remcos

General

Target
ceb178a1032f5d768e321db28db24d88.exe
Size 473KB
Sample211008-nyfnvseae9
SHA256 6653d6fb54f51870c3c9bc33e04ffe4a855c1886f3b2f328c2ca7ba5e1f088cf
MD5 ceb178a1032f5d768e321db28db24d88
SHA1 eaba42910a33de266a6347ca7ad4573912145b25
SHA512 764a1d75f931f0852bdeb8a9949486f3292794395449f9e62aac2006a487a4beaba9f92e3595c7a335d54ab047dcb7bdefd6dcd57852609f9cb96f6e56b5ef40
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

NetGeneration

C2

Venonletmonitprradministratioran.loseyourip.com:24091

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
Dlls.exe
copy_folder
Adobes
delete_file
true
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Adobes
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-HCJBCA
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Chrome
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Extracted

Family

remcos

Version

3.3.0 Pro

Botnet

NetGeneration

C2

Venonletmonitprradministratioran.loseyourip.com:24091

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
Dlls.exe
copy_folder
Adobes
delete_file
true
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Adobes
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-HCJBCA
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Chrome
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Targets

- Target
  ceb178a1032f5d768e321db28db24d88.exe
- Size 473KB
- SHA256 6653d6fb54f51870c3c9bc33e04ffe4a855c1886f3b2f328c2ca7ba5e1f088cf
- MD5 ceb178a1032f5d768e321db28db24d88
- SHA1 eaba42910a33de266a6347ca7ad4573912145b25
- SHA512 764a1d75f931f0852bdeb8a9949486f3292794395449f9e62aac2006a487a4beaba9f92e3595c7a335d54ab047dcb7bdefd6dcd57852609f9cb96f6e56b5ef40
- MD5 SHA1 SHA512
Score

10^/10

remcos netgeneration rat persistence
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Adds policy Run key to start application

Executes dropped EXE

Deletes itself

Loads dropped DLL

Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2