remcos | 4c8c59242b2c2a8b0873d6c06ce57ba6b31dd1e92859f0a444ac3f14d47d275b

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe
Size

502KB
MD5

d44ba5b8a9598cb8ce4d82f0b5e48d9f
SHA1

755308b8328eafa8f9b78e63e1e699717da7d718
SHA256

81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1
SHA512

f7eff85ce186faef8e6bfad30d2668d831cc09b70f0c269a2f17432a56cf89c67c93d3cd9c203928b74824aa44d2c2bcdd63831f3deba83c663a58616a57449f
SSDEEP

12288:5r9vaMBjApa+t4IuNh9jgpL2JoIJ6rOSGWgwO56KPxu24ATa6q:n7jAI+t4IF2JoIJlXPI24mJq

Score

10^/10

remcos 14 discovery rat

Malware Config

Extracted

Family

remcos

Version

2.7.0 Pro

Botnet

prueba6812111.duckdns.org:1717

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-HEOTZ9
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4016 set thread context of 3744	4016	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2568	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4016	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4016	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3744	RegSvcs.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 2568	4016	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	96
PID 4016 wrote to memory of 2568	4016	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	96
PID 4016 wrote to memory of 2568	4016	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	96
PID 4016 wrote to memory of 3744	4016	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	98
PID 4016 wrote to memory of 3744	4016	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	98
PID 4016 wrote to memory of 3744	4016	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	98
PID 4016 wrote to memory of 3744	4016	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	98
PID 4016 wrote to memory of 3744	4016	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	98
PID 4016 wrote to memory of 3744	4016	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	98
PID 4016 wrote to memory of 3744	4016	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	98
PID 4016 wrote to memory of 3744	4016	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	98
PID 4016 wrote to memory of 3744	4016	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	98
PID 4016 wrote to memory of 3744	4016	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	98

C:\Users\Admin\AppData\Local\Temp\81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe
"C:\Users\Admin\AppData\Local\Temp\81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zCmrifXxFLnZnW" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE6A7.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2568
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "{path}"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE6A7.tmp

Filesize
1KB

MD5
c06e87812b23b63f5eb5cd2792a3ef09

SHA1
045b55bdc6377bc89c32dd83871c0a412f6eac36

SHA256
fbb2281e15aa87a8589f3492052c13b809b2233bbb82cd7db7811252112280ea

SHA512
8620e49ed88ef2ce5f2d7b4828a973b44e111e3772a46dc04dca4cc0922e0e664c51942afeebd22a8b9522bbf86bfcaed37d2fd53898c8428495ed9a997818f2

Download Submit
C:\Users\Admin\AppData\Roaming\remcos\logs.dat

Filesize
74B

MD5
c8bf1008a66614e3368fc6247d3398e4

SHA1
3571a961b9148e8bef69278ef071aa29057c45e5

SHA256
701ceb895521abacec580212b457786057e8f12e7a377ee1de543e8781ae44b7

SHA512
0319e97f17f4e0b29298a9f39f381ed4b4960d833ac7a0ce9723d486bd0c50c3724dd55bc229736657b24b406d244661bcc3438cd878cd7fb5aaf73daf4e2dc6

Download Submit
memory/3744-42-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-66-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-19-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-15-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-86-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-44-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-84-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-82-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-81-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-80-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-79-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-77-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-76-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-45-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-75-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-73-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-23-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-25-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-26-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-27-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-28-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-29-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-30-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-33-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-34-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-47-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-38-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-39-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-40-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-41-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-18-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-43-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-71-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-69-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-35-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-48-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-49-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-51-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-52-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-54-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-55-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-56-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-57-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-58-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-59-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-60-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-62-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-63-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-64-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-22-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-67-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3744-68-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4016-8-0x0000000074F4E000-0x0000000074F4F000-memory.dmp

Filesize
4KB

Download
memory/4016-2-0x0000000005BA0000-0x0000000006144000-memory.dmp

Filesize
5.6MB

Download
memory/4016-24-0x0000000074F40000-0x00000000756F0000-memory.dmp

Filesize
7.7MB

Download
memory/4016-11-0x0000000006C50000-0x0000000006C76000-memory.dmp

Filesize
152KB

Download
memory/4016-9-0x0000000074F40000-0x00000000756F0000-memory.dmp

Filesize
7.7MB

Download
memory/4016-10-0x0000000006A80000-0x0000000006AF6000-memory.dmp

Filesize
472KB

Download
memory/4016-7-0x0000000005A20000-0x0000000005A2A000-memory.dmp

Filesize
40KB

Download
memory/4016-4-0x0000000005730000-0x00000000057CC000-memory.dmp

Filesize
624KB

Download
memory/4016-5-0x0000000074F40000-0x00000000756F0000-memory.dmp

Filesize
7.7MB

Download
memory/4016-6-0x0000000005620000-0x000000000562A000-memory.dmp

Filesize
40KB

Download
memory/4016-3-0x0000000005690000-0x0000000005722000-memory.dmp

Filesize
584KB

Download
memory/4016-1-0x0000000000B90000-0x0000000000C12000-memory.dmp

Filesize
520KB

Download
memory/4016-0-0x0000000074F4E000-0x0000000074F4F000-memory.dmp

Filesize
4KB

Download