remcos | 7162fc24e700f042d19b8f08a42c91bfae05f2a08c66df2bb4cb3d8e8635e475

Analysis

max time kernel
151s
max time network
151s
platform
windows10_x64
resource
win10v20210408
submitted
20/07/2021, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dc71ed81724056f7ee199d098356e155.exe
Size 702KB
Sample210720-832prf183s
SHA256 7162fc24e700f042d19b8f08a42c91bfae05f2a08c66df2bb4cb3d8e8635e475
MD5 dc71ed81724056f7ee199d098356e155
SHA1 d4c92dbec92c5ef658a12664f8eeef2ceb9f29d9
SHA512 609ac31917d44cbae8b745d58e700a3930c03e498281b75df7ab66a10036c14230b5eba6ec2df38b72e9cfcccbd81ef017aff9e3cf76092bb51eba63c4f83a7c
MD5 SHA1 SHA512

Score

10^/10

remcos p'salm 55 2p's persistence rat

Malware Config

Extracted

Family

remcos

Version

3.1.5 Pro

Botnet

P'salm 55 2P's

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
true.exe
copy_folder
true
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
winlogs.dat
keylog_flag
false
keylog_folder
winloga
keylog_path
%AppData%
mouse_option
false
mutex
true-meta-EN2Y0Z
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
true
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ouioees = "C:\\Users\\Public\\Libraries\\seeoiuO.url"	dc71ed81724056f7ee199d098356e155.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4084	4652	WerFault.exe	67

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
1108	reg.exe
1220	reg.exe
1860	reg.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4084	WerFault.exe
4084	WerFault.exe
4084	WerFault.exe
4084	WerFault.exe
4084	WerFault.exe
4084	WerFault.exe
4084	WerFault.exe
4084	WerFault.exe
4084	WerFault.exe
4084	WerFault.exe
4084	WerFault.exe
4084	WerFault.exe
4084	WerFault.exe
4084	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	4084	WerFault.exe
Token: SeBackupPrivilege	4084	WerFault.exe
Token: SeDebugPrivilege	4084	WerFault.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 2212	4652	dc71ed81724056f7ee199d098356e155.exe	80
PID 4652 wrote to memory of 2212	4652	dc71ed81724056f7ee199d098356e155.exe	80
PID 4652 wrote to memory of 2212	4652	dc71ed81724056f7ee199d098356e155.exe	80
PID 4652 wrote to memory of 2212	4652	dc71ed81724056f7ee199d098356e155.exe	80
PID 4652 wrote to memory of 2212	4652	dc71ed81724056f7ee199d098356e155.exe	80
PID 4652 wrote to memory of 2212	4652	dc71ed81724056f7ee199d098356e155.exe	80
PID 4652 wrote to memory of 2212	4652	dc71ed81724056f7ee199d098356e155.exe	80
PID 4652 wrote to memory of 2212	4652	dc71ed81724056f7ee199d098356e155.exe	80
PID 4652 wrote to memory of 2212	4652	dc71ed81724056f7ee199d098356e155.exe	80
PID 4652 wrote to memory of 2212	4652	dc71ed81724056f7ee199d098356e155.exe	80
PID 4652 wrote to memory of 2212	4652	dc71ed81724056f7ee199d098356e155.exe	80
PID 4652 wrote to memory of 2212	4652	dc71ed81724056f7ee199d098356e155.exe	80
PID 4652 wrote to memory of 2212	4652	dc71ed81724056f7ee199d098356e155.exe	80
PID 4652 wrote to memory of 2212	4652	dc71ed81724056f7ee199d098356e155.exe	80
PID 4652 wrote to memory of 2212	4652	dc71ed81724056f7ee199d098356e155.exe	80
PID 4652 wrote to memory of 580	4652	dc71ed81724056f7ee199d098356e155.exe	81
PID 4652 wrote to memory of 580	4652	dc71ed81724056f7ee199d098356e155.exe	81
PID 4652 wrote to memory of 580	4652	dc71ed81724056f7ee199d098356e155.exe	81
PID 580 wrote to memory of 1012	580	cmd.exe	83
PID 580 wrote to memory of 1012	580	cmd.exe	83
PID 580 wrote to memory of 1012	580	cmd.exe	83
PID 1012 wrote to memory of 1108	1012	cmd.exe	85
PID 1012 wrote to memory of 1108	1012	cmd.exe	85
PID 1012 wrote to memory of 1108	1012	cmd.exe	85
PID 1012 wrote to memory of 1220	1012	cmd.exe	86
PID 1012 wrote to memory of 1220	1012	cmd.exe	86
PID 1012 wrote to memory of 1220	1012	cmd.exe	86
PID 1012 wrote to memory of 1380	1012	cmd.exe	87
PID 1012 wrote to memory of 1380	1012	cmd.exe	87
PID 1012 wrote to memory of 1380	1012	cmd.exe	87
PID 4652 wrote to memory of 1580	4652	dc71ed81724056f7ee199d098356e155.exe	88
PID 4652 wrote to memory of 1580	4652	dc71ed81724056f7ee199d098356e155.exe	88
PID 4652 wrote to memory of 1580	4652	dc71ed81724056f7ee199d098356e155.exe	88
PID 1580 wrote to memory of 1860	1580	cmd.exe	90
PID 1580 wrote to memory of 1860	1580	cmd.exe	90
PID 1580 wrote to memory of 1860	1580	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\dc71ed81724056f7ee199d098356e155.exe
"C:\Users\Admin\AppData\Local\Temp\dc71ed81724056f7ee199d098356e155.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 1260
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4084
- C:\Windows\SysWOW64\mobsync.exe
  C:\Windows\System32\mobsync.exe
  2⤵
  PID:2212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Trast.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:580
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1012
  - - C:\Windows\SysWOW64\reg.exe
      reg delete hkcu\Environment /v windir /f
      4⤵
      Modifies registry key
      PID:1108
  - - C:\Windows\SysWOW64\reg.exe
      reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
      4⤵
      Modifies registry key
      PID:1220
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
      4⤵
      PID:1380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\nest.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\SysWOW64\reg.exe
    reg delete hkcu\Environment /v windir /f
    3⤵
    - Modifies registry key
    PID:1860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2212-124-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Download

memory/2212-123-0x0000000000A50000-0x0000000000A51000-memory.dmp

Download

memory/2212-126-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/2212-125-0x0000000010590000-0x000000001060C000-memory.dmp

Download

memory/2212-127-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4652-114-0x00000000022F0000-0x00000000022F1000-memory.dmp

Download