Overview
overview
10Static
static
3Remcos Pro...22.zip
windows10-2004-x64
1Remcos Pro...22.zip
windows11-21h2-x64
1LICENSE
windows10-2004-x64
1LICENSE
windows11-21h2-x64
1Remcos Pro...le.ini
windows10-2004-x64
1Remcos Pro...le.ini
windows11-21h2-x64
3Remcos Pro...22.exe
windows10-2004-x64
10Remcos Pro...22.exe
windows11-21h2-x64
10Remcos Pro...gs.ini
windows10-2004-x64
1Remcos Pro...gs.ini
windows11-21h2-x64
3Analysis
-
max time kernel
148s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 17:29
Static task
static1
Behavioral task
behavioral1
Sample
Remcos Professional Cracked By Alcatraz3222.zip
Resource
win10v2004-20240611-en
Behavioral task
behavioral2
Sample
Remcos Professional Cracked By Alcatraz3222.zip
Resource
win11-20240419-en
Behavioral task
behavioral3
Sample
LICENSE
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
LICENSE
Resource
win11-20240508-en
Behavioral task
behavioral5
Sample
Remcos Professional Cracked By Alcatraz3222/BuilderProfiles/DefaultProfile.ini
Resource
win10v2004-20240611-en
Behavioral task
behavioral6
Sample
Remcos Professional Cracked By Alcatraz3222/BuilderProfiles/DefaultProfile.ini
Resource
win11-20240508-en
Behavioral task
behavioral7
Sample
Remcos Professional Cracked By Alcatraz3222/Remcos Professional Cracked By Alcatraz3222.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
Remcos Professional Cracked By Alcatraz3222/Remcos Professional Cracked By Alcatraz3222.exe
Resource
win11-20240611-en
Behavioral task
behavioral9
Sample
Remcos Professional Cracked By Alcatraz3222/Remcos_Settings.ini
Resource
win10v2004-20240611-en
Behavioral task
behavioral10
Sample
Remcos Professional Cracked By Alcatraz3222/Remcos_Settings.ini
Resource
win11-20240419-en
General
-
Target
Remcos Professional Cracked By Alcatraz3222/Remcos Professional Cracked By Alcatraz3222.exe
-
Size
17.7MB
-
MD5
efc159c7cf75545997f8c6af52d3e802
-
SHA1
b85bd368c91a13db1c5de2326deb25ad666c24c1
-
SHA256
898ac001d0f6c52c1001c640d9860287fdf30a648d580e9f5dd15e2ef84ab18e
-
SHA512
d06a432233dceb731defd53238971699fef201d0f9144ee50e5dd7d6620dfdd6c298d52618bf2c9feb0519574f4565fb0177b00fd8292768fbd8b85dd11e650d
-
SSDEEP
393216:GYuGvp8EHb+in8f4Zg41+Q4AXf5ZZcyfHDMxVpSc+q+eOFxdx:3mqSi8fN4sAXfrZcyfo7p0eYHx
Malware Config
Extracted
njrat
0.7d
HacKed
dllsys.duckdns.org:3202
3b570ffeeb3d34249b9a5ce0ee58a328
-
reg_key
3b570ffeeb3d34249b9a5ce0ee58a328
-
splitter
svchost
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 4784 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Remcos Professional Cracked By Alcatraz3222.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation Remcos Professional Cracked By Alcatraz3222.exe -
Executes dropped EXE 2 IoCs
Processes:
Remcos Professional Cracked By Alcatraz3222.exetaskhost.exepid process 3604 Remcos Professional Cracked By Alcatraz3222.exe 3616 taskhost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Remcos Professional Cracked By Alcatraz3222.exepid process 3604 Remcos Professional Cracked By Alcatraz3222.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Remcos Professional Cracked By Alcatraz3222.exedescription pid process target process PID 4820 set thread context of 3616 4820 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
Remcos Professional Cracked By Alcatraz3222.exeRemcos Professional Cracked By Alcatraz3222.exepid process 4820 Remcos Professional Cracked By Alcatraz3222.exe 3604 Remcos Professional Cracked By Alcatraz3222.exe 3604 Remcos Professional Cracked By Alcatraz3222.exe 3604 Remcos Professional Cracked By Alcatraz3222.exe 3604 Remcos Professional Cracked By Alcatraz3222.exe 4820 Remcos Professional Cracked By Alcatraz3222.exe 4820 Remcos Professional Cracked By Alcatraz3222.exe 4820 Remcos Professional Cracked By Alcatraz3222.exe 4820 Remcos Professional Cracked By Alcatraz3222.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
Processes:
Remcos Professional Cracked By Alcatraz3222.exetaskhost.exedescription pid process Token: SeDebugPrivilege 4820 Remcos Professional Cracked By Alcatraz3222.exe Token: SeDebugPrivilege 3616 taskhost.exe Token: 33 3616 taskhost.exe Token: SeIncBasePriorityPrivilege 3616 taskhost.exe Token: 33 3616 taskhost.exe Token: SeIncBasePriorityPrivilege 3616 taskhost.exe Token: 33 3616 taskhost.exe Token: SeIncBasePriorityPrivilege 3616 taskhost.exe Token: 33 3616 taskhost.exe Token: SeIncBasePriorityPrivilege 3616 taskhost.exe Token: 33 3616 taskhost.exe Token: SeIncBasePriorityPrivilege 3616 taskhost.exe Token: 33 3616 taskhost.exe Token: SeIncBasePriorityPrivilege 3616 taskhost.exe Token: 33 3616 taskhost.exe Token: SeIncBasePriorityPrivilege 3616 taskhost.exe Token: 33 3616 taskhost.exe Token: SeIncBasePriorityPrivilege 3616 taskhost.exe Token: 33 3616 taskhost.exe Token: SeIncBasePriorityPrivilege 3616 taskhost.exe Token: 33 3616 taskhost.exe Token: SeIncBasePriorityPrivilege 3616 taskhost.exe Token: 33 3616 taskhost.exe Token: SeIncBasePriorityPrivilege 3616 taskhost.exe Token: 33 3616 taskhost.exe Token: SeIncBasePriorityPrivilege 3616 taskhost.exe Token: 33 3616 taskhost.exe Token: SeIncBasePriorityPrivilege 3616 taskhost.exe Token: 33 3616 taskhost.exe Token: SeIncBasePriorityPrivilege 3616 taskhost.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Remcos Professional Cracked By Alcatraz3222.exepid process 3604 Remcos Professional Cracked By Alcatraz3222.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
Remcos Professional Cracked By Alcatraz3222.exepid process 3604 Remcos Professional Cracked By Alcatraz3222.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Remcos Professional Cracked By Alcatraz3222.exepid process 3604 Remcos Professional Cracked By Alcatraz3222.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
Remcos Professional Cracked By Alcatraz3222.execmd.exetaskhost.exedescription pid process target process PID 4820 wrote to memory of 3604 4820 Remcos Professional Cracked By Alcatraz3222.exe Remcos Professional Cracked By Alcatraz3222.exe PID 4820 wrote to memory of 3604 4820 Remcos Professional Cracked By Alcatraz3222.exe Remcos Professional Cracked By Alcatraz3222.exe PID 4820 wrote to memory of 3604 4820 Remcos Professional Cracked By Alcatraz3222.exe Remcos Professional Cracked By Alcatraz3222.exe PID 4820 wrote to memory of 4924 4820 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 4820 wrote to memory of 4924 4820 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 4820 wrote to memory of 4924 4820 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 4820 wrote to memory of 2536 4820 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 4820 wrote to memory of 2536 4820 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 4820 wrote to memory of 2536 4820 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 2536 wrote to memory of 4984 2536 cmd.exe reg.exe PID 2536 wrote to memory of 4984 2536 cmd.exe reg.exe PID 2536 wrote to memory of 4984 2536 cmd.exe reg.exe PID 4820 wrote to memory of 3428 4820 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 4820 wrote to memory of 3428 4820 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 4820 wrote to memory of 3428 4820 Remcos Professional Cracked By Alcatraz3222.exe cmd.exe PID 4820 wrote to memory of 3616 4820 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 4820 wrote to memory of 3616 4820 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 4820 wrote to memory of 3616 4820 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 4820 wrote to memory of 3616 4820 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 4820 wrote to memory of 3616 4820 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 4820 wrote to memory of 3616 4820 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 4820 wrote to memory of 3616 4820 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 4820 wrote to memory of 3616 4820 Remcos Professional Cracked By Alcatraz3222.exe taskhost.exe PID 3616 wrote to memory of 4784 3616 taskhost.exe netsh.exe PID 3616 wrote to memory of 4784 3616 taskhost.exe netsh.exe PID 3616 wrote to memory of 4784 3616 taskhost.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222\Remcos Professional Cracked By Alcatraz3222.exe"C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222\Remcos Professional Cracked By Alcatraz3222.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222.exe"C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/Remcos Professional Cracked By Alcatraz3222/Remcos Professional Cracked By Alcatraz3222.exe" "%temp%\Profile Remcos\Update_Lock_Remcos.exe" /Y2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\Profile Remcos\Update_Lock_Remcos.exe.lnk" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Profile Remcos\Update_Lock_Remcos.exe.lnk" /f3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\Profile Remcos\Update_Lock_Remcos.exe:Zone.Identifier2⤵
-
C:\Users\Admin\AppData\Local\Temp\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\taskhost.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\taskhost.exe" "taskhost.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4060 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Profile Remcos\Update_Lock_Remcos.exeFilesize
17.7MB
MD5efc159c7cf75545997f8c6af52d3e802
SHA1b85bd368c91a13db1c5de2326deb25ad666c24c1
SHA256898ac001d0f6c52c1001c640d9860287fdf30a648d580e9f5dd15e2ef84ab18e
SHA512d06a432233dceb731defd53238971699fef201d0f9144ee50e5dd7d6620dfdd6c298d52618bf2c9feb0519574f4565fb0177b00fd8292768fbd8b85dd11e650d
-
C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222.exeFilesize
17.4MB
MD5c3c21fa4c2186deb641455482ab0d3aa
SHA12f4b49e8383e073ccb965943ce970de403412567
SHA2564ea203509d0fdff3e31f976413c546ca3d36133bc708e9a1301860961cc3a8d9
SHA51231db2963f1bd49f7b4a6ee38e54940d20120d6c05ef7bf34ec97eb93051bee6d5428e9e1271e4ae8f5544b824188ac7278315e2e2c27be302a312eebbf8c3fb7
-
C:\Users\Admin\AppData\Local\Temp\Remcos Professional Cracked By Alcatraz3222\Remcos_Settings.iniFilesize
881B
MD5a3468935e33e361cf94f4721ed4cb66d
SHA1c3b19ca8382534b2179940cabede8c6c952a9c06
SHA256b374af58c24b6085f64f979dab434643da39d0267a27975f396473327dc98c7d
SHA512c1caa0b9637a46187d54b2952db204182fad5a5324574949ce4db13bdb17624ccd8b3228eb9b2bcfe5851add2c5d2f586945e7264b1d1cd02d91acf1fd81583a
-
C:\Users\Admin\AppData\Local\Temp\taskhost.exeFilesize
256KB
MD58fdf47e0ff70c40ed3a17014aeea4232
SHA1e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA256ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
SHA512bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be
-
memory/3604-24-0x00000000048A0000-0x00000000048A1000-memory.dmpFilesize
4KB
-
memory/3604-27-0x0000000000400000-0x0000000002991000-memory.dmpFilesize
37.6MB
-
memory/3604-16-0x0000000000762000-0x000000000181E000-memory.dmpFilesize
16.7MB
-
memory/3604-18-0x0000000004820000-0x0000000004821000-memory.dmpFilesize
4KB
-
memory/3604-22-0x0000000004880000-0x0000000004881000-memory.dmpFilesize
4KB
-
memory/3604-21-0x0000000004870000-0x0000000004871000-memory.dmpFilesize
4KB
-
memory/3604-20-0x0000000004860000-0x0000000004861000-memory.dmpFilesize
4KB
-
memory/3604-19-0x0000000004830000-0x0000000004831000-memory.dmpFilesize
4KB
-
memory/3604-17-0x00000000029C0000-0x00000000029C1000-memory.dmpFilesize
4KB
-
memory/3604-95-0x0000000000400000-0x0000000002991000-memory.dmpFilesize
37.6MB
-
memory/3604-96-0x0000000000762000-0x000000000181E000-memory.dmpFilesize
16.7MB
-
memory/3604-23-0x0000000004890000-0x0000000004891000-memory.dmpFilesize
4KB
-
memory/3604-25-0x0000000000400000-0x0000000002991000-memory.dmpFilesize
37.6MB
-
memory/3616-94-0x0000000005200000-0x000000000520A000-memory.dmpFilesize
40KB
-
memory/3616-35-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/3616-45-0x0000000005110000-0x00000000051A2000-memory.dmpFilesize
584KB
-
memory/3616-40-0x0000000005510000-0x0000000005AB4000-memory.dmpFilesize
5.6MB
-
memory/4820-3-0x0000000074E00000-0x00000000755B0000-memory.dmpFilesize
7.7MB
-
memory/4820-43-0x0000000074E00000-0x00000000755B0000-memory.dmpFilesize
7.7MB
-
memory/4820-44-0x0000000074E00000-0x00000000755B0000-memory.dmpFilesize
7.7MB
-
memory/4820-41-0x0000000074E0E000-0x0000000074E0F000-memory.dmpFilesize
4KB
-
memory/4820-1-0x00000000006D0000-0x000000000187E000-memory.dmpFilesize
17.7MB
-
memory/4820-2-0x0000000006230000-0x00000000062CC000-memory.dmpFilesize
624KB
-
memory/4820-4-0x000000000D8F0000-0x000000000EA72000-memory.dmpFilesize
17.5MB
-
memory/4820-0-0x0000000074E0E000-0x0000000074E0F000-memory.dmpFilesize
4KB