remcos | 2ed5e08904545beef35a09a2be25b45215218b8a4e7d5f9711125f92d8b86a6f

General

Target

Purchase Inquiry_002.exe
Size

893KB
MD5

c016b06a4942455df9ce8a58b72bcc90
SHA1

dba52afe33451c444fd5cf3c6aca9d2ced768d2c
SHA256

e115d3bd2903d9d663a7a69edd08b0ba5f2528c831d17530bbf621648b44894c
SHA512

961475a98cfdc14a29725b43c1807a3eda08a2257f50d216375faf262880ce39cf7847d00263d00fd1ce032ad14fbb003b3ab1e78bbd25b3a644f3d6746168fe
SSDEEP

24576:WNo7gN9rqhq/5UqutCi1BDUTskujqA5pd6p3MFHdIvYV:QL2hq/6q1i1h4v3A5pdSOWvY

Score

10^/10

remcos cee discovery execution rat

Malware Config

Extracted

Family

remcos

Botnet

cee

C2

cee.work.gd:2531

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
vlc
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
ios
mouse_option
false
mutex
gig-1IH5DX
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
sos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2168 powershell.exe
2940 powershell.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Purchase Inquiry_002.exe

description pid process target process

PID 1504 set thread context of 1676 1504 Purchase Inquiry_002.exe Purchase Inquiry_002.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2168	powershell.exe
2940	powershell.exe

description	pid	process	target process
PID 1504 set thread context of 1676	1504	Purchase Inquiry_002.exe	Purchase Inquiry_002.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Purchase Inquiry_002.exepowershell.exepowershell.exeschtasks.exePurchase Inquiry_002.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Purchase Inquiry_002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Purchase Inquiry_002.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

1668 schtasks.exe

pid	process
1668	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

Purchase Inquiry_002.exepowershell.exepowershell.exe

pid	process
1504	Purchase Inquiry_002.exe
1504	Purchase Inquiry_002.exe
1504	Purchase Inquiry_002.exe
1504	Purchase Inquiry_002.exe
1504	Purchase Inquiry_002.exe
1504	Purchase Inquiry_002.exe
1504	Purchase Inquiry_002.exe
1504	Purchase Inquiry_002.exe
1504	Purchase Inquiry_002.exe
2168	powershell.exe
2940	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Purchase Inquiry_002.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1504	Purchase Inquiry_002.exe
Token: SeDebugPrivilege	2168	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Purchase Inquiry_002.exe

pid process

1676 Purchase Inquiry_002.exe

pid	process
1676	Purchase Inquiry_002.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

Purchase Inquiry_002.exe

description	pid	process	target process
PID 1504 wrote to memory of 2168	1504	Purchase Inquiry_002.exe	powershell.exe
PID 1504 wrote to memory of 2168	1504	Purchase Inquiry_002.exe	powershell.exe
PID 1504 wrote to memory of 2168	1504	Purchase Inquiry_002.exe	powershell.exe
PID 1504 wrote to memory of 2168	1504	Purchase Inquiry_002.exe	powershell.exe
PID 1504 wrote to memory of 2940	1504	Purchase Inquiry_002.exe	powershell.exe
PID 1504 wrote to memory of 2940	1504	Purchase Inquiry_002.exe	powershell.exe
PID 1504 wrote to memory of 2940	1504	Purchase Inquiry_002.exe	powershell.exe
PID 1504 wrote to memory of 2940	1504	Purchase Inquiry_002.exe	powershell.exe
PID 1504 wrote to memory of 1668	1504	Purchase Inquiry_002.exe	schtasks.exe
PID 1504 wrote to memory of 1668	1504	Purchase Inquiry_002.exe	schtasks.exe
PID 1504 wrote to memory of 1668	1504	Purchase Inquiry_002.exe	schtasks.exe
PID 1504 wrote to memory of 1668	1504	Purchase Inquiry_002.exe	schtasks.exe
PID 1504 wrote to memory of 2372	1504	Purchase Inquiry_002.exe	Purchase Inquiry_002.exe
PID 1504 wrote to memory of 2372	1504	Purchase Inquiry_002.exe	Purchase Inquiry_002.exe
PID 1504 wrote to memory of 2372	1504	Purchase Inquiry_002.exe	Purchase Inquiry_002.exe
PID 1504 wrote to memory of 2372	1504	Purchase Inquiry_002.exe	Purchase Inquiry_002.exe
PID 1504 wrote to memory of 1676	1504	Purchase Inquiry_002.exe	Purchase Inquiry_002.exe
PID 1504 wrote to memory of 1676	1504	Purchase Inquiry_002.exe	Purchase Inquiry_002.exe
PID 1504 wrote to memory of 1676	1504	Purchase Inquiry_002.exe	Purchase Inquiry_002.exe
PID 1504 wrote to memory of 1676	1504	Purchase Inquiry_002.exe	Purchase Inquiry_002.exe
PID 1504 wrote to memory of 1676	1504	Purchase Inquiry_002.exe	Purchase Inquiry_002.exe
PID 1504 wrote to memory of 1676	1504	Purchase Inquiry_002.exe	Purchase Inquiry_002.exe
PID 1504 wrote to memory of 1676	1504	Purchase Inquiry_002.exe	Purchase Inquiry_002.exe
PID 1504 wrote to memory of 1676	1504	Purchase Inquiry_002.exe	Purchase Inquiry_002.exe
PID 1504 wrote to memory of 1676	1504	Purchase Inquiry_002.exe	Purchase Inquiry_002.exe
PID 1504 wrote to memory of 1676	1504	Purchase Inquiry_002.exe	Purchase Inquiry_002.exe
PID 1504 wrote to memory of 1676	1504	Purchase Inquiry_002.exe	Purchase Inquiry_002.exe
PID 1504 wrote to memory of 1676	1504	Purchase Inquiry_002.exe	Purchase Inquiry_002.exe
PID 1504 wrote to memory of 1676	1504	Purchase Inquiry_002.exe	Purchase Inquiry_002.exe

C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_002.exe
"C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_002.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_002.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xASiLfzXONGIW.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2940
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xASiLfzXONGIW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8E4B.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1668
- C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_002.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_002.exe"
  2⤵
  PID:2372
- C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_002.exe
  "C:\Users\Admin\AppData\Local\Temp\Purchase Inquiry_002.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ios\logs.dat

Filesize
144B

MD5
225b6f925e8d3b0c2f33f0d74c2605a8

SHA1
b47d8f92562292c853e86f5252a6de74e6076376

SHA256
d4d7097a983ef4b4e946d8537487716e0e28bc4d5385a57fec3d24d9aeb646be

SHA512
6dfaf6986ee39e45d9a96e83e2dd4321fcdca51bdc487cae94637cd3d5f0cfe8888a61ead99951faf84af28ffb0d3b71ad5c8a7e8b4ee31f12dea06edae4bcdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8E4B.tmp

Filesize
1KB

MD5
55b1952cf7a2a60dc4962bcfaac8433d

SHA1
74c136f6fe7d5c8ec0f573c550d9e86f448fc72a

SHA256
6e2b273265fa8b7176dc03e475296feb796ac5a39a5b61944231ed12d97f9148

SHA512
7e3525d3d1538972fcdba07a60e233a78bf9d54dff75ae8cc1c0670a6ad6f4705f2213e85e7b255c94f8270521d483d0b9a9522c19b95a7bbfdfeeda77c7a5dc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
bec23942e713ae3d8d1569f646bbd218

SHA1
3ef62b68b94b639fce538687071a6d91d9a42848

SHA256
ca35bce2eb9be4e60f4be4c04f194aedb328f52b13685049b98ca27531688fbc

SHA512
c1870f30160d22dac65b1ca3216eb61b46f3994c0e1f760af5dbf6c899dda799441485fecec650b228112333c9d00d53f9c195ad298c4b9a9e9e020b1d1e3d4d

Download Submit
memory/1504-0-0x000000007494E000-0x000000007494F000-memory.dmp

Filesize
4KB

Download
memory/1504-1-0x0000000001000000-0x00000000010E6000-memory.dmp

Filesize
920KB

Download
memory/1504-2-0x0000000074940000-0x000000007502E000-memory.dmp

Filesize
6.9MB

Download
memory/1504-3-0x000000007494E000-0x000000007494F000-memory.dmp

Filesize
4KB

Download
memory/1504-4-0x0000000000290000-0x00000000002A2000-memory.dmp

Filesize
72KB

Download
memory/1504-5-0x0000000074940000-0x000000007502E000-memory.dmp

Filesize
6.9MB

Download
memory/1504-6-0x00000000048D0000-0x0000000004990000-memory.dmp

Filesize
768KB

Download
memory/1504-42-0x0000000074940000-0x000000007502E000-memory.dmp

Filesize
6.9MB

Download
memory/1676-41-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1676-23-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1676-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1676-33-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1676-38-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1676-32-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1676-37-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1676-29-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1676-27-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1676-25-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1676-21-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1676-36-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1676-43-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1676-44-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1676-45-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1676-46-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1676-48-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1676-20-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1676-55-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1676-56-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1676-63-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1676-64-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1676-72-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1676-71-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads