remcos | 8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-11-2024 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe
Size

990KB
MD5

5d6b0f7f6ee6287341412584a2a1d8c5
SHA1

4e6a40536ea394ce35259a8b8c617880b42d2895
SHA256

8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671
SHA512

b02b688314748c4666230d86fa4415a3a1e2310ce0302e9f0bc46b8bed4377eb30ff2262a26d5280f20e562ee1f875f47dcf89d71db77fe7c16b69b1abd4bb70
SSDEEP

24576:C4P2198h0XGjH4GXDe84WKb2ry2C+5+CJV6:rP2L8hkGjYG/4WOr2C8B

Score

10^/10

remcos novermber discovery execution rat

Malware Config

Extracted

Family

remcos

Botnet

Novermber

www.vipvipvipdnsdomain.store:1989

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
soft
mouse_option
false
mutex
Rmc-FEU0WU
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

736 powershell.exe
380 powershell.exe

pid	process
736	powershell.exe
380	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of SetThreadContext 1 IoCs

Processes:

8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe

description	pid	process	target process
PID 1896 set thread context of 4972	1896	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exepowershell.exepowershell.exeschtasks.exevbc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

4060 schtasks.exe

pid	process
4060	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exepowershell.exepowershell.exe

pid	process
1896	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe
736	powershell.exe
380	powershell.exe
1896	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe
736	powershell.exe
380	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1896	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe
Token: SeDebugPrivilege	380	powershell.exe
Token: SeDebugPrivilege	736	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

4972 vbc.exe

pid	process
4972	vbc.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe

description	pid	process	target process
PID 1896 wrote to memory of 736	1896	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe	powershell.exe
PID 1896 wrote to memory of 736	1896	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe	powershell.exe
PID 1896 wrote to memory of 736	1896	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe	powershell.exe
PID 1896 wrote to memory of 380	1896	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe	powershell.exe
PID 1896 wrote to memory of 380	1896	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe	powershell.exe
PID 1896 wrote to memory of 380	1896	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe	powershell.exe
PID 1896 wrote to memory of 4060	1896	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe	schtasks.exe
PID 1896 wrote to memory of 4060	1896	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe	schtasks.exe
PID 1896 wrote to memory of 4060	1896	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe	schtasks.exe
PID 1896 wrote to memory of 4972	1896	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe	vbc.exe
PID 1896 wrote to memory of 4972	1896	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe	vbc.exe
PID 1896 wrote to memory of 4972	1896	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe	vbc.exe
PID 1896 wrote to memory of 4972	1896	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe	vbc.exe
PID 1896 wrote to memory of 4972	1896	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe	vbc.exe
PID 1896 wrote to memory of 4972	1896	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe	vbc.exe
PID 1896 wrote to memory of 4972	1896	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe	vbc.exe
PID 1896 wrote to memory of 4972	1896	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe	vbc.exe
PID 1896 wrote to memory of 4972	1896	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe	vbc.exe
PID 1896 wrote to memory of 4972	1896	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe	vbc.exe
PID 1896 wrote to memory of 4972	1896	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe	vbc.exe
PID 1896 wrote to memory of 4972	1896	8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe
"C:\Users\Admin\AppData\Local\Temp\8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8cf5c38431b0d40340a5fff19a773b73674fcb921970292472dedbbc51683671.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:736
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\WRYDezrYlYY.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:380
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WRYDezrYlYY" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCFF2.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4060
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\soft\logs.dat

Filesize
144B

MD5
91988d3a624fd1e9577599fc28fe12ce

SHA1
3766fa44ed65fdc61cc9be92d3a332d479f30790

SHA256
071a4f8ccb2bfe8ac8abf19b591c33e0c66b2c669b779d90fd08f342635cd5f4

SHA512
fa45bb1859ef25a7c51544eeee1c187f1e4e30873f97dd46580482047fabea1033b0926006ad1d3e1653157429d10b104acd0a4ca4d9241da7e0e77d0e287730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
952e78036c92629ebb87cd8721b4bea1

SHA1
131c90bb3e43df341c68fbb329dda4af34cf356e

SHA256
1208be313554e4aa16a0799f9b725a56381fa9ee5b335acf7cebcc769a1f7928

SHA512
c87be17b8ab7711e01e3db5e5b1103f114d591feb63d398114e714c0f597ae12b1311e5510c520fe46840aeda889561ff2de7a96a5548abe23a04a6c90d06fca

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xstewcjx.nis.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCFF2.tmp

Filesize
1KB

MD5
53aea92022dda560d2b66212c2590e91

SHA1
de3225461a8ecd0656588f7e6d3f790bea6e36eb

SHA256
234f2d379e130f7cca4351f7377d8f7e725c1de40129b0194a167959321ff323

SHA512
bc7247ff4d9e7fa9fbfb0b35f9cd0a338fe8db6a87a3b20b17f62310b035d426aded1646dff802d6a68f876160be5e10122feb3d59ded9b6f41f0b9fb5611b07

Download Submit
memory/380-20-0x00000000053D0000-0x0000000005436000-memory.dmp

Filesize
408KB

Download
memory/380-89-0x00000000078B0000-0x00000000078C1000-memory.dmp

Filesize
68KB

Download
memory/380-80-0x00000000068D0000-0x00000000068EE000-memory.dmp

Filesize
120KB

Download
memory/380-60-0x0000000007370000-0x00000000073A2000-memory.dmp

Filesize
200KB

Download
memory/380-61-0x0000000073AF0000-0x0000000073B3C000-memory.dmp

Filesize
304KB

Download
memory/380-100-0x0000000075020000-0x00000000757D0000-memory.dmp

Filesize
7.7MB

Download
memory/380-45-0x0000000075020000-0x00000000757D0000-memory.dmp

Filesize
7.7MB

Download
memory/380-22-0x0000000075020000-0x00000000757D0000-memory.dmp

Filesize
7.7MB

Download
memory/380-24-0x0000000075020000-0x00000000757D0000-memory.dmp

Filesize
7.7MB

Download
memory/380-21-0x00000000054F0000-0x0000000005556000-memory.dmp

Filesize
408KB

Download
memory/380-19-0x00000000052B0000-0x00000000052D2000-memory.dmp

Filesize
136KB

Download
memory/380-93-0x00000000079D0000-0x00000000079D8000-memory.dmp

Filesize
32KB

Download
memory/736-91-0x0000000007050000-0x0000000007064000-memory.dmp

Filesize
80KB

Download
memory/736-71-0x0000000073AF0000-0x0000000073B3C000-memory.dmp

Filesize
304KB

Download
memory/736-16-0x0000000075020000-0x00000000757D0000-memory.dmp

Filesize
7.7MB

Download
memory/736-17-0x0000000004BC0000-0x00000000051E8000-memory.dmp

Filesize
6.2MB

Download
memory/736-41-0x0000000075020000-0x00000000757D0000-memory.dmp

Filesize
7.7MB

Download
memory/736-30-0x0000000005510000-0x0000000005864000-memory.dmp

Filesize
3.3MB

Download
memory/736-15-0x0000000004520000-0x0000000004556000-memory.dmp

Filesize
216KB

Download
memory/736-99-0x0000000075020000-0x00000000757D0000-memory.dmp

Filesize
7.7MB

Download
memory/736-92-0x0000000007150000-0x000000000716A000-memory.dmp

Filesize
104KB

Download
memory/736-90-0x0000000007040000-0x000000000704E000-memory.dmp

Filesize
56KB

Download
memory/736-88-0x0000000007090000-0x0000000007126000-memory.dmp

Filesize
600KB

Download
memory/736-87-0x0000000006E80000-0x0000000006E8A000-memory.dmp

Filesize
40KB

Download
memory/736-18-0x0000000075020000-0x00000000757D0000-memory.dmp

Filesize
7.7MB

Download
memory/736-54-0x0000000005AF0000-0x0000000005B0E000-memory.dmp

Filesize
120KB

Download
memory/736-56-0x0000000005FF0000-0x000000000603C000-memory.dmp

Filesize
304KB

Download
memory/736-86-0x0000000006E10000-0x0000000006E2A000-memory.dmp

Filesize
104KB

Download
memory/736-85-0x0000000007460000-0x0000000007ADA000-memory.dmp

Filesize
6.5MB

Download
memory/736-84-0x0000000006AC0000-0x0000000006B63000-memory.dmp

Filesize
652KB

Download
memory/1896-53-0x0000000075020000-0x00000000757D0000-memory.dmp

Filesize
7.7MB

Download
memory/1896-1-0x0000000000D60000-0x0000000000E5E000-memory.dmp

Filesize
1016KB

Download
memory/1896-8-0x000000007502E000-0x000000007502F000-memory.dmp

Filesize
4KB

Download
memory/1896-9-0x0000000075020000-0x00000000757D0000-memory.dmp

Filesize
7.7MB

Download
memory/1896-7-0x0000000006B50000-0x0000000006B62000-memory.dmp

Filesize
72KB

Download
memory/1896-10-0x0000000006B90000-0x0000000006C54000-memory.dmp

Filesize
784KB

Download
memory/1896-2-0x0000000005EA0000-0x0000000006444000-memory.dmp

Filesize
5.6MB

Download
memory/1896-3-0x0000000005830000-0x00000000058C2000-memory.dmp

Filesize
584KB

Download
memory/1896-4-0x0000000005990000-0x0000000005A2C000-memory.dmp

Filesize
624KB

Download
memory/1896-5-0x0000000075020000-0x00000000757D0000-memory.dmp

Filesize
7.7MB

Download
memory/1896-0-0x000000007502E000-0x000000007502F000-memory.dmp

Filesize
4KB

Download
memory/1896-6-0x0000000005910000-0x000000000591A000-memory.dmp

Filesize
40KB

Download
memory/4972-102-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4972-55-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4972-47-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4972-52-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4972-103-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4972-57-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4972-82-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4972-59-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4972-46-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4972-49-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4972-58-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4972-111-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4972-110-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4972-118-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4972-119-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4972-127-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4972-126-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download