remcos | a7f4245d63e1dd21c5af3e0ddf682ac517eda484bf6650f3e0d5d856f4cc68fa

Analysis

max time kernel
154s
max time network
140s
platform
windows10_x64
resource
win10v20210408
submitted
09/10/2021, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b4b8bccd580837d9a1086debe48ccd7e.exe
Size 473KB
Sample211009-sk6qcafcgl
SHA256 a7f4245d63e1dd21c5af3e0ddf682ac517eda484bf6650f3e0d5d856f4cc68fa
MD5 b4b8bccd580837d9a1086debe48ccd7e
SHA1 204223344d400ccad7f29a41d677755e5890395c
SHA512 3ff85e68b93ce120df0232843e1465c249fd4829817d6656a0aa500c3207137f4d68185335ff9dcf903f4050ed72e74b1ccdad0fc950d081fde57633b7619126
MD5 SHA1 SHA512

Score

10^/10

remcos netgeneration persistence rat

Malware Config

Extracted

Family

remcos

Version

3.3.0 Pro

Botnet

NetGeneration

Venonletmonitprradministratioran.loseyourip.com:24091

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
Dlls.exe
copy_folder
Adobes
delete_file
true
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Adobes
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-HCJBCA
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Chrome
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	b4b8bccd580837d9a1086debe48ccd7e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\Adobes\\Dlls.exe\""	b4b8bccd580837d9a1086debe48ccd7e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Dlls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\Adobes\\Dlls.exe\""	Dlls.exe

Executes dropped EXE 2 IoCs

pid	Process
3384	Dlls.exe
700	Dlls.exe

Deletes itself 1 IoCs

pid	Process
724	WScript.exe

Loads dropped DLL 2 IoCs

pid	Process
604	b4b8bccd580837d9a1086debe48ccd7e.exe
3384	Dlls.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\Adobes\\Dlls.exe\""	b4b8bccd580837d9a1086debe48ccd7e.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Dlls.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\Adobes\\Dlls.exe\""	Dlls.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	Dlls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\Adobes\\Dlls.exe\""	Dlls.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\	b4b8bccd580837d9a1086debe48ccd7e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Chrome = "\"C:\\Users\\Admin\\AppData\\Roaming\\Adobes\\Dlls.exe\""	b4b8bccd580837d9a1086debe48ccd7e.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	b4b8bccd580837d9a1086debe48ccd7e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 6 IoCs

installer

resource	yara_rule
behavioral2/files/0x000100000001ab47-126.dat	nsis_installer_1
behavioral2/files/0x000100000001ab47-126.dat	nsis_installer_2
behavioral2/files/0x000100000001ab47-127.dat	nsis_installer_1
behavioral2/files/0x000100000001ab47-127.dat	nsis_installer_2
behavioral2/files/0x000100000001ab47-131.dat	nsis_installer_1
behavioral2/files/0x000100000001ab47-131.dat	nsis_installer_2

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	b4b8bccd580837d9a1086debe48ccd7e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
700	Dlls.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 604 wrote to memory of 3356	604	b4b8bccd580837d9a1086debe48ccd7e.exe	73
PID 604 wrote to memory of 3356	604	b4b8bccd580837d9a1086debe48ccd7e.exe	73
PID 604 wrote to memory of 3356	604	b4b8bccd580837d9a1086debe48ccd7e.exe	73
PID 604 wrote to memory of 3356	604	b4b8bccd580837d9a1086debe48ccd7e.exe	73
PID 604 wrote to memory of 3356	604	b4b8bccd580837d9a1086debe48ccd7e.exe	73
PID 604 wrote to memory of 3356	604	b4b8bccd580837d9a1086debe48ccd7e.exe	73
PID 604 wrote to memory of 3356	604	b4b8bccd580837d9a1086debe48ccd7e.exe	73
PID 604 wrote to memory of 3356	604	b4b8bccd580837d9a1086debe48ccd7e.exe	73
PID 604 wrote to memory of 3356	604	b4b8bccd580837d9a1086debe48ccd7e.exe	73
PID 604 wrote to memory of 3356	604	b4b8bccd580837d9a1086debe48ccd7e.exe	73
PID 604 wrote to memory of 3356	604	b4b8bccd580837d9a1086debe48ccd7e.exe	73
PID 604 wrote to memory of 3356	604	b4b8bccd580837d9a1086debe48ccd7e.exe	73
PID 3356 wrote to memory of 724	3356	b4b8bccd580837d9a1086debe48ccd7e.exe	74
PID 3356 wrote to memory of 724	3356	b4b8bccd580837d9a1086debe48ccd7e.exe	74
PID 3356 wrote to memory of 724	3356	b4b8bccd580837d9a1086debe48ccd7e.exe	74
PID 724 wrote to memory of 2208	724	WScript.exe	75
PID 724 wrote to memory of 2208	724	WScript.exe	75
PID 724 wrote to memory of 2208	724	WScript.exe	75
PID 2208 wrote to memory of 3384	2208	cmd.exe	77
PID 2208 wrote to memory of 3384	2208	cmd.exe	77
PID 2208 wrote to memory of 3384	2208	cmd.exe	77
PID 3384 wrote to memory of 700	3384	Dlls.exe	78
PID 3384 wrote to memory of 700	3384	Dlls.exe	78
PID 3384 wrote to memory of 700	3384	Dlls.exe	78
PID 3384 wrote to memory of 700	3384	Dlls.exe	78
PID 3384 wrote to memory of 700	3384	Dlls.exe	78
PID 3384 wrote to memory of 700	3384	Dlls.exe	78
PID 3384 wrote to memory of 700	3384	Dlls.exe	78
PID 3384 wrote to memory of 700	3384	Dlls.exe	78
PID 3384 wrote to memory of 700	3384	Dlls.exe	78
PID 3384 wrote to memory of 700	3384	Dlls.exe	78
PID 3384 wrote to memory of 700	3384	Dlls.exe	78
PID 3384 wrote to memory of 700	3384	Dlls.exe	78

C:\Users\Admin\AppData\Local\Temp\b4b8bccd580837d9a1086debe48ccd7e.exe
"C:\Users\Admin\AppData\Local\Temp\b4b8bccd580837d9a1086debe48ccd7e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:604
- C:\Users\Admin\AppData\Local\Temp\b4b8bccd580837d9a1086debe48ccd7e.exe
  "C:\Users\Admin\AppData\Local\Temp\b4b8bccd580837d9a1086debe48ccd7e.exe"
  2⤵
  - Adds policy Run key to start application
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:724
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\Adobes\Dlls.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2208
    - - C:\Users\Admin\AppData\Roaming\Adobes\Dlls.exe
        
        C:\Users\Admin\AppData\Roaming\Adobes\Dlls.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:3384
      - C:\Users\Admin\AppData\Roaming\Adobes\Dlls.exe
        
        C:\Users\Admin\AppData\Roaming\Adobes\Dlls.exe
        6⤵
        Adds policy Run key to start application
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/700-137-0x0000000000440000-0x00000000004B9000-memory.dmp

Download

memory/3356-121-0x0000000000440000-0x00000000004B9000-memory.dmp

Download

memory/3356-116-0x0000000000440000-0x00000000004B9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads