
    3⤵
    - Program crash
    PID:2328
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 1464
    3⤵
    - Program crash
    PID:5040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 432 -s 1360
  2⤵
  - Program crash
  PID:4708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 432 -ip 432
1⤵
PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 432 -ip 432
1⤵
PID:724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 432 -ip 432
1⤵
PID:3344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 432 -ip 432
1⤵
PID:1128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 432 -ip 432
1⤵
PID:4060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 432 -ip 432
1⤵
PID:1344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 432 -ip 432
1⤵
PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4656 -ip 4656
1⤵
PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4656 -ip 4656
1⤵
PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4656 -ip 4656
1⤵
PID:1064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4656 -ip 4656
1⤵
PID:1624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4656 -ip 4656
1⤵
PID:332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4656 -ip 4656
1⤵
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4656 -ip 4656
1⤵
PID:4676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4656 -ip 4656
1⤵
PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4656 -ip 4656
1⤵
PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4656 -ip 4656
1⤵
PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4656 -ip 4656
1⤵
PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4656 -ip 4656
1⤵
PID:3172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4656 -ip 4656
1⤵
PID:4540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4656 -ip 4656
1⤵
PID:1476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4656 -ip 4656
1⤵
PID:1840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4656 -ip 4656
1⤵
PID:860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4656 -ip 4656
1⤵
PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4656 -ip 4656
1⤵
PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4656 -ip 4656
1⤵
PID:4996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4656 -ip 4656
1⤵
PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4656 -ip 4656
1⤵
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4656 -ip 4656
1⤵
PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4656 -ip 4656
1⤵
PID:4336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\yavascript.exe

Filesize
487KB

MD5
01f1edaadf867c124fceea9dbfa1ed29

SHA1
d69c565e28e2f49cf04641c7777b31d15ba3bb96

SHA256
657047361a9c9c09c96808adbdcec56a17f7e5a5e11ea4565d88b6dcdb2a7fc6

SHA512
6b26c141c7152a12fa2c2ae0595dc148d0525c7e250ca32008764bddf35bfb0fa360c1adc6120de8fcc731a3e3ba5db70f4c221ef2b6fde2ef19619f7ec4bb3b

Download Submit
memory/432-1-0x0000000000770000-0x0000000000870000-memory.dmp

Filesize
1024KB

Download
memory/432-2-0x00000000006C0000-0x000000000073A000-memory.dmp

Filesize
488KB

Download
memory/432-3-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/432-12-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/432-14-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/432-13-0x00000000006C0000-0x000000000073A000-memory.dmp

Filesize
488KB

Download
memory/4656-22-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/4656-26-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/4656-18-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/4656-20-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/4656-21-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/4656-16-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/4656-23-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/4656-24-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/4656-25-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/4656-17-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/4656-27-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/4656-28-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/4656-29-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/4656-30-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/4656-31-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/4656-32-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/4656-33-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/4656-34-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/4656-35-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads