Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
- submitted
10/03/2025, 12:09
General
- Target 3799fefd99f0042be2e286b28b2902fd3a7ec31d812694ff7a96f266b11b8003.exe
- Size 1.1MB
- Sample250310-pbj87stycy
- SHA256 3799fefd99f0042be2e286b28b2902fd3a7ec31d812694ff7a96f266b11b8003
Malware Config
Extracted
-
remcos
-
FEB 19
-
austin99.duckdns.org:9373
-
103.186.117.61:9373
-
sales778.bounceme.net:9373
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-7BJJCC
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Remcos family
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3799fefd99f0042be2e286b28b2902fd3a7ec31d812694ff7a96f266b11b8003.exe"C:\Users\Admin\AppData\Local\Temp\3799fefd99f0042be2e286b28b2902fd3a7ec31d812694ff7a96f266b11b8003.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rDjjAiTe.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rDjjAiTe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp804A.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\3799fefd99f0042be2e286b28b2902fd3a7ec31d812694ff7a96f266b11b8003.exe"C:\Users\Admin\AppData\Local\Temp\3799fefd99f0042be2e286b28b2902fd3a7ec31d812694ff7a96f266b11b8003.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
logs.dat
__PSScriptPolicyTest_0cd2ptpl.rb5.ps1
tmp804A.tmp
memory/556-6-0x0000000005400000-0x000000000540A000-memory.dmp
memory/556-4-0x0000000005500000-0x000000000559C000-memory.dmp
memory/556-5-0x00000000752E0000-0x0000000075A90000-memory.dmp
memory/556-3-0x0000000005460000-0x00000000054F2000-memory.dmp
memory/556-7-0x00000000059D0000-0x00000000059E8000-memory.dmp
memory/556-8-0x00000000752EE000-0x00000000752EF000-memory.dmp
memory/556-9-0x00000000752E0000-0x0000000075A90000-memory.dmp
memory/556-10-0x0000000006700000-0x00000000067C0000-memory.dmp
memory/556-2-0x0000000005A10000-0x0000000005FB4000-memory.dmp
memory/556-0-0x00000000752EE000-0x00000000752EF000-memory.dmp
memory/556-46-0x00000000752E0000-0x0000000075A90000-memory.dmp
memory/556-1-0x00000000008D0000-0x00000000009F2000-memory.dmp
memory/1716-66-0x00000000070D0000-0x00000000070E4000-memory.dmp
memory/1716-43-0x0000000005B50000-0x0000000005B6E000-memory.dmp
memory/1716-20-0x00000000052F0000-0x0000000005356000-memory.dmp
memory/1716-21-0x0000000005450000-0x00000000054B6000-memory.dmp
memory/1716-23-0x00000000752E0000-0x0000000075A90000-memory.dmp
memory/1716-18-0x0000000004BC0000-0x0000000004BE2000-memory.dmp
memory/1716-33-0x00000000055C0000-0x0000000005914000-memory.dmp
memory/1716-15-0x00000000045E0000-0x0000000004616000-memory.dmp
memory/1716-71-0x00000000752E0000-0x0000000075A90000-memory.dmp
memory/1716-68-0x00000000071B0000-0x00000000071B8000-memory.dmp
memory/1716-67-0x00000000071D0000-0x00000000071EA000-memory.dmp
memory/1716-22-0x00000000752E0000-0x0000000075A90000-memory.dmp
memory/1716-17-0x0000000004C50000-0x0000000005278000-memory.dmp
memory/1716-64-0x0000000007090000-0x00000000070A1000-memory.dmp
memory/1716-65-0x00000000070C0000-0x00000000070CE000-memory.dmp
memory/1716-16-0x00000000752E0000-0x0000000075A90000-memory.dmp
memory/1716-45-0x0000000005B70000-0x0000000005BBC000-memory.dmp
memory/1716-47-0x0000000006AF0000-0x0000000006B22000-memory.dmp
memory/1716-48-0x000000006FC00000-0x000000006FC4C000-memory.dmp
memory/1716-58-0x0000000006B30000-0x0000000006B4E000-memory.dmp
memory/1716-59-0x0000000006B50000-0x0000000006BF3000-memory.dmp
memory/1716-60-0x00000000074D0000-0x0000000007B4A000-memory.dmp
memory/1716-61-0x0000000006E90000-0x0000000006EAA000-memory.dmp
memory/1716-62-0x0000000006F00000-0x0000000006F0A000-memory.dmp
memory/1716-63-0x0000000007110000-0x00000000071A6000-memory.dmp
memory/1816-38-0x0000000000400000-0x000000000047F000-memory.dmp
memory/1816-44-0x0000000000400000-0x000000000047F000-memory.dmp
memory/1816-36-0x0000000000400000-0x000000000047F000-memory.dmp
memory/1816-42-0x0000000000400000-0x000000000047F000-memory.dmp
memory/1816-41-0x0000000000400000-0x000000000047F000-memory.dmp
memory/1816-34-0x0000000000400000-0x000000000047F000-memory.dmp
memory/1816-74-0x0000000000400000-0x000000000047F000-memory.dmp
memory/1816-77-0x0000000000400000-0x000000000047F000-memory.dmp
memory/1816-35-0x0000000000400000-0x000000000047F000-memory.dmp
memory/1816-83-0x0000000000400000-0x000000000047F000-memory.dmp
memory/1816-84-0x0000000000400000-0x000000000047F000-memory.dmp
memory/1816-90-0x0000000000400000-0x000000000047F000-memory.dmp
memory/1816-96-0x0000000000400000-0x000000000047F000-memory.dmp
memory/1816-97-0x0000000000400000-0x000000000047F000-memory.dmp
memory/1816-102-0x0000000000400000-0x000000000047F000-memory.dmp
memory/1816-108-0x0000000000400000-0x000000000047F000-memory.dmp
memory/1816-109-0x0000000000400000-0x000000000047F000-memory.dmp