| File name: | remcos.exe |
| Full analysis: | https://app.any.run/tasks/138b2457-9a1e-4c93-bce5-5f614c79f832 |
| Verdict: | Malicious activity |
| Threats: | A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools. |
| Analysis date: | April 03, 2024, 21:26:21 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 88E18AE5E46697D28AEC9AB6E2E230AA |
| SHA1: | 6BFC2A4A37F781584CFCE47C9297A6179F714334 |
| SHA256: | EA8020C029EE419C056C1B3C078441C9E5389EC02EC28DBAC371D728C1508768 |
| SSDEEP: | 12288:mp/TGh+2QTAzx+xfvADuEkcwec52DZVmpWVVVVVVVVVVVVVVVVVFI/:Jp+xfXEsCDZgp |
MALICIOUS
Drops the executable file immediately after the start
- remcos.exe (PID: 2120)
REMCOS has been detected
- remcos.exe (PID: 2120)
- remcos.exe (PID: 2120)
- remcos.exe (PID: 1836)
- remcos.exe (PID: 1836)
Changes the autorun value in the registry
- remcos.exe (PID: 2120)
- remcos.exe (PID: 1836)
REMCOS has been detected (SURICATA)
- remcos.exe (PID: 1836)
REMCOS has been detected (YARA)
- remcos.exe (PID: 1836)
SUSPICIOUS
Writes files like Keylogger logs
- remcos.exe (PID: 2120)
- remcos.exe (PID: 1836)
Starts itself from another location
- remcos.exe (PID: 2120)
Reads security settings of Internet Explorer
- remcos.exe (PID: 2120)
- remcos.exe (PID: 1836)
Reads the Internet Settings
- remcos.exe (PID: 2120)
- remcos.exe (PID: 1836)
Connects to unusual port
- remcos.exe (PID: 1836)
INFO
Checks supported languages
- remcos.exe (PID: 2120)
- remcos.exe (PID: 1836)
Reads product name
- remcos.exe (PID: 2120)
- remcos.exe (PID: 1836)
Creates files in the program directory
- remcos.exe (PID: 2120)
- remcos.exe (PID: 1836)
Reads Environment values
- remcos.exe (PID: 2120)
- remcos.exe (PID: 1836)
Reads the computer name
- remcos.exe (PID: 2120)
- remcos.exe (PID: 1836)
Reads the machine GUID from the registry
- remcos.exe (PID: 1836)
Manual execution by a user
- explorer.exe (PID: 2792)
Checks proxy server information
- remcos.exe (PID: 1836)
Creates files or folders in the user directory
- remcos.exe (PID: 1836)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Remcos
(PID) Process(1836) remcos.exe
C2 (1)lila152511.duckdns.org:4000
BotnetNUEVOS
Options
Connect_interval1
Install_flagTrue
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-F5R20T
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_fileregistros.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileCapturas de pantalla
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
TRiD
| .exe | | | Win64 Executable (generic) (64.6) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (15.4) |
| .exe | | | Win32 Executable (generic) (10.5) |
| .exe | | | Generic Win/DOS Executable (4.6) |
| .exe | | | DOS Executable Generic (4.6) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2023:09:07 10:23:27+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14 |
| CodeSize: | 356864 |
| InitializedDataSize: | 136704 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x3493d |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
Total processes
41
Monitored processes
3
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1836 | "C:\ProgramData\Remcos\remcos.exe" | C:\ProgramData\Remcos\remcos.exe | remcos.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
Remcos(PID) Process(1836) remcos.exe C2 (1)lila152511.duckdns.org:4000 BotnetNUEVOS Options Connect_interval1 Install_flagTrue Install_HKCU\RunTrue Install_HKLM\RunTrue Install_HKLM\Explorer\Run1 Install_HKLM\Winlogon\Shell100000 Setup_path%LOCALAPPDATA% Copy_fileremcos.exe Startup_valueFalse Hide_fileFalse Mutex_nameRmc-F5R20T Keylog_flag1 Keylog_path%LOCALAPPDATA% Keylog_fileregistros.dat Keylog_cryptFalse Hide_keylogFalse Screenshot_flagFalse Screenshot_time5 Take_ScreenshotFalse Screenshot_path%APPDATA% Screenshot_fileCapturas de pantalla Screenshot_cryptFalse Mouse_optionFalse Delete_fileFalse Audio_record_time5 Audio_path%ProgramFiles% Audio_dirMicRecords Connect_delay0 Copy_dirRemcos Keylog_dirremcos | |||||||||||||||
| 2120 | "C:\Users\admin\AppData\Local\Temp\remcos.exe" | C:\Users\admin\AppData\Local\Temp\remcos.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 2792 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
1 105
Read events
1 064
Write events
35
Delete events
6
Modification events
| (PID) Process: | (2120) remcos.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | Rmc-F5R20T |
Value: "C:\ProgramData\Remcos\remcos.exe" | |||
| (PID) Process: | (2120) remcos.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | Rmc-F5R20T |
Value: "C:\ProgramData\Remcos\remcos.exe" | |||
| (PID) Process: | (2120) remcos.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (2120) remcos.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (2120) remcos.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (2120) remcos.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (1836) remcos.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | Rmc-F5R20T |
Value: "C:\ProgramData\Remcos\remcos.exe" | |||
| (PID) Process: | (1836) remcos.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | Rmc-F5R20T |
Value: "C:\ProgramData\Remcos\remcos.exe" | |||
| (PID) Process: | (1836) remcos.exe | Key: | HKEY_CURRENT_USER\Software\Rmc-F5R20T |
| Operation: | write | Name: | exepath |
Value: 8D66052A8757A494FCC6ECD3890F2ED99E56DFD0FDF5A9F3E9B8244FE3DCB174F172E7DEFEFBC0450F48E89BD08799480BC865DAC57068FBE879561E611C17FDBFA8 | |||
| (PID) Process: | (1836) remcos.exe | Key: | HKEY_CURRENT_USER\Software\Rmc-F5R20T |
| Operation: | write | Name: | licence |
Value: 2EF1F875A9B2C3AAAA4C4AE597182F64 | |||
Executable files
1
Suspicious files
0
Text files
0
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2120 | remcos.exe | C:\ProgramData\Remcos\remcos.exe | executable | |
MD5:— | SHA256:— | |||
| 1836 | remcos.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\json[1].json | binary | |
MD5:— | SHA256:— | |||
| 1836 | remcos.exe | C:\ProgramData\remcos\registros.dat | binary | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
7
DNS requests
4
Threats
9
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1836 | remcos.exe | GET | 200 | 178.237.33.50:80 | http://geoplugin.net/json.gp | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | unknown |
1836 | remcos.exe | 149.28.103.159:4000 | lila152511.duckdns.org | AS-CHOOPA | US | unknown |
1836 | remcos.exe | 178.237.33.50:80 | geoplugin.net | Schuberg Philis B.V. | NL | unknown |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
lila152511.duckdns.org |
| malicious |
geoplugin.net |
| malicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1080 | svchost.exe | Potentially Bad Traffic | ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain |
1080 | svchost.exe | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
1836 | remcos.exe | A Network Trojan was detected | REMOTE [ANY.RUN] REMCOS JA3 Hash |
1836 | remcos.exe | Malware Command and Control Activity Detected | ET JA3 Hash - Remcos 3.x/4.x TLS Connection |
1080 | svchost.exe | Potentially Bad Traffic | ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain |
1080 | svchost.exe | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
— | — | Potentially Bad Traffic | ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain |
— | — | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
1 ETPRO signatures available at the full report