remcos | ce89d311b330e35c55d76d79a59c4f5c4296af02ddbfa3f86c7ef45d177be2b5

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/11/2024, 05:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New Order 20242405.exe
Size

1006KB
MD5

a7a06e3b861b20e1969209a06cf79645
SHA1

690925d642a8ab2c465590f473008dbe81190c14
SHA256

ab8953a3cb88e1a5f5416f535c8857eba7062a741a527f7fed5274802d90d4f7
SHA512

0fb13ffa94afca55aaca1283f010910ef0f38497c123c88fa6e31107c6c4560af2aaf84690b62a5bd294541fa2b41e975bc3c648aa20624c779ff477434c2689
SSDEEP

24576:xNF5a247iDhR+WYig4d5bUU9iTO0LNtG5:xNF1hRzg4d5Y55XQ

Score

10^/10

remcos remotehost discovery execution persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

eadzagba.duckdns.org:2264

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-03T4TH
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2832	powershell.exe
736	powershell.exe

Executes dropped EXE 6 IoCs

pid	Process
2696	remcos.exe
1760	remcos.exe
1904	remcos.exe
2144	remcos.exe
2428	remcos.exe
2440	remcos.exe

Loads dropped DLL 1 IoCs

pid	Process
2736	New Order 20242405.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-03T4TH = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	New Order 20242405.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-03T4TH = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	New Order 20242405.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2544 set thread context of 2736	2544	New Order 20242405.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Order 20242405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Order 20242405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2828	schtasks.exe
2092	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2544	New Order 20242405.exe
2544	New Order 20242405.exe
2544	New Order 20242405.exe
2544	New Order 20242405.exe
2544	New Order 20242405.exe
2544	New Order 20242405.exe
2544	New Order 20242405.exe
2544	New Order 20242405.exe
2544	New Order 20242405.exe
2544	New Order 20242405.exe
2832	powershell.exe
2696	remcos.exe
2696	remcos.exe
2696	remcos.exe
2696	remcos.exe
2696	remcos.exe
2696	remcos.exe
2696	remcos.exe
2696	remcos.exe
736	powershell.exe
2696	remcos.exe
2696	remcos.exe
2696	remcos.exe
2696	remcos.exe
2696	remcos.exe
2696	remcos.exe
2696	remcos.exe
2696	remcos.exe
2696	remcos.exe
2696	remcos.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2544	New Order 20242405.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeDebugPrivilege	2696	remcos.exe
Token: SeDebugPrivilege	736	powershell.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2832	2544	New Order 20242405.exe	31
PID 2544 wrote to memory of 2832	2544	New Order 20242405.exe	31
PID 2544 wrote to memory of 2832	2544	New Order 20242405.exe	31
PID 2544 wrote to memory of 2832	2544	New Order 20242405.exe	31
PID 2544 wrote to memory of 2828	2544	New Order 20242405.exe	33
PID 2544 wrote to memory of 2828	2544	New Order 20242405.exe	33
PID 2544 wrote to memory of 2828	2544	New Order 20242405.exe	33
PID 2544 wrote to memory of 2828	2544	New Order 20242405.exe	33
PID 2544 wrote to memory of 2736	2544	New Order 20242405.exe	35
PID 2544 wrote to memory of 2736	2544	New Order 20242405.exe	35
PID 2544 wrote to memory of 2736	2544	New Order 20242405.exe	35
PID 2544 wrote to memory of 2736	2544	New Order 20242405.exe	35
PID 2544 wrote to memory of 2736	2544	New Order 20242405.exe	35
PID 2544 wrote to memory of 2736	2544	New Order 20242405.exe	35
PID 2544 wrote to memory of 2736	2544	New Order 20242405.exe	35
PID 2544 wrote to memory of 2736	2544	New Order 20242405.exe	35
PID 2544 wrote to memory of 2736	2544	New Order 20242405.exe	35
PID 2544 wrote to memory of 2736	2544	New Order 20242405.exe	35
PID 2544 wrote to memory of 2736	2544	New Order 20242405.exe	35
PID 2544 wrote to memory of 2736	2544	New Order 20242405.exe	35
PID 2544 wrote to memory of 2736	2544	New Order 20242405.exe	35
PID 2736 wrote to memory of 2696	2736	New Order 20242405.exe	36
PID 2736 wrote to memory of 2696	2736	New Order 20242405.exe	36
PID 2736 wrote to memory of 2696	2736	New Order 20242405.exe	36
PID 2736 wrote to memory of 2696	2736	New Order 20242405.exe	36
PID 2696 wrote to memory of 736	2696	remcos.exe	37
PID 2696 wrote to memory of 736	2696	remcos.exe	37
PID 2696 wrote to memory of 736	2696	remcos.exe	37
PID 2696 wrote to memory of 736	2696	remcos.exe	37
PID 2696 wrote to memory of 2092	2696	remcos.exe	39
PID 2696 wrote to memory of 2092	2696	remcos.exe	39
PID 2696 wrote to memory of 2092	2696	remcos.exe	39
PID 2696 wrote to memory of 2092	2696	remcos.exe	39
PID 2696 wrote to memory of 1760	2696	remcos.exe	41
PID 2696 wrote to memory of 1760	2696	remcos.exe	41
PID 2696 wrote to memory of 1760	2696	remcos.exe	41
PID 2696 wrote to memory of 1760	2696	remcos.exe	41
PID 2696 wrote to memory of 2144	2696	remcos.exe	42
PID 2696 wrote to memory of 2144	2696	remcos.exe	42
PID 2696 wrote to memory of 2144	2696	remcos.exe	42
PID 2696 wrote to memory of 2144	2696	remcos.exe	42
PID 2696 wrote to memory of 1904	2696	remcos.exe	43
PID 2696 wrote to memory of 1904	2696	remcos.exe	43
PID 2696 wrote to memory of 1904	2696	remcos.exe	43
PID 2696 wrote to memory of 1904	2696	remcos.exe	43
PID 2696 wrote to memory of 2440	2696	remcos.exe	44
PID 2696 wrote to memory of 2440	2696	remcos.exe	44
PID 2696 wrote to memory of 2440	2696	remcos.exe	44
PID 2696 wrote to memory of 2440	2696	remcos.exe	44
PID 2696 wrote to memory of 2428	2696	remcos.exe	45
PID 2696 wrote to memory of 2428	2696	remcos.exe	45
PID 2696 wrote to memory of 2428	2696	remcos.exe	45
PID 2696 wrote to memory of 2428	2696	remcos.exe	45

C:\Users\Admin\AppData\Local\Temp\New Order 20242405.exe
"C:\Users\Admin\AppData\Local\Temp\New Order 20242405.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WUYdDsHgxSy.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2832
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WUYdDsHgxSy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp50CE.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2828
- C:\Users\Admin\AppData\Local\Temp\New Order 20242405.exe
  "C:\Users\Admin\AppData\Local\Temp\New Order 20242405.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\ProgramData\Remcos\remcos.exe
    "C:\ProgramData\Remcos\remcos.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WUYdDsHgxSy.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:736
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WUYdDsHgxSy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBFA7.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2092
  - - C:\ProgramData\Remcos\remcos.exe
      "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Executes dropped EXE
      PID:1760
  - - C:\ProgramData\Remcos\remcos.exe
      "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Executes dropped EXE
      PID:2144
  - - C:\ProgramData\Remcos\remcos.exe
      "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Executes dropped EXE
      PID:1904
  - - C:\ProgramData\Remcos\remcos.exe
      "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Executes dropped EXE
      PID:2440
  - - C:\ProgramData\Remcos\remcos.exe
      "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Executes dropped EXE
      PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Remcos\remcos.exe

Filesize
1006KB

MD5
a7a06e3b861b20e1969209a06cf79645

SHA1
690925d642a8ab2c465590f473008dbe81190c14

SHA256
ab8953a3cb88e1a5f5416f535c8857eba7062a741a527f7fed5274802d90d4f7

SHA512
0fb13ffa94afca55aaca1283f010910ef0f38497c123c88fa6e31107c6c4560af2aaf84690b62a5bd294541fa2b41e975bc3c648aa20624c779ff477434c2689

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp50CE.tmp

Filesize
1KB

MD5
f8f164017d503ad6bd29c9c2ea072674

SHA1
94c70653320c3e0b9f6df00cfc081f0d557fabe9

SHA256
c9ef823bb0cb9ca1033a613e755a77c94e7208c7cf05326b755b8fd715ce036e

SHA512
95f9064ae528aa68fca2208590b3be474ddb6ad277ebd03bc50ab73386abf8d55ab365d91ed182029be609955379b931fd685658f751fdc302a38957ef36ca17

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
9028bf7f637ffd8723cfb7e4061fe73c

SHA1
96ba2968927064a22c61952b42d91204b396455d

SHA256
a18934c53d2916ef94eaedd8932bd88ff5533458b503ec6e70e8134c8bdaa35d

SHA512
14b924b26993f83e6285ef4ef8cc20ffe94a94d4781f8daeb67474902cfd7ca3445cf302ffd2d5f15079c7547f53f8fbeb3fa962600d05856d7427c291a894d1

Download Submit
memory/2544-1-0x0000000000F90000-0x000000000108E000-memory.dmp

Filesize
1016KB

Download
memory/2544-2-0x00000000740F0000-0x00000000747DE000-memory.dmp

Filesize
6.9MB

Download
memory/2544-3-0x0000000000440000-0x000000000045E000-memory.dmp

Filesize
120KB

Download
memory/2544-4-0x00000000740FE000-0x00000000740FF000-memory.dmp

Filesize
4KB

Download
memory/2544-5-0x00000000740F0000-0x00000000747DE000-memory.dmp

Filesize
6.9MB

Download
memory/2544-6-0x000000000AC60000-0x000000000AD20000-memory.dmp

Filesize
768KB

Download
memory/2544-0-0x00000000740FE000-0x00000000740FF000-memory.dmp

Filesize
4KB

Download
memory/2544-34-0x00000000740F0000-0x00000000747DE000-memory.dmp

Filesize
6.9MB

Download
memory/2696-41-0x00000000003C0000-0x00000000004BE000-memory.dmp

Filesize
1016KB

Download
memory/2736-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2736-24-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2736-22-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2736-32-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2736-26-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2736-28-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2736-20-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2736-16-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2736-14-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2736-31-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2736-18-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download