remcos | 6653d6fb54f51870c3c9bc33e04ffe4a855c1886f3b2f328c2ca7ba5e1f088cf

Analysis

max time kernel
153s
max time network
140s
platform
windows10_x64
resource
win10v20210408
submitted
08/10/2021, 11:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ceb178a1032f5d768e321db28db24d88.exe
Size 473KB
Sample211008-nyfnvseae9
SHA256 6653d6fb54f51870c3c9bc33e04ffe4a855c1886f3b2f328c2ca7ba5e1f088cf
MD5 ceb178a1032f5d768e321db28db24d88
SHA1 eaba42910a33de266a6347ca7ad4573912145b25
SHA512 764a1d75f931f0852bdeb8a9949486f3292794395449f9e62aac2006a487a4beaba9f92e3595c7a335d54ab047dcb7bdefd6dcd57852609f9cb96f6e56b5ef40
MD5 SHA1 SHA512

Score

10^/10

remcos netgeneration persistence rat

Malware Config

Extracted

Family

remcos

Version

3.3.0 Pro

Botnet

NetGeneration

Venonletmonitprradministratioran.loseyourip.com:24091

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
Dlls.exe
copy_folder
Adobes
delete_file
true
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Adobes
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-HCJBCA
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Chrome
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\Adobes\\Dlls.exe\""	ceb178a1032f5d768e321db28db24d88.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Dlls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\Adobes\\Dlls.exe\""	Dlls.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ceb178a1032f5d768e321db28db24d88.exe

Executes dropped EXE 2 IoCs

pid	Process
2400	Dlls.exe
1312	Dlls.exe

Deletes itself 1 IoCs

pid	Process
1228	WScript.exe

Loads dropped DLL 2 IoCs

pid	Process
800	ceb178a1032f5d768e321db28db24d88.exe
2400	Dlls.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\Adobes\\Dlls.exe\""	ceb178a1032f5d768e321db28db24d88.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	ceb178a1032f5d768e321db28db24d88.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\Adobes\\Dlls.exe\""	ceb178a1032f5d768e321db28db24d88.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Dlls.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\Adobes\\Dlls.exe\""	Dlls.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	Dlls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\Adobes\\Dlls.exe\""	Dlls.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\	ceb178a1032f5d768e321db28db24d88.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

resource	yara_rule
behavioral2/files/0x000100000001ab45-126.dat	nsis_installer_1
behavioral2/files/0x000100000001ab45-126.dat	nsis_installer_2
behavioral2/files/0x000100000001ab45-127.dat	nsis_installer_1
behavioral2/files/0x000100000001ab45-127.dat	nsis_installer_2
behavioral2/files/0x000100000001ab45-131.dat	nsis_installer_1
behavioral2/files/0x000100000001ab45-131.dat	nsis_installer_2

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	ceb178a1032f5d768e321db28db24d88.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1312	Dlls.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 2952	800	ceb178a1032f5d768e321db28db24d88.exe	72
PID 800 wrote to memory of 2952	800	ceb178a1032f5d768e321db28db24d88.exe	72
PID 800 wrote to memory of 2952	800	ceb178a1032f5d768e321db28db24d88.exe	72
PID 800 wrote to memory of 2952	800	ceb178a1032f5d768e321db28db24d88.exe	72
PID 800 wrote to memory of 2952	800	ceb178a1032f5d768e321db28db24d88.exe	72
PID 800 wrote to memory of 2952	800	ceb178a1032f5d768e321db28db24d88.exe	72
PID 800 wrote to memory of 2952	800	ceb178a1032f5d768e321db28db24d88.exe	72
PID 800 wrote to memory of 2952	800	ceb178a1032f5d768e321db28db24d88.exe	72
PID 800 wrote to memory of 2952	800	ceb178a1032f5d768e321db28db24d88.exe	72
PID 800 wrote to memory of 2952	800	ceb178a1032f5d768e321db28db24d88.exe	72
PID 800 wrote to memory of 2952	800	ceb178a1032f5d768e321db28db24d88.exe	72
PID 800 wrote to memory of 2952	800	ceb178a1032f5d768e321db28db24d88.exe	72
PID 2952 wrote to memory of 1228	2952	ceb178a1032f5d768e321db28db24d88.exe	74
PID 2952 wrote to memory of 1228	2952	ceb178a1032f5d768e321db28db24d88.exe	74
PID 2952 wrote to memory of 1228	2952	ceb178a1032f5d768e321db28db24d88.exe	74
PID 1228 wrote to memory of 1480	1228	WScript.exe	75
PID 1228 wrote to memory of 1480	1228	WScript.exe	75
PID 1228 wrote to memory of 1480	1228	WScript.exe	75
PID 1480 wrote to memory of 2400	1480	cmd.exe	77
PID 1480 wrote to memory of 2400	1480	cmd.exe	77
PID 1480 wrote to memory of 2400	1480	cmd.exe	77
PID 2400 wrote to memory of 1312	2400	Dlls.exe	78
PID 2400 wrote to memory of 1312	2400	Dlls.exe	78
PID 2400 wrote to memory of 1312	2400	Dlls.exe	78
PID 2400 wrote to memory of 1312	2400	Dlls.exe	78
PID 2400 wrote to memory of 1312	2400	Dlls.exe	78
PID 2400 wrote to memory of 1312	2400	Dlls.exe	78
PID 2400 wrote to memory of 1312	2400	Dlls.exe	78
PID 2400 wrote to memory of 1312	2400	Dlls.exe	78
PID 2400 wrote to memory of 1312	2400	Dlls.exe	78
PID 2400 wrote to memory of 1312	2400	Dlls.exe	78
PID 2400 wrote to memory of 1312	2400	Dlls.exe	78
PID 2400 wrote to memory of 1312	2400	Dlls.exe	78

C:\Users\Admin\AppData\Local\Temp\ceb178a1032f5d768e321db28db24d88.exe
"C:\Users\Admin\AppData\Local\Temp\ceb178a1032f5d768e321db28db24d88.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:800
- C:\Users\Admin\AppData\Local\Temp\ceb178a1032f5d768e321db28db24d88.exe
  "C:\Users\Admin\AppData\Local\Temp\ceb178a1032f5d768e321db28db24d88.exe"
  2⤵
  - Adds policy Run key to start application
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:1228
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Adobes\Dlls.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1480
    - - C:\Users\Admin\AppData\Roaming\Adobes\Dlls.exe
        
        C:\Users\Admin\AppData\Roaming\Adobes\Dlls.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2400
      - C:\Users\Admin\AppData\Roaming\Adobes\Dlls.exe
        
        C:\Users\Admin\AppData\Roaming\Adobes\Dlls.exe
        6⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:1312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1312-137-0x0000000000440000-0x00000000004B9000-memory.dmp

Download

memory/2952-121-0x0000000000440000-0x00000000004B9000-memory.dmp

Download

memory/2952-116-0x0000000000440000-0x00000000004B9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads