remcos | 5118bcfda155a19a27cfafea90a66f11624a11b8abcf00b300d544da0b73aea9

General

Target

HOH76746.js
Size

1.7MB
MD5

e261e68bcae0c10642170416082702b7
SHA1

6c9b48b65090ec13326a07bef72b1c3995f72513
SHA256

f126bcd906ba8815594cd987e4ba8852bccd58d813ac415a626e66ab5a395db2
SHA512

05979d43fee175648476accc5562a02c9736337e21ca850ce893791365f5b54f55f9b6813cc0a20d2781ba09c16b6425ee01cb853ab546e049bc1e7e03dd8818

Score

10^/10

remcos vjw0rm 250million persistence rat trojan worm

Malware Config

Extracted

Family

remcos

Version

3.2.0 Pro

Botnet

250million

C2

www.ommi-it.com:8760

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
250million-2CWGNX
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 32 IoCs

Processes:

wscript.exe

flow	pid	process
8	1212	wscript.exe
11	1212	wscript.exe
12	1212	wscript.exe
16	1212	wscript.exe
19	1212	wscript.exe
20	1212	wscript.exe
24	1212	wscript.exe
27	1212	wscript.exe
29	1212	wscript.exe
32	1212	wscript.exe
35	1212	wscript.exe
38	1212	wscript.exe
40	1212	wscript.exe
43	1212	wscript.exe
46	1212	wscript.exe
48	1212	wscript.exe
51	1212	wscript.exe
54	1212	wscript.exe
57	1212	wscript.exe
59	1212	wscript.exe
62	1212	wscript.exe
66	1212	wscript.exe
67	1212	wscript.exe
70	1212	wscript.exe
74	1212	wscript.exe
77	1212	wscript.exe
78	1212	wscript.exe
82	1212	wscript.exe
85	1212	wscript.exe
86	1212	wscript.exe
90	1212	wscript.exe
93	1212	wscript.exe

Executes dropped EXE 1 IoCs

Processes:

250million.exe

pid process

1960 250million.exe

pid	process
1960	250million.exe

Drops startup file 2 IoCs

Processes:

wscript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OrmKzxDqEk.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OrmKzxDqEk.js	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wscript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\0HKX5ALWLG = "\"C:\\Users\\Admin\\AppData\\Roaming\\OrmKzxDqEk.js\""	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

wscript.exe

description	pid	process	target process
PID 1632 wrote to memory of 1212	1632	wscript.exe	wscript.exe
PID 1632 wrote to memory of 1212	1632	wscript.exe	wscript.exe
PID 1632 wrote to memory of 1212	1632	wscript.exe	wscript.exe
PID 1632 wrote to memory of 1960	1632	wscript.exe	250million.exe
PID 1632 wrote to memory of 1960	1632	wscript.exe	250million.exe
PID 1632 wrote to memory of 1960	1632	wscript.exe	250million.exe
PID 1632 wrote to memory of 1960	1632	wscript.exe	250million.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\HOH76746.js
1⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\System32\wscript.exe
"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\OrmKzxDqEk.js"
2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:1212

C:\Users\Admin\AppData\Roaming\250million.exe
"C:\Users\Admin\AppData\Roaming\250million.exe"
2⤵
- Executes dropped EXE
PID:1960

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:908

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\250million.exe
MD5
d9569e6f7afd3afb9debc99245595adb

SHA1
b3e25ed7212be6a1fb0567a14fe9385941086794

SHA256
e3f38af5cd488978bbc4156eb62e881c04df48055f5e6819eabcca429c9051d7

SHA512
f195cebe98d30bb2a0ca7c07cd984a22cd201288d75e15f000ff41d901f09f825a591d71e4799ab320892b8625a62196e792ce57eb618ef6b3ceb826a8bb9a21

Download Submit
C:\Users\Admin\AppData\Roaming\OrmKzxDqEk.js
MD5
4ddac2fa49c2f9f17a5faad271025659

SHA1
575f942637af4b6e75eba0d046acd7ab67914714

SHA256
810c2f963f1741e83aae85cd7e93a99435557f230966cb6632ca405e9482df34

SHA512
d26169bd1430337a6dc27b2a75238108701c670bafb52b44f9d07ef70e3dd0b0d385009d7317e06ab159e6be0b41c1c6e356a82e8cb9c88ebd68fbcb77a2bd2f

Download Submit
memory/1212-61-0x0000000000000000-mapping.dmp

Download
memory/1632-60-0x000007FEFBAB1000-0x000007FEFBAB3000-memory.dmp

Filesize
8KB

Download
memory/1960-63-0x0000000000000000-mapping.dmp

Download
memory/1960-65-0x0000000075411000-0x0000000075413000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads