remcos | 5033129de4258592effa6f57ddb97aa1028fae4ed9a6075654bb56f9be84d329

General

Target

RFQ_PO_08361284,pdf.exe
Size

1.0MB
MD5

208d83597e8525b0868eaec636024d32
SHA1

613799e5457c8493276f96d25c05d054d3af5091
SHA256

76fd257f51e11637d0fb987ccd4c94d46b8a0d6d7f46d2785f836f912d63362f
SHA512

75fbface481124fee0d7f62020d91e8564bd415479ac62ae97f0db0f2a5251224c2e5065c4bf808b0db55b728de3863b784071a9aba33bfa373dba99d1236bb3

Score

10^/10

remcos ok man persistence rat

Malware Config

Extracted

Family

remcos

Botnet

OK MAN

C2

zion6.ddns.net:2815

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-MPN2RF
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RFQ_PO_08361284,pdf.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bfbenum = "C:\\Users\\Public\\Libraries\\munebfB.url"	RFQ_PO_08361284,pdf.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

RFQ_PO_08361284,pdf.exe

description	pid	process	target process
PID 2044 wrote to memory of 1976	2044	RFQ_PO_08361284,pdf.exe	mobsync.exe
PID 2044 wrote to memory of 1976	2044	RFQ_PO_08361284,pdf.exe	mobsync.exe
PID 2044 wrote to memory of 1976	2044	RFQ_PO_08361284,pdf.exe	mobsync.exe
PID 2044 wrote to memory of 1976	2044	RFQ_PO_08361284,pdf.exe	mobsync.exe
PID 2044 wrote to memory of 1976	2044	RFQ_PO_08361284,pdf.exe	mobsync.exe
PID 2044 wrote to memory of 1976	2044	RFQ_PO_08361284,pdf.exe	mobsync.exe
PID 2044 wrote to memory of 1976	2044	RFQ_PO_08361284,pdf.exe	mobsync.exe
PID 2044 wrote to memory of 1976	2044	RFQ_PO_08361284,pdf.exe	mobsync.exe
PID 2044 wrote to memory of 1976	2044	RFQ_PO_08361284,pdf.exe	mobsync.exe
PID 2044 wrote to memory of 1976	2044	RFQ_PO_08361284,pdf.exe	mobsync.exe
PID 2044 wrote to memory of 1976	2044	RFQ_PO_08361284,pdf.exe	mobsync.exe
PID 2044 wrote to memory of 1976	2044	RFQ_PO_08361284,pdf.exe	mobsync.exe
PID 2044 wrote to memory of 1976	2044	RFQ_PO_08361284,pdf.exe	mobsync.exe
PID 2044 wrote to memory of 1976	2044	RFQ_PO_08361284,pdf.exe	mobsync.exe
PID 2044 wrote to memory of 1976	2044	RFQ_PO_08361284,pdf.exe	mobsync.exe
PID 2044 wrote to memory of 1976	2044	RFQ_PO_08361284,pdf.exe	mobsync.exe

C:\Users\Admin\AppData\Local\Temp\RFQ_PO_08361284,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ_PO_08361284,pdf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\mobsync.exe
C:\Windows\System32\mobsync.exe
2⤵
PID:1976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1976-61-0x0000000000000000-mapping.dmp

Download
memory/1976-64-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1976-63-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1976-65-0x0000000010590000-0x000000001060D000-memory.dmp

Filesize
500KB

Download
memory/1976-66-0x0000000000410000-0x000000000048A000-memory.dmp

Filesize
488KB

Download
memory/1976-67-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2044-59-0x0000000075D11000-0x0000000075D13000-memory.dmp

Filesize
8KB

Download
memory/2044-60-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing