remcos | bb63c61554ccc2caa79eec3705c3e4ce41626e88f375a8a1bc5b514e489b0f04

Analysis

max time kernel
158s
max time network
173s
platform
windows10_x64
resource
win10v20210408
submitted
30/08/2021, 09:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AD Re Order Confirmation-7645,pdf.exe
Size 684KB
Sample210830-55t8ynw232
SHA256 bb63c61554ccc2caa79eec3705c3e4ce41626e88f375a8a1bc5b514e489b0f04
MD5 44ad9e1f56ffbfba3631d687efebaf11
SHA1 be82c83d63d323015982225aebf2acce068ba2bf
SHA512 1ac1c695f1eec632ce2640b2ae6a3f028090960f2bdb135d1eab20030233355bba76992abf4e9ec9f4c35450c7e8020315ed514333990922599e4cf14d993e4f
MD5 SHA1 SHA512

Score

10^/10

remcos new era persistence rat

Malware Config

Extracted

Family

remcos

Botnet

NEW ERA

thankyoulord4real.ddns.net:3030

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-MGW834
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hocthmd = "C:\\Users\\Public\\Libraries\\dmhtcoH.url"	AD Re Order Confirmation-7645,pdf.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
4452	reg.exe
4476	reg.exe
4576	reg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77
PID 636 wrote to memory of 3520	636	AD Re Order Confirmation-7645,pdf.exe	77

C:\Users\Admin\AppData\Local\Temp\AD Re Order Confirmation-7645,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\AD Re Order Confirmation-7645,pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:636
- C:\Users\Admin\AppData\Local\Temp\AD Re Order Confirmation-7645,pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\AD Re Order Confirmation-7645,pdf.exe"
  2⤵
  - Adds Run key to start application
  PID:3520
- - C:\Windows\SysWOW64\mobsync.exe
    C:\Windows\System32\mobsync.exe
    3⤵
    PID:4284
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Trast.bat" "
    3⤵
    PID:4320
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
      4⤵
      PID:4396
    - - C:\Windows\SysWOW64\reg.exe
        
        reg delete hkcu\Environment /v windir /f
        5⤵
        Modifies registry key
        
        PID:4452
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
        5⤵
        Modifies registry key
        
        PID:4476
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
        5⤵
        
        PID:4496
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Public\nest.bat" "
    3⤵
    PID:4524
  - - C:\Windows\SysWOW64\reg.exe
      reg delete hkcu\Environment /v windir /f
      4⤵
      Modifies registry key
      PID:4576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/636-114-0x00000000007A0000-0x00000000007A1000-memory.dmp

Download

memory/636-117-0x0000000010410000-0x000000001042B000-memory.dmp

Download

memory/3520-121-0x0000000000650000-0x0000000000651000-memory.dmp

Download

memory/3520-120-0x00000000001C0000-0x00000000001C1000-memory.dmp

Download

memory/3520-122-0x00000000008C0000-0x0000000000A0A000-memory.dmp

Download

memory/3520-123-0x00000000008C0000-0x0000000000A0A000-memory.dmp

Download

memory/4284-126-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

Download

memory/4284-128-0x0000000010590000-0x000000001060C000-memory.dmp

Download

memory/4284-130-0x00000000042A0000-0x0000000004319000-memory.dmp

Download

memory/4284-129-0x00000000009F0000-0x00000000009F1000-memory.dmp

Download

memory/4284-127-0x0000000002D00000-0x0000000002D01000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads