remcos

General

Target
b4b8bccd580837d9a1086debe48ccd7e.exe
Size 473KB
Sample211009-sk6qcafcgl
SHA256 a7f4245d63e1dd21c5af3e0ddf682ac517eda484bf6650f3e0d5d856f4cc68fa
MD5 b4b8bccd580837d9a1086debe48ccd7e
SHA1 204223344d400ccad7f29a41d677755e5890395c
SHA512 3ff85e68b93ce120df0232843e1465c249fd4829817d6656a0aa500c3207137f4d68185335ff9dcf903f4050ed72e74b1ccdad0fc950d081fde57633b7619126
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

remcos

Botnet

NetGeneration

C2

Venonletmonitprradministratioran.loseyourip.com:24091

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
Dlls.exe
copy_folder
Adobes
delete_file
true
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Adobes
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-HCJBCA
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Chrome
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Extracted

Family

remcos

Version

3.3.0 Pro

Botnet

NetGeneration

C2

Venonletmonitprradministratioran.loseyourip.com:24091

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
Dlls.exe
copy_folder
Adobes
delete_file
true
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Adobes
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-HCJBCA
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Chrome
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Targets

- Target
  b4b8bccd580837d9a1086debe48ccd7e.exe
- Size 473KB
- SHA256 a7f4245d63e1dd21c5af3e0ddf682ac517eda484bf6650f3e0d5d856f4cc68fa
- MD5 b4b8bccd580837d9a1086debe48ccd7e
- SHA1 204223344d400ccad7f29a41d677755e5890395c
- SHA512 3ff85e68b93ce120df0232843e1465c249fd4829817d6656a0aa500c3207137f4d68185335ff9dcf903f4050ed72e74b1ccdad0fc950d081fde57633b7619126
- MD5 SHA1 SHA512
Score

10^/10

remcos netgeneration rat persistence
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Adds policy Run key to start application
  persistence
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Adds policy Run key to start application

Executes dropped EXE

Deletes itself

Loads dropped DLL

Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2