remcos | 963af49abf3f81e9ad4685ded0a27b7e6f6113291abe974cbb675deedbdf7bb6

General

Target

SLIP.exe
Size

1.6MB
MD5

cd020bbe91886c44ed61a0b4947e2ed0
SHA1

efdec00969f61b2795de443c843c57c737b12b46
SHA256

963af49abf3f81e9ad4685ded0a27b7e6f6113291abe974cbb675deedbdf7bb6
SHA512

3a1306d72e8200707405d8048f33a6e9157285563bd2999ee859ea8b4e6acbf4927b768ccd85ba62f872be64ceb029f647fc0e9b8592de54042148112c37677a

Score

10^/10

remcos persistence rat

Malware Config

Extracted

Family

remcos

C2

nkosarevaocs.duckdns.org:7266

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 1 IoCs

Processes:

remcos.exe

pid process

1172 remcos.exe
Drops startup file 1 IoCs

Processes:

SLIP.exe

description ioc process

File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.url SLIP.exe

pid	process
1172	remcos.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.url	SLIP.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

SLIP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\	SLIP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Remcos\\remcos.exe\""	SLIP.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

SLIP.exe

description pid process target process

PID 4820 set thread context of 2152 4820 SLIP.exe SLIP.exe
Modifies registry class 1 IoCs

Processes:

SLIP.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings SLIP.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

SLIP.exe

pid process

4820 SLIP.exe
Suspicious use of FindShellTrayWindow 6 IoCs

Processes:

SLIP.exeremcos.exe

pid process

4820 SLIP.exe
4820 SLIP.exe
4820 SLIP.exe
1172 remcos.exe
1172 remcos.exe
1172 remcos.exe
Suspicious use of SendNotifyMessage 6 IoCs

Processes:

SLIP.exeremcos.exe

pid process

4820 SLIP.exe
4820 SLIP.exe
4820 SLIP.exe
1172 remcos.exe
1172 remcos.exe
1172 remcos.exe

description	pid	process	target process
PID 4820 set thread context of 2152	4820	SLIP.exe	SLIP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings	SLIP.exe

pid	process
4820	SLIP.exe

pid	process
4820	SLIP.exe
4820	SLIP.exe
4820	SLIP.exe
1172	remcos.exe
1172	remcos.exe
1172	remcos.exe

pid	process
4820	SLIP.exe
4820	SLIP.exe
4820	SLIP.exe
1172	remcos.exe
1172	remcos.exe
1172	remcos.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

SLIP.exeSLIP.exeWScript.execmd.exe

description	pid	process	target process
PID 4820 wrote to memory of 2152	4820	SLIP.exe	SLIP.exe
PID 4820 wrote to memory of 2152	4820	SLIP.exe	SLIP.exe
PID 4820 wrote to memory of 2152	4820	SLIP.exe	SLIP.exe
PID 4820 wrote to memory of 2152	4820	SLIP.exe	SLIP.exe
PID 2152 wrote to memory of 4280	2152	SLIP.exe	WScript.exe
PID 2152 wrote to memory of 4280	2152	SLIP.exe	WScript.exe
PID 2152 wrote to memory of 4280	2152	SLIP.exe	WScript.exe
PID 4280 wrote to memory of 1004	4280	WScript.exe	cmd.exe
PID 4280 wrote to memory of 1004	4280	WScript.exe	cmd.exe
PID 4280 wrote to memory of 1004	4280	WScript.exe	cmd.exe
PID 1004 wrote to memory of 1172	1004	cmd.exe	remcos.exe
PID 1004 wrote to memory of 1172	1004	cmd.exe	remcos.exe
PID 1004 wrote to memory of 1172	1004	cmd.exe	remcos.exe

C:\Users\Admin\AppData\Local\Temp\SLIP.exe
"C:\Users\Admin\AppData\Local\Temp\SLIP.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4820

C:\Users\Admin\AppData\Local\Temp\SLIP.exe
"C:\Users\Admin\AppData\Local\Temp\SLIP.exe"
2⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2152

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
3⤵
- Suspicious use of WriteProcessMemory
PID:4280

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:1004

C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
5⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1172

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs
MD5
b92d64fe5b1d1f59df4b738262aea8df

SHA1
c8fb1981759c2d9bb2ec91b705985fba5fc7af63

SHA256
fa20e9aab03dc8e9f1910aaf0cf42662379fa16ae3a22642084fb97fa3d4f83a

SHA512
2566248b93c0cfb0414f033b8dd18bbd4f88180093eac2861107289bcb4ee160f9593706ff1f7d1f2e4ecea430d67a5a2897551a4f9ebd82b707243e300520e2

Download Submit
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
MD5
cd020bbe91886c44ed61a0b4947e2ed0

SHA1
efdec00969f61b2795de443c843c57c737b12b46

SHA256
963af49abf3f81e9ad4685ded0a27b7e6f6113291abe974cbb675deedbdf7bb6

SHA512
3a1306d72e8200707405d8048f33a6e9157285563bd2999ee859ea8b4e6acbf4927b768ccd85ba62f872be64ceb029f647fc0e9b8592de54042148112c37677a

Download Submit
C:\Users\Admin\AppData\Roaming\Remcos\remcos.exe
MD5
cd020bbe91886c44ed61a0b4947e2ed0

SHA1
efdec00969f61b2795de443c843c57c737b12b46

SHA256
963af49abf3f81e9ad4685ded0a27b7e6f6113291abe974cbb675deedbdf7bb6

SHA512
3a1306d72e8200707405d8048f33a6e9157285563bd2999ee859ea8b4e6acbf4927b768ccd85ba62f872be64ceb029f647fc0e9b8592de54042148112c37677a

Download Submit
memory/1004-8-0x0000000000000000-mapping.dmp

Download
memory/1172-9-0x0000000000000000-mapping.dmp

Download
memory/2152-2-0x0000000000413FA4-mapping.dmp

Download
memory/2152-5-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/4280-6-0x0000000000000000-mapping.dmp

Download
memory/4820-3-0x0000000001990000-0x00000000019B1000-memory.dmp

Filesize
132KB

Download
memory/4820-4-0x00000000018E0000-0x00000000018E3000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing