remcos | dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c

Analysis

max time kernel
143s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-11-2024 13:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
Size

2.3MB
MD5

8c7721a07d8a75318cd69d3e99e6f26f
SHA1

e689e4b95e1adab3dc8b3aa86679de192f380577
SHA256

dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c
SHA512

8b693458e5032302de273e4181de78d1228f0753913ac54f078176c8419cfd45a21e2de8ffaea958f977eb8637142b331807f75557999733f98cfdbfc29f66f6
SSDEEP

49152:g/K22SdQ1bMbFg1Um7t/cxKlW667eR0HO8jgwCsyKlr2mgxvJ:g/K22Sd4nJ7t/tlNPjKlqhh

Score

10^/10

remcos nov money discovery persistence rat

Malware Config

Extracted

Family

remcos

Botnet

Nov Money

ramcourse.duckdns.org:65249

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-DZXWWG
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

reg.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Local\\csrssx.exe,"	reg.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Executes dropped EXE 1 IoCs

Processes:

csrssx.exe

pid	Process
2600	csrssx.exe

Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid	Process
2552	cmd.exe
2552	cmd.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exePING.EXEcmd.exePING.EXEreg.exePING.EXEcsrssx.exedcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrssx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

PING.EXEPING.EXEcmd.exePING.EXEcmd.exe

pid	Process
2620	PING.EXE
2424	PING.EXE
2884	cmd.exe
2744	PING.EXE
2552	cmd.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

Processes:

PING.EXEPING.EXEPING.EXE

pid	Process
2620	PING.EXE
2424	PING.EXE
2744	PING.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.execsrssx.exe

pid	Process
3024	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3024	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3024	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3024	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3024	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
3024	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
2600	csrssx.exe
2600	csrssx.exe
2600	csrssx.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.execsrssx.exe

description	pid	Process
Token: SeDebugPrivilege	3024	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
Token: SeDebugPrivilege	2600	csrssx.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.execmd.execmd.execsrssx.exe

description	pid	Process	procid_target
PID 3024 wrote to memory of 2884	3024	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe	31
PID 3024 wrote to memory of 2884	3024	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe	31
PID 3024 wrote to memory of 2884	3024	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe	31
PID 3024 wrote to memory of 2884	3024	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe	31
PID 2884 wrote to memory of 2744	2884	cmd.exe	33
PID 2884 wrote to memory of 2744	2884	cmd.exe	33
PID 2884 wrote to memory of 2744	2884	cmd.exe	33
PID 2884 wrote to memory of 2744	2884	cmd.exe	33
PID 3024 wrote to memory of 2552	3024	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe	34
PID 3024 wrote to memory of 2552	3024	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe	34
PID 3024 wrote to memory of 2552	3024	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe	34
PID 3024 wrote to memory of 2552	3024	dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe	34
PID 2552 wrote to memory of 2620	2552	cmd.exe	36
PID 2552 wrote to memory of 2620	2552	cmd.exe	36
PID 2552 wrote to memory of 2620	2552	cmd.exe	36
PID 2552 wrote to memory of 2620	2552	cmd.exe	36
PID 2884 wrote to memory of 2044	2884	cmd.exe	37
PID 2884 wrote to memory of 2044	2884	cmd.exe	37
PID 2884 wrote to memory of 2044	2884	cmd.exe	37
PID 2884 wrote to memory of 2044	2884	cmd.exe	37
PID 2552 wrote to memory of 2424	2552	cmd.exe	38
PID 2552 wrote to memory of 2424	2552	cmd.exe	38
PID 2552 wrote to memory of 2424	2552	cmd.exe	38
PID 2552 wrote to memory of 2424	2552	cmd.exe	38
PID 2552 wrote to memory of 2600	2552	cmd.exe	39
PID 2552 wrote to memory of 2600	2552	cmd.exe	39
PID 2552 wrote to memory of 2600	2552	cmd.exe	39
PID 2552 wrote to memory of 2600	2552	cmd.exe	39
PID 2600 wrote to memory of 2776	2600	csrssx.exe	40
PID 2600 wrote to memory of 2776	2600	csrssx.exe	40
PID 2600 wrote to memory of 2776	2600	csrssx.exe	40
PID 2600 wrote to memory of 2776	2600	csrssx.exe	40
PID 2600 wrote to memory of 2776	2600	csrssx.exe	40
PID 2600 wrote to memory of 2776	2600	csrssx.exe	40
PID 2600 wrote to memory of 2776	2600	csrssx.exe	40
PID 2600 wrote to memory of 2776	2600	csrssx.exe	40
PID 2600 wrote to memory of 2776	2600	csrssx.exe	40
PID 2600 wrote to memory of 2776	2600	csrssx.exe	40
PID 2600 wrote to memory of 2776	2600	csrssx.exe	40

C:\Users\Admin\AppData\Local\Temp\dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe
"C:\Users\Admin\AppData\Local\Temp\dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 35 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\csrssx.exe,"
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 35
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2744
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\csrssx.exe,"
    3⤵
    - Modifies WinLogon for persistence
    - System Location Discovery: System Language Discovery
    PID:2044
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 37 > nul && copy "C:\Users\Admin\AppData\Local\Temp\dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c.exe" "C:\Users\Admin\AppData\Local\csrssx.exe" && ping 127.0.0.1 -n 37 > nul && "C:\Users\Admin\AppData\Local\csrssx.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 37
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2620
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 37
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2424
- - C:\Users\Admin\AppData\Local\csrssx.exe
    "C:\Users\Admin\AppData\Local\csrssx.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      4⤵
      PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\csrssx.exe

Filesize
2.3MB

MD5
8c7721a07d8a75318cd69d3e99e6f26f

SHA1
e689e4b95e1adab3dc8b3aa86679de192f380577

SHA256
dcbcfe00290d92cfea7ff37d322cf80991016d6379888cdaf27451c6543a894c

SHA512
8b693458e5032302de273e4181de78d1228f0753913ac54f078176c8419cfd45a21e2de8ffaea958f977eb8637142b331807f75557999733f98cfdbfc29f66f6

Download Submit
memory/2600-19-0x0000000000760000-0x0000000000766000-memory.dmp

Filesize
24KB

Download
memory/2600-18-0x0000000000640000-0x000000000065A000-memory.dmp

Filesize
104KB

Download
memory/2600-17-0x00000000002D0000-0x0000000000528000-memory.dmp

Filesize
2.3MB

Download
memory/2776-27-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2776-32-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2776-22-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2776-24-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2776-28-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2776-30-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2776-21-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3024-1-0x0000000001250000-0x00000000014A8000-memory.dmp

Filesize
2.3MB

Download
memory/3024-0-0x000000007469E000-0x000000007469F000-memory.dmp

Filesize
4KB

Download
memory/3024-2-0x0000000000BD0000-0x0000000000C14000-memory.dmp

Filesize
272KB

Download
memory/3024-5-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/3024-3-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/3024-4-0x000000007469E000-0x000000007469F000-memory.dmp

Filesize
4KB

Download
memory/3024-6-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download