remcos | 4c8c59242b2c2a8b0873d6c06ce57ba6b31dd1e92859f0a444ac3f14d47d275b

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/12/2024, 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe
Size

502KB
MD5

d44ba5b8a9598cb8ce4d82f0b5e48d9f
SHA1

755308b8328eafa8f9b78e63e1e699717da7d718
SHA256

81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1
SHA512

f7eff85ce186faef8e6bfad30d2668d831cc09b70f0c269a2f17432a56cf89c67c93d3cd9c203928b74824aa44d2c2bcdd63831f3deba83c663a58616a57449f
SSDEEP

12288:5r9vaMBjApa+t4IuNh9jgpL2JoIJ6rOSGWgwO56KPxu24ATa6q:n7jAI+t4IF2JoIJlXPI24mJq

Score

10^/10

remcos 14 discovery rat

Malware Config

Extracted

Family

remcos

Version

2.7.0 Pro

Botnet

prueba6812111.duckdns.org:1717

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-HEOTZ9
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2824 set thread context of 2532	2824	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2596	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2824	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2824	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2532	RegSvcs.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2596	2824	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	31
PID 2824 wrote to memory of 2596	2824	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	31
PID 2824 wrote to memory of 2596	2824	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	31
PID 2824 wrote to memory of 2596	2824	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	31
PID 2824 wrote to memory of 2532	2824	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	33
PID 2824 wrote to memory of 2532	2824	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	33
PID 2824 wrote to memory of 2532	2824	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	33
PID 2824 wrote to memory of 2532	2824	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	33
PID 2824 wrote to memory of 2532	2824	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	33
PID 2824 wrote to memory of 2532	2824	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	33
PID 2824 wrote to memory of 2532	2824	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	33
PID 2824 wrote to memory of 2532	2824	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	33
PID 2824 wrote to memory of 2532	2824	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	33
PID 2824 wrote to memory of 2532	2824	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	33
PID 2824 wrote to memory of 2532	2824	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	33
PID 2824 wrote to memory of 2532	2824	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	33
PID 2824 wrote to memory of 2532	2824	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	33
PID 2824 wrote to memory of 2532	2824	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	33

C:\Users\Admin\AppData\Local\Temp\81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe
"C:\Users\Admin\AppData\Local\Temp\81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zCmrifXxFLnZnW" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD430.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2596
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD430.tmp

Filesize
1KB

MD5
ada2b7adee7e5c24cff903a9668c756b

SHA1
294bfa0abfbcf371e966f75a83f3e77aa63e3f90

SHA256
55ea0c1b0a1e929459d30e617664d5a84ea335807a8a6fbfeda63c6ae618255d

SHA512
ff3cb31fdc37a58f9410838d9c0a0cb1527bfb7d669eba3b381a7b08c92875a44bd5b13b9a30c791c7e1bd0015773d46c67e4e7d6e7a248571bf67045be8fe29

Download Submit
C:\Users\Admin\AppData\Roaming\remcos\logs.dat

Filesize
74B

MD5
de695b63ed7ed5abda81f94d0c5d8f58

SHA1
301d01361111bd06adda8696babe453554783b4b

SHA256
90c769419a78eccae0a95ec3e3b83da929ab51f663b88b19c71578440837258e

SHA512
d1b32c92e606b8e0603f58af5bd71f48b27fb8f9044b78ebc7987b7729287ba82e65130a4798b203548c56ce903065b637038b3426f7928fa57167829162c60b

Download Submit
memory/2532-45-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-33-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-78-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-76-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-74-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-72-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-52-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-11-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-12-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-20-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-23-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2532-18-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-15-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-13-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-29-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-26-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-25-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-51-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-31-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-50-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-34-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-32-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-35-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-36-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-37-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-38-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-39-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-49-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-46-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-47-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2532-48-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2824-0-0x00000000746BE000-0x00000000746BF000-memory.dmp

Filesize
4KB

Download
memory/2824-3-0x0000000000310000-0x000000000031A000-memory.dmp

Filesize
40KB

Download
memory/2824-30-0x00000000746B0000-0x0000000074D9E000-memory.dmp

Filesize
6.9MB

Download
memory/2824-2-0x00000000746B0000-0x0000000074D9E000-memory.dmp

Filesize
6.9MB

Download
memory/2824-7-0x0000000000760000-0x0000000000786000-memory.dmp

Filesize
152KB

Download
memory/2824-6-0x0000000001030000-0x00000000010A6000-memory.dmp

Filesize
472KB

Download
memory/2824-5-0x00000000746B0000-0x0000000074D9E000-memory.dmp

Filesize
6.9MB

Download
memory/2824-4-0x00000000746BE000-0x00000000746BF000-memory.dmp

Filesize
4KB

Download
memory/2824-1-0x00000000010A0000-0x0000000001122000-memory.dmp

Filesize
520KB

Download