remcos | 37cc8d06cb1500b90001e9307464c2f7a2d603c54ef604db7b840b635900d365

Analysis

max time kernel
149s
max time network
149s
platform
windows10_x64
resource
win10-en-20210920
submitted
27/09/2021, 15:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe
Size 985KB
Sample210927-swcxeahddj
SHA256 37cc8d06cb1500b90001e9307464c2f7a2d603c54ef604db7b840b635900d365
MD5 93bc502c19f1b3499d86f67f95689d90
SHA1 67316d2fa690e110668fe7d1a78ae5615bd03ea5
SHA512 abcade0008dcd5414466637e50ddbb4ada2db8352ec93b1de7db72948102a67f66ddaa8cfab4804828b7edff1a538a1a83147dbd8d33c8f64dda9663fbc67751
MD5 SHA1 SHA512

Score

10^/10

remcos remotehost persistence rat suricata

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

ongod4life.ddns.net:4336

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-UHUWMR
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
suricata: ET MALWARE Remocs 3.x Unencrypted Checkin
suricata: ET MALWARE Remocs 3.x Unencrypted Checkin
suricata
suricata: ET MALWARE Remocs 3.x Unencrypted Server Response
suricata: ET MALWARE Remocs 3.x Unencrypted Server Response
suricata

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hqkwpjo = "C:\\Users\\Public\\Libraries\\ojpwkqH.url"	PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
508	reg.exe
1668	reg.exe
4544	reg.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 4092	3608	PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe	70
PID 3608 wrote to memory of 4092	3608	PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe	70
PID 3608 wrote to memory of 4092	3608	PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe	70
PID 3608 wrote to memory of 4092	3608	PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe	70
PID 3608 wrote to memory of 4092	3608	PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe	70
PID 3608 wrote to memory of 4092	3608	PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe	70
PID 3608 wrote to memory of 4092	3608	PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe	70
PID 3608 wrote to memory of 4092	3608	PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe	70
PID 3608 wrote to memory of 4092	3608	PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe	70
PID 3608 wrote to memory of 4092	3608	PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe	70
PID 3608 wrote to memory of 4092	3608	PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe	70
PID 3608 wrote to memory of 4092	3608	PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe	70
PID 3608 wrote to memory of 4092	3608	PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe	70
PID 3608 wrote to memory of 4092	3608	PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe	70
PID 3608 wrote to memory of 4092	3608	PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe	70
PID 3608 wrote to memory of 4092	3608	PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe	70
PID 3608 wrote to memory of 4092	3608	PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe	70
PID 3608 wrote to memory of 4072	3608	PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe	71
PID 3608 wrote to memory of 4072	3608	PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe	71
PID 3608 wrote to memory of 4072	3608	PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe	71
PID 4072 wrote to memory of 4344	4072	cmd.exe	73
PID 4072 wrote to memory of 4344	4072	cmd.exe	73
PID 4072 wrote to memory of 4344	4072	cmd.exe	73
PID 4344 wrote to memory of 1668	4344	cmd.exe	75
PID 4344 wrote to memory of 1668	4344	cmd.exe	75
PID 4344 wrote to memory of 1668	4344	cmd.exe	75
PID 4344 wrote to memory of 4544	4344	cmd.exe	76
PID 4344 wrote to memory of 4544	4344	cmd.exe	76
PID 4344 wrote to memory of 4544	4344	cmd.exe	76
PID 4344 wrote to memory of 4624	4344	cmd.exe	77
PID 4344 wrote to memory of 4624	4344	cmd.exe	77
PID 4344 wrote to memory of 4624	4344	cmd.exe	77
PID 3608 wrote to memory of 4596	3608	PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe	78
PID 3608 wrote to memory of 4596	3608	PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe	78
PID 3608 wrote to memory of 4596	3608	PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe	78
PID 4596 wrote to memory of 508	4596	cmd.exe	80
PID 4596 wrote to memory of 508	4596	cmd.exe	80
PID 4596 wrote to memory of 508	4596	cmd.exe	80

C:\Users\Admin\AppData\Local\Temp\PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\PO CONSULTA DE PEDIDOS DE TEXOPOL,pdf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\SysWOW64\mobsync.exe
  "C:\Windows\System32\mobsync.exe"
  2⤵
  PID:4092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Trast.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\Windows\SysWOW64\reg.exe
      reg delete hkcu\Environment /v windir /f
      4⤵
      Modifies registry key
      PID:1668
  - - C:\Windows\SysWOW64\reg.exe
      reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
      4⤵
      Modifies registry key
      PID:4544
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
      4⤵
      PID:4624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\nest.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\SysWOW64\reg.exe
    reg delete hkcu\Environment /v windir /f
    3⤵
    - Modifies registry key
    PID:508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3608-116-0x0000000000650000-0x000000000079A000-memory.dmp

Download

memory/4092-119-0x0000000000A60000-0x0000000000A61000-memory.dmp

Download

memory/4092-123-0x0000000050600000-0x000000005067C000-memory.dmp

Download

memory/4092-122-0x0000000000B50000-0x0000000000B51000-memory.dmp

Download

memory/4092-121-0x0000000000B20000-0x0000000000B21000-memory.dmp

Download

memory/4092-120-0x0000000004110000-0x0000000004189000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads