remcos | 963af49abf3f81e9ad4685ded0a27b7e6f6113291abe974cbb675deedbdf7bb6

General

Target

SLIP.exe
Size

1.6MB
MD5

cd020bbe91886c44ed61a0b4947e2ed0
SHA1

efdec00969f61b2795de443c843c57c737b12b46
SHA256

963af49abf3f81e9ad4685ded0a27b7e6f6113291abe974cbb675deedbdf7bb6
SHA512

3a1306d72e8200707405d8048f33a6e9157285563bd2999ee859ea8b4e6acbf4927b768ccd85ba62f872be64ceb029f647fc0e9b8592de54042148112c37677a

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

C2

nkosarevaocs.duckdns.org:7266

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 1 IoCs

Processes:

remcos.exe

pid process

920 remcos.exe
Drops startup file 1 IoCs

Processes:

SLIP.exe

description ioc process

File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.url SLIP.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

744 cmd.exe

pid	process
920	remcos.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.url	SLIP.exe

pid	process
744	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

SLIP.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	SLIP.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\	SLIP.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

SLIP.exe

description pid process target process

PID 2044 set thread context of 1088 2044 SLIP.exe SLIP.exe
Suspicious behavior: MapViewOfSection 10 IoCs

Processes:

SLIP.exe

pid process

2044 SLIP.exe
2044 SLIP.exe
2044 SLIP.exe
2044 SLIP.exe
2044 SLIP.exe
2044 SLIP.exe
2044 SLIP.exe
2044 SLIP.exe
2044 SLIP.exe
2044 SLIP.exe
Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

SLIP.exeremcos.exe

pid process

2044 SLIP.exe
2044 SLIP.exe
2044 SLIP.exe
920 remcos.exe
920 remcos.exe
920 remcos.exe
Suspicious use of SendNotifyMessage 6 IoCs

Processes:

SLIP.exeremcos.exe

pid process

2044 SLIP.exe
2044 SLIP.exe
2044 SLIP.exe
920 remcos.exe
920 remcos.exe
920 remcos.exe

description	pid	process	target process
PID 2044 set thread context of 1088	2044	SLIP.exe	SLIP.exe

pid	process
2044	SLIP.exe
2044	SLIP.exe
2044	SLIP.exe
2044	SLIP.exe
2044	SLIP.exe
2044	SLIP.exe
2044	SLIP.exe
2044	SLIP.exe
2044	SLIP.exe
2044	SLIP.exe

pid	process
2044	SLIP.exe
2044	SLIP.exe
2044	SLIP.exe
920	remcos.exe
920	remcos.exe
920	remcos.exe

pid	process
2044	SLIP.exe
2044	SLIP.exe
2044	SLIP.exe
920	remcos.exe
920	remcos.exe
920	remcos.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

SLIP.exeSLIP.exeWScript.execmd.exe

description	pid	process	target process
PID 2044 wrote to memory of 792	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 792	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 792	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 792	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 748	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 748	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 748	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 748	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 684	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 684	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 684	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 684	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1728	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1728	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1728	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1728	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1784	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1784	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1784	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1784	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1640	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1640	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1640	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1640	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1084	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1084	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1084	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1084	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1664	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1664	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1664	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1664	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1656	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1656	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1656	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1656	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1088	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1088	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1088	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1088	2044	SLIP.exe	SLIP.exe
PID 2044 wrote to memory of 1088	2044	SLIP.exe	SLIP.exe
PID 1088 wrote to memory of 2008	1088	SLIP.exe	WScript.exe
PID 1088 wrote to memory of 2008	1088	SLIP.exe	WScript.exe
PID 1088 wrote to memory of 2008	1088	SLIP.exe	WScript.exe
PID 1088 wrote to memory of 2008	1088	SLIP.exe	WScript.exe
PID 2008 wrote to memory of 744	2008	WScript.exe	cmd.exe
PID 2008 wrote to memory of 744	2008	WScript.exe	cmd.exe
PID 2008 wrote to memory of 744	2008	WScript.exe	cmd.exe
PID 2008 wrote to memory of 744	2008	WScript.exe	cmd.exe
PID 744 wrote to memory of 920	744	cmd.exe	remcos.exe
PID 744 wrote to memory of 920	744	cmd.exe	remcos.exe
PID 744 wrote to memory of 920	744	cmd.exe	remcos.exe
PID 744 wrote to memory of 920	744	cmd.exe	remcos.exe

C:\Users\Admin\AppData\Local\Temp\SLIP.exe
"C:\Users\Admin\AppData\Local\Temp\SLIP.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2044

C:\Users\Admin\AppData\Local\Temp\SLIP.exe
"C:\Users\Admin\AppData\Local\Temp\SLIP.exe"
2⤵
PID:792

C:\Users\Admin\AppData\Local\Temp\SLIP.exe
"C:\Users\Admin\AppData\Local\Temp\SLIP.exe"
2⤵
PID:748

C:\Users\Admin\AppData\Local\Temp\SLIP.exe
"C:\Users\Admin\AppData\Local\Temp\SLIP.exe"
2⤵
PID:684

C:\Users\Admin\AppData\Local\Temp\SLIP.exe
"C:\Users\Admin\AppData\Local\Temp\SLIP.exe"
2⤵
PID:1728

C:\Users\Admin\AppData\Local\Temp\SLIP.exe
"C:\Users\Admin\AppData\Local\Temp\SLIP.exe"
2⤵
PID:1784

C:\Users\Admin\AppData\Local\Temp\SLIP.exe
"C:\Users\Admin\AppData\Local\Temp\SLIP.exe"
2⤵
PID:1640

C:\Users\Admin\AppData\Local\Temp\SLIP.exe
"C:\Users\Admin\AppData\Local\Temp\SLIP.exe"
2⤵
PID:1084

C:\Users\Admin\AppData\Local\Temp\SLIP.exe
"C:\Users\Admin\AppData\Local\Temp\SLIP.exe"
2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
3⤵
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:744

C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
5⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:920

C:\Users\Admin\AppData\Local\Temp\SLIP.exe
"C:\Users\Admin\AppData\Local\Temp\SLIP.exe"
2⤵
PID:1656

C:\Users\Admin\AppData\Local\Temp\SLIP.exe
"C:\Users\Admin\AppData\Local\Temp\SLIP.exe"
2⤵
PID:1664

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs
MD5
b92d64fe5b1d1f59df4b738262aea8df

SHA1
c8fb1981759c2d9bb2ec91b705985fba5fc7af63

SHA256
fa20e9aab03dc8e9f1910aaf0cf42662379fa16ae3a22642084fb97fa3d4f83a

SHA512
2566248b93c0cfb0414f033b8dd18bbd4f88180093eac2861107289bcb4ee160f9593706ff1f7d1f2e4ecea430d67a5a2897551a4f9ebd82b707243e300520e2

Download Submit
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
MD5
cd020bbe91886c44ed61a0b4947e2ed0

SHA1
efdec00969f61b2795de443c843c57c737b12b46

SHA256
963af49abf3f81e9ad4685ded0a27b7e6f6113291abe974cbb675deedbdf7bb6

SHA512
3a1306d72e8200707405d8048f33a6e9157285563bd2999ee859ea8b4e6acbf4927b768ccd85ba62f872be64ceb029f647fc0e9b8592de54042148112c37677a

Download Submit
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
MD5
cd020bbe91886c44ed61a0b4947e2ed0

SHA1
efdec00969f61b2795de443c843c57c737b12b46

SHA256
963af49abf3f81e9ad4685ded0a27b7e6f6113291abe974cbb675deedbdf7bb6

SHA512
3a1306d72e8200707405d8048f33a6e9157285563bd2999ee859ea8b4e6acbf4927b768ccd85ba62f872be64ceb029f647fc0e9b8592de54042148112c37677a

Download Submit
\Users\Admin\AppData\Roaming\Remcos\remcos.exe
MD5
cd020bbe91886c44ed61a0b4947e2ed0

SHA1
efdec00969f61b2795de443c843c57c737b12b46

SHA256
963af49abf3f81e9ad4685ded0a27b7e6f6113291abe974cbb675deedbdf7bb6

SHA512
3a1306d72e8200707405d8048f33a6e9157285563bd2999ee859ea8b4e6acbf4927b768ccd85ba62f872be64ceb029f647fc0e9b8592de54042148112c37677a

Download Submit
memory/744-11-0x0000000000000000-mapping.dmp

Download
memory/920-15-0x0000000000000000-mapping.dmp

Download
memory/1088-5-0x0000000000413FA4-mapping.dmp

Download
memory/1088-10-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2008-12-0x0000000002750000-0x0000000002754000-memory.dmp

Filesize
16KB

Download
memory/2008-7-0x0000000000000000-mapping.dmp

Download
memory/2044-2-0x0000000075251000-0x0000000075253000-memory.dmp

Filesize
8KB

Download
memory/2044-3-0x0000000000280000-0x00000000002A1000-memory.dmp

Filesize
132KB

Download
memory/2044-4-0x00000000001F0000-0x00000000001F3000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing