remcos | f57e0e55aa4691d0502f6da67d4ecb2823c98bd319c5208ae44a518a0a17392b

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
25-11-2024 12:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe
Size

908KB
MD5

0a91b0a960e1cb925434f0ded97e30b7
SHA1

ea0ed432c0cdb5f86cde1b17850a77b68ad71af4
SHA256

f57e0e55aa4691d0502f6da67d4ecb2823c98bd319c5208ae44a518a0a17392b
SHA512

37d4fbd29f3a5b274545f4864f9005b814410e35abc94c106e433ecd5c403a230eb2ca38d1d20aaa1f29ad0fbef5997c0c0cae37c2237b165e2eb5778dd2f7e4
SSDEEP

24576:Mo7x/alQteiW/C+sHTTPrCehcxQv4Zj6CSy:Mc/zhWK+vC4ZIy

Score

10^/10

remcos remotehost discovery execution persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

206.189.218.238:4782

206.189.218.238:2286

206.189.218.238:3363

206.189.218.238:3386

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-NJK093
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
1
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exe

pid	Process
3040	powershell.exe
2708	powershell.exe

Executes dropped EXE 3 IoCs

Processes:

remcos.exeremcos.exeremcos.exe

pid	Process
2352	remcos.exe
2412	remcos.exe
1148	remcos.exe

Loads dropped DLL 1 IoCs

Processes:

Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe

pid	Process
1212	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exeremcos.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-NJK093 = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-NJK093 = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-NJK093 = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-NJK093 = "\"C:\\ProgramData\\Remcos\\remcos.exe\""	remcos.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exeremcos.exe

description	pid	Process	procid_target
PID 2888 set thread context of 1212	2888	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe	34
PID 2352 set thread context of 1148	2352	remcos.exe	42

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

powershell.exeschtasks.exeremcos.exeQuotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exepowershell.exeschtasks.exeQuotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exeremcos.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	remcos.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exe

pid	Process
1276	schtasks.exe
520	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exeremcos.exepowershell.exe

pid	Process
2708	powershell.exe
2352	remcos.exe
2352	remcos.exe
3040	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exeremcos.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	2352	remcos.exe
Token: SeDebugPrivilege	3040	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

remcos.exe

pid	Process
1148	remcos.exe

Suspicious use of WriteProcessMemory 50 IoCs

Processes:

Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exeQuotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exeremcos.exe

description	pid	Process	procid_target
PID 2888 wrote to memory of 2708	2888	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe	30
PID 2888 wrote to memory of 2708	2888	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe	30
PID 2888 wrote to memory of 2708	2888	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe	30
PID 2888 wrote to memory of 2708	2888	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe	30
PID 2888 wrote to memory of 1276	2888	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe	32
PID 2888 wrote to memory of 1276	2888	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe	32
PID 2888 wrote to memory of 1276	2888	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe	32
PID 2888 wrote to memory of 1276	2888	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe	32
PID 2888 wrote to memory of 1212	2888	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe	34
PID 2888 wrote to memory of 1212	2888	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe	34
PID 2888 wrote to memory of 1212	2888	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe	34
PID 2888 wrote to memory of 1212	2888	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe	34
PID 2888 wrote to memory of 1212	2888	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe	34
PID 2888 wrote to memory of 1212	2888	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe	34
PID 2888 wrote to memory of 1212	2888	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe	34
PID 2888 wrote to memory of 1212	2888	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe	34
PID 2888 wrote to memory of 1212	2888	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe	34
PID 2888 wrote to memory of 1212	2888	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe	34
PID 2888 wrote to memory of 1212	2888	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe	34
PID 2888 wrote to memory of 1212	2888	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe	34
PID 2888 wrote to memory of 1212	2888	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe	34
PID 1212 wrote to memory of 2352	1212	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe	35
PID 1212 wrote to memory of 2352	1212	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe	35
PID 1212 wrote to memory of 2352	1212	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe	35
PID 1212 wrote to memory of 2352	1212	Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe	35
PID 2352 wrote to memory of 3040	2352	remcos.exe	37
PID 2352 wrote to memory of 3040	2352	remcos.exe	37
PID 2352 wrote to memory of 3040	2352	remcos.exe	37
PID 2352 wrote to memory of 3040	2352	remcos.exe	37
PID 2352 wrote to memory of 520	2352	remcos.exe	39
PID 2352 wrote to memory of 520	2352	remcos.exe	39
PID 2352 wrote to memory of 520	2352	remcos.exe	39
PID 2352 wrote to memory of 520	2352	remcos.exe	39
PID 2352 wrote to memory of 2412	2352	remcos.exe	41
PID 2352 wrote to memory of 2412	2352	remcos.exe	41
PID 2352 wrote to memory of 2412	2352	remcos.exe	41
PID 2352 wrote to memory of 2412	2352	remcos.exe	41
PID 2352 wrote to memory of 1148	2352	remcos.exe	42
PID 2352 wrote to memory of 1148	2352	remcos.exe	42
PID 2352 wrote to memory of 1148	2352	remcos.exe	42
PID 2352 wrote to memory of 1148	2352	remcos.exe	42
PID 2352 wrote to memory of 1148	2352	remcos.exe	42
PID 2352 wrote to memory of 1148	2352	remcos.exe	42
PID 2352 wrote to memory of 1148	2352	remcos.exe	42
PID 2352 wrote to memory of 1148	2352	remcos.exe	42
PID 2352 wrote to memory of 1148	2352	remcos.exe	42
PID 2352 wrote to memory of 1148	2352	remcos.exe	42
PID 2352 wrote to memory of 1148	2352	remcos.exe	42
PID 2352 wrote to memory of 1148	2352	remcos.exe	42
PID 2352 wrote to memory of 1148	2352	remcos.exe	42

C:\Users\Admin\AppData\Local\Temp\Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wGvcmEX.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wGvcmEX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEE07.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:1276
- C:\Users\Admin\AppData\Local\Temp\Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe
  "C:\Users\Admin\AppData\Local\Temp\Quotation Ref No. CODE PCBMCPUG02-ORDER 11524-FOUND.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\ProgramData\Remcos\remcos.exe
    "C:\ProgramData\Remcos\remcos.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2352
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wGvcmEX.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3040
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wGvcmEX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7CAF.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:520
  - - C:\ProgramData\Remcos\remcos.exe
      "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Executes dropped EXE
      PID:2412
  - - C:\ProgramData\Remcos\remcos.exe
      "C:\ProgramData\Remcos\remcos.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Remcos\logs.dat

Filesize
144B

MD5
0a58141cb2b3b5416c78785b4157a6f0

SHA1
a202423b72ab863eb4df56cc49f3b0dc96ffcb9c

SHA256
e4f835b4f5cccf61771e190dc4fa83bccda1a1b7515d7b0dc7505634a884f6fa

SHA512
b8ad0e806291af87513572e2662119ddccabe1fb6e6b06b2e51f0f28cc7bdaffc6acb6ec36f5069895f8686e44d359c57353a56f7eafe64a42903242d1012253

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpEE07.tmp

Filesize
1KB

MD5
f3206a4dae6e822836e4b20dca43295b

SHA1
5041c32da10adf441c0ec2316d284afafc9115ee

SHA256
596397faec068efa1fb6aef440db6c318a6e564081b6cca20e56f3aa00e96740

SHA512
3f52abd3864bfdf3d3aa210d5c4228a429c3e510841f62a38050de39ee900c7fcbf3258eba049ff563b4f9c24c69387a7a60d4b2947559e29b46eaf58dbd76ce

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
a0ad1d1a0954b83364dafbf1e3bae705

SHA1
c646773871d442af11a47f4b904ef835b55f1c0e

SHA256
78dece9e7aa137bddf8f1d6a27b1be4d62d75a34ebcac5cdb94e892cce0a301a

SHA512
5d5f4eea00fd58e9ef89bc81d1d85a43f5ab12743f0b9b58988410b65cfb2f8170b2d945026121b22193dac786ecebadc17759c49cd8705bb047d81d520c4def

Download Submit
\ProgramData\Remcos\remcos.exe

Filesize
908KB

MD5
0a91b0a960e1cb925434f0ded97e30b7

SHA1
ea0ed432c0cdb5f86cde1b17850a77b68ad71af4

SHA256
f57e0e55aa4691d0502f6da67d4ecb2823c98bd319c5208ae44a518a0a17392b

SHA512
37d4fbd29f3a5b274545f4864f9005b814410e35abc94c106e433ecd5c403a230eb2ca38d1d20aaa1f29ad0fbef5997c0c0cae37c2237b165e2eb5778dd2f7e4

Download Submit
memory/1148-95-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1148-88-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1148-81-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1148-62-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1148-65-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1148-69-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1148-74-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1148-75-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1212-26-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1212-31-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1212-24-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1212-22-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1212-20-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1212-16-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1212-18-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1212-14-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1212-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1212-28-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/1212-32-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2352-41-0x0000000000280000-0x000000000036A000-memory.dmp

Filesize
936KB

Download
memory/2888-33-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/2888-0-0x0000000073DCE000-0x0000000073DCF000-memory.dmp

Filesize
4KB

Download
memory/2888-6-0x0000000004840000-0x0000000004904000-memory.dmp

Filesize
784KB

Download
memory/2888-5-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/2888-4-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/2888-3-0x0000000073DCE000-0x0000000073DCF000-memory.dmp

Filesize
4KB

Download
memory/2888-2-0x0000000073DC0000-0x00000000744AE000-memory.dmp

Filesize
6.9MB

Download
memory/2888-1-0x0000000000DA0000-0x0000000000E8A000-memory.dmp

Filesize
936KB

Download