remcos | f5277278370d2ba066b6c402183d0c4204a6367a6f92ef261e18b1c40484b92c

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
05/11/2024, 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

027f61e8861f743bf8e8cb0ca2ea5de056790cffed76d375e5e84f6575bc7ff6.exe
Size

2.8MB
MD5

45f06e05ee29b52bbaad37c5cdeadc18
SHA1

4a146193a9705565694f4d9a0894d49672c8e74c
SHA256

027f61e8861f743bf8e8cb0ca2ea5de056790cffed76d375e5e84f6575bc7ff6
SHA512

fe7fc8522f36942e7a6a4e3b8897a41e6de58432353325f7eb7ec0767ed7d1bd1624f3cd176c2b07a62ff87c0f20fe623b95fcda330344d6ea56b372863e6d8a
SSDEEP

49152:nQ+gwLSXSrhe6GCiYcRHXePEdjK1Q1CjAS1LC8FkruizcmhkT6ZFQzKF3AS:Qll4mKbjAS1vkqFwkT6ZFTF3A

Score

10^/10

remcos hopa discovery evasion persistence rat trojan

Malware Config

Extracted

Family

remcos

Version

3.3.0 Pro

Botnet

hopa

178.20.44.131:2405

my.bingoroll20.net:2405

my.bingoroll19.net:2405

my.bingoroll18.net:2405

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
winmap.exe
copy_folder
winmap
delete_file
true
hide_file
true
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
pidron-PXIKI2
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
winmap
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	winmap.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	027f61e8861f743bf8e8cb0ca2ea5de056790cffed76d375e5e84f6575bc7ff6.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	027f61e8861f743bf8e8cb0ca2ea5de056790cffed76d375e5e84f6575bc7ff6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winmap = "\"C:\\Users\\Admin\\AppData\\Roaming\\winmap\\winmap.exe\""	027f61e8861f743bf8e8cb0ca2ea5de056790cffed76d375e5e84f6575bc7ff6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winmap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\winmap = "\"C:\\Users\\Admin\\AppData\\Roaming\\winmap\\winmap.exe\""	winmap.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	027f61e8861f743bf8e8cb0ca2ea5de056790cffed76d375e5e84f6575bc7ff6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	winmap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	winmap.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	027f61e8861f743bf8e8cb0ca2ea5de056790cffed76d375e5e84f6575bc7ff6.exe

Deletes itself 1 IoCs

pid	Process
2812	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
2876	winmap.exe

Loads dropped DLL 1 IoCs

pid	Process
2892	cmd.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winmap = "\"C:\\Users\\Admin\\AppData\\Roaming\\winmap\\winmap.exe\""	winmap.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\winmap = "\"C:\\Users\\Admin\\AppData\\Roaming\\winmap\\winmap.exe\""	027f61e8861f743bf8e8cb0ca2ea5de056790cffed76d375e5e84f6575bc7ff6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winmap = "\"C:\\Users\\Admin\\AppData\\Roaming\\winmap\\winmap.exe\""	027f61e8861f743bf8e8cb0ca2ea5de056790cffed76d375e5e84f6575bc7ff6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\winmap = "\"C:\\Users\\Admin\\AppData\\Roaming\\winmap\\winmap.exe\""	winmap.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	027f61e8861f743bf8e8cb0ca2ea5de056790cffed76d375e5e84f6575bc7ff6.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winmap.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2304	027f61e8861f743bf8e8cb0ca2ea5de056790cffed76d375e5e84f6575bc7ff6.exe
2876	winmap.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	027f61e8861f743bf8e8cb0ca2ea5de056790cffed76d375e5e84f6575bc7ff6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmap.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2304	027f61e8861f743bf8e8cb0ca2ea5de056790cffed76d375e5e84f6575bc7ff6.exe
2876	winmap.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2812	2304	027f61e8861f743bf8e8cb0ca2ea5de056790cffed76d375e5e84f6575bc7ff6.exe	31
PID 2304 wrote to memory of 2812	2304	027f61e8861f743bf8e8cb0ca2ea5de056790cffed76d375e5e84f6575bc7ff6.exe	31
PID 2304 wrote to memory of 2812	2304	027f61e8861f743bf8e8cb0ca2ea5de056790cffed76d375e5e84f6575bc7ff6.exe	31
PID 2304 wrote to memory of 2812	2304	027f61e8861f743bf8e8cb0ca2ea5de056790cffed76d375e5e84f6575bc7ff6.exe	31
PID 2812 wrote to memory of 2892	2812	WScript.exe	32
PID 2812 wrote to memory of 2892	2812	WScript.exe	32
PID 2812 wrote to memory of 2892	2812	WScript.exe	32
PID 2812 wrote to memory of 2892	2812	WScript.exe	32
PID 2892 wrote to memory of 2876	2892	cmd.exe	34
PID 2892 wrote to memory of 2876	2892	cmd.exe	34
PID 2892 wrote to memory of 2876	2892	cmd.exe	34
PID 2892 wrote to memory of 2876	2892	cmd.exe	34
PID 2876 wrote to memory of 2928	2876	winmap.exe	35
PID 2876 wrote to memory of 2928	2876	winmap.exe	35
PID 2876 wrote to memory of 2928	2876	winmap.exe	35
PID 2876 wrote to memory of 2928	2876	winmap.exe	35

C:\Users\Admin\AppData\Local\Temp\027f61e8861f743bf8e8cb0ca2ea5de056790cffed76d375e5e84f6575bc7ff6.exe
"C:\Users\Admin\AppData\Local\Temp\027f61e8861f743bf8e8cb0ca2ea5de056790cffed76d375e5e84f6575bc7ff6.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Adds policy Run key to start application
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\winmap\winmap.exe"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Users\Admin\AppData\Roaming\winmap\winmap.exe
      C:\Users\Admin\AppData\Roaming\winmap\winmap.exe
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Adds policy Run key to start application
      Checks BIOS information in registry
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2876
    - - C:\Windows\SysWOW64\svchost.exe
        
        C:\Windows\SysWOW64\svchost.exe
        5⤵
        
        PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
658B

MD5
1b3af20b94b3c152be7897ff8431a475

SHA1
46271e64b3cf746d1aaad19764a601ece6e4611d

SHA256
51b422333940919ea7deff34dda0cdd0e0027b0d030c4c306dcc2d8d5e5e7466

SHA512
4b774cec31bcf7546605180b1b9acecd278d5f6739da512e90ce823e9ebeb97c9d2ea8d0902ca17b24ce426f033f7a73d7b9f9e38ccc75846b2986adf13106bc

Download Submit
C:\Users\Admin\AppData\Roaming\winmap\winmap.exe

Filesize
2.8MB

MD5
45f06e05ee29b52bbaad37c5cdeadc18

SHA1
4a146193a9705565694f4d9a0894d49672c8e74c

SHA256
027f61e8861f743bf8e8cb0ca2ea5de056790cffed76d375e5e84f6575bc7ff6

SHA512
fe7fc8522f36942e7a6a4e3b8897a41e6de58432353325f7eb7ec0767ed7d1bd1624f3cd176c2b07a62ff87c0f20fe623b95fcda330344d6ea56b372863e6d8a

Download Submit
memory/2304-1-0x0000000000B0A000-0x0000000000B0B000-memory.dmp

Filesize
4KB

Download
memory/2304-0-0x0000000000400000-0x0000000000B3C000-memory.dmp

Filesize
7.2MB

Download
memory/2304-2-0x0000000000400000-0x0000000000B3C000-memory.dmp

Filesize
7.2MB

Download
memory/2304-4-0x0000000000400000-0x0000000000B3C000-memory.dmp

Filesize
7.2MB

Download
memory/2304-5-0x0000000000400000-0x0000000000B3C000-memory.dmp

Filesize
7.2MB

Download
memory/2304-3-0x0000000000400000-0x0000000000B3C000-memory.dmp

Filesize
7.2MB

Download
memory/2304-9-0x0000000000400000-0x0000000000B3C000-memory.dmp

Filesize
7.2MB

Download
memory/2304-13-0x0000000000400000-0x0000000000B3C000-memory.dmp

Filesize
7.2MB

Download
memory/2876-21-0x0000000000400000-0x0000000000B3C000-memory.dmp

Filesize
7.2MB

Download
memory/2876-29-0x0000000000400000-0x0000000000B3C000-memory.dmp

Filesize
7.2MB

Download
memory/2876-20-0x0000000000400000-0x0000000000B3C000-memory.dmp

Filesize
7.2MB

Download
memory/2876-22-0x0000000000400000-0x0000000000B3C000-memory.dmp

Filesize
7.2MB

Download
memory/2876-38-0x0000000000400000-0x0000000000B3C000-memory.dmp

Filesize
7.2MB

Download
memory/2876-37-0x0000000000400000-0x0000000000B3C000-memory.dmp

Filesize
7.2MB

Download
memory/2876-25-0x0000000000400000-0x0000000000B3C000-memory.dmp

Filesize
7.2MB

Download
memory/2876-24-0x0000000000400000-0x0000000000B3C000-memory.dmp

Filesize
7.2MB

Download
memory/2876-26-0x0000000000400000-0x0000000000B3C000-memory.dmp

Filesize
7.2MB

Download
memory/2876-27-0x0000000000400000-0x0000000000B3C000-memory.dmp

Filesize
7.2MB

Download
memory/2876-28-0x0000000000400000-0x0000000000B3C000-memory.dmp

Filesize
7.2MB

Download
memory/2876-19-0x0000000000400000-0x0000000000B3C000-memory.dmp

Filesize
7.2MB

Download
memory/2876-30-0x0000000000400000-0x0000000000B3C000-memory.dmp

Filesize
7.2MB

Download
memory/2876-31-0x0000000000400000-0x0000000000B3C000-memory.dmp

Filesize
7.2MB

Download
memory/2876-32-0x0000000000400000-0x0000000000B3C000-memory.dmp

Filesize
7.2MB

Download
memory/2876-33-0x0000000000400000-0x0000000000B3C000-memory.dmp

Filesize
7.2MB

Download
memory/2876-34-0x0000000000400000-0x0000000000B3C000-memory.dmp

Filesize
7.2MB

Download
memory/2876-35-0x0000000000400000-0x0000000000B3C000-memory.dmp

Filesize
7.2MB

Download
memory/2876-36-0x0000000000400000-0x0000000000B3C000-memory.dmp

Filesize
7.2MB

Download
memory/2892-23-0x0000000002070000-0x00000000027AC000-memory.dmp

Filesize
7.2MB

Download
memory/2892-18-0x0000000002070000-0x00000000027AC000-memory.dmp

Filesize
7.2MB

Download