remcos | c93cb82d0cf5c20e8efb54197b95e646dc6a47168908bd024969892c0ec2a0b6

General

Target
Payment_Slip.jpg.exe
Size 1.2MB
Sample210622-2s3tdwmc3a
SHA256 eeddb4eb1252a45f5a8246d68dc6557f3e0c6f264a0a6f42e81d041c53864a48
MD5 fadbae48aec8768a2ff8682dd1e60004
SHA1 b1d138910f9de58de2e00181de2ee4741353e6bc
SHA512 49d9359d9fb8a1fa3e2dbdcf69154197ddc7a92b44247b0076165e8341022e8c51c5032f20b2f482196ec9682cb0939b4f082b76b4057648b4e77f37c791db7f
MD5 SHA1 SHA512

Score

10^/10

remcos newnew rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

newnew

C2

103.147.184.53:4041

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
now.exe
copy_folder
now12
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%Temp%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
now
keylog_path
%AppData%
mouse_option
false
mutex
remcos_cqtzwatsal
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
challan2
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
2292	Payment slip.exe
1460	Payment slip.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2292 set thread context of 1460	2292	Payment slip.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3896	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2292	Payment slip.exe
2292	Payment slip.exe
2292	Payment slip.exe
2292	Payment slip.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2292	Payment slip.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1460	Payment slip.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 2292	3176	Payment_Slip.jpg.exe	78
PID 3176 wrote to memory of 2292	3176	Payment_Slip.jpg.exe	78
PID 3176 wrote to memory of 2292	3176	Payment_Slip.jpg.exe	78
PID 2292 wrote to memory of 3896	2292	Payment slip.exe	81
PID 2292 wrote to memory of 3896	2292	Payment slip.exe	81
PID 2292 wrote to memory of 3896	2292	Payment slip.exe	81
PID 2292 wrote to memory of 1460	2292	Payment slip.exe	83
PID 2292 wrote to memory of 1460	2292	Payment slip.exe	83
PID 2292 wrote to memory of 1460	2292	Payment slip.exe	83
PID 2292 wrote to memory of 1460	2292	Payment slip.exe	83
PID 2292 wrote to memory of 1460	2292	Payment slip.exe	83
PID 2292 wrote to memory of 1460	2292	Payment slip.exe	83
PID 2292 wrote to memory of 1460	2292	Payment slip.exe	83
PID 2292 wrote to memory of 1460	2292	Payment slip.exe	83
PID 2292 wrote to memory of 1460	2292	Payment slip.exe	83

C:\Users\Admin\AppData\Local\Temp\Payment_Slip.jpg.exe
"C:\Users\Admin\AppData\Local\Temp\Payment_Slip.jpg.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Payment slip.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Payment slip.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yEpnFRa" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB329.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:3896
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Payment slip.exe
    "{path}"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1460-134-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1460-131-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/2292-125-0x0000000007D80000-0x0000000007D81000-memory.dmp

Download

memory/2292-126-0x0000000002D40000-0x0000000002D42000-memory.dmp

Download

memory/2292-127-0x0000000008A10000-0x0000000008ABD000-memory.dmp

Download

memory/2292-128-0x0000000006660000-0x00000000066C0000-memory.dmp

Download

memory/2292-124-0x00000000079D0000-0x00000000079D1000-memory.dmp

Download

memory/2292-123-0x0000000007B70000-0x0000000007B71000-memory.dmp

Download

memory/2292-122-0x0000000007A60000-0x0000000007A61000-memory.dmp

Download

memory/2292-121-0x0000000008070000-0x0000000008071000-memory.dmp

Download

memory/2292-119-0x0000000000A60000-0x0000000000A61000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads