remcos | cd43f136f1d3221cd64fc792a37744dfa9656a9ea5889e52929275c05eb4e33b

Analysis

max time kernel
154s
max time network
149s
platform
windows10_x64
resource
win10-en-20210920
submitted
12/10/2021, 08:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
from-iso_BELGE ALIS IRSALIYESINI DHL_119040,PDF.EXE
Size 1.0MB
Sample211012-kg4gtabhf2
SHA256 cd43f136f1d3221cd64fc792a37744dfa9656a9ea5889e52929275c05eb4e33b
MD5 70d2357b4e9d5ecf392ee6c0deb4c3c5
SHA1 0dc4240f1e94e0d3b779d4b78ecb72bbf7de1ecc
SHA512 62e297daac51398c7aa2bced3366db13dfc54c18e56413df274b38578be67e888eaca9116c854e03bb0eee56c2c926fdb40f5b26f1bcf797f456bf029a6b2839
MD5 SHA1 SHA512

Score

10^/10

remcos asedeybe persistence rat

Malware Config

Extracted

Family

remcos

Version

3.3.0 Pro

Botnet

ASEDEYBE

blowmymind.hopto.org:7676

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-988OC2
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hqusrqr = "C:\\Users\\Public\\Libraries\\rqrsuqH.url"	from-iso_BELGE ALIS IRSALIYESINI DHL_119040,PDF.EXE

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
1800	reg.exe
604	reg.exe
1628	reg.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2196	2136	from-iso_BELGE ALIS IRSALIYESINI DHL_119040,PDF.EXE	71
PID 2136 wrote to memory of 2196	2136	from-iso_BELGE ALIS IRSALIYESINI DHL_119040,PDF.EXE	71
PID 2136 wrote to memory of 2196	2136	from-iso_BELGE ALIS IRSALIYESINI DHL_119040,PDF.EXE	71
PID 2136 wrote to memory of 2196	2136	from-iso_BELGE ALIS IRSALIYESINI DHL_119040,PDF.EXE	71
PID 2136 wrote to memory of 2196	2136	from-iso_BELGE ALIS IRSALIYESINI DHL_119040,PDF.EXE	71
PID 2136 wrote to memory of 2196	2136	from-iso_BELGE ALIS IRSALIYESINI DHL_119040,PDF.EXE	71
PID 2136 wrote to memory of 2196	2136	from-iso_BELGE ALIS IRSALIYESINI DHL_119040,PDF.EXE	71
PID 2136 wrote to memory of 2196	2136	from-iso_BELGE ALIS IRSALIYESINI DHL_119040,PDF.EXE	71
PID 2136 wrote to memory of 2196	2136	from-iso_BELGE ALIS IRSALIYESINI DHL_119040,PDF.EXE	71
PID 2136 wrote to memory of 2196	2136	from-iso_BELGE ALIS IRSALIYESINI DHL_119040,PDF.EXE	71
PID 2136 wrote to memory of 2196	2136	from-iso_BELGE ALIS IRSALIYESINI DHL_119040,PDF.EXE	71
PID 2136 wrote to memory of 2196	2136	from-iso_BELGE ALIS IRSALIYESINI DHL_119040,PDF.EXE	71
PID 2136 wrote to memory of 2196	2136	from-iso_BELGE ALIS IRSALIYESINI DHL_119040,PDF.EXE	71
PID 2136 wrote to memory of 2196	2136	from-iso_BELGE ALIS IRSALIYESINI DHL_119040,PDF.EXE	71
PID 2136 wrote to memory of 2196	2136	from-iso_BELGE ALIS IRSALIYESINI DHL_119040,PDF.EXE	71
PID 2136 wrote to memory of 436	2136	from-iso_BELGE ALIS IRSALIYESINI DHL_119040,PDF.EXE	72
PID 2136 wrote to memory of 436	2136	from-iso_BELGE ALIS IRSALIYESINI DHL_119040,PDF.EXE	72
PID 2136 wrote to memory of 436	2136	from-iso_BELGE ALIS IRSALIYESINI DHL_119040,PDF.EXE	72
PID 436 wrote to memory of 2856	436	cmd.exe	74
PID 436 wrote to memory of 2856	436	cmd.exe	74
PID 436 wrote to memory of 2856	436	cmd.exe	74
PID 2856 wrote to memory of 1800	2856	cmd.exe	76
PID 2856 wrote to memory of 1800	2856	cmd.exe	76
PID 2856 wrote to memory of 1800	2856	cmd.exe	76
PID 2856 wrote to memory of 604	2856	cmd.exe	77
PID 2856 wrote to memory of 604	2856	cmd.exe	77
PID 2856 wrote to memory of 604	2856	cmd.exe	77
PID 2856 wrote to memory of 1124	2856	cmd.exe	78
PID 2856 wrote to memory of 1124	2856	cmd.exe	78
PID 2856 wrote to memory of 1124	2856	cmd.exe	78
PID 2136 wrote to memory of 1080	2136	from-iso_BELGE ALIS IRSALIYESINI DHL_119040,PDF.EXE	79
PID 2136 wrote to memory of 1080	2136	from-iso_BELGE ALIS IRSALIYESINI DHL_119040,PDF.EXE	79
PID 2136 wrote to memory of 1080	2136	from-iso_BELGE ALIS IRSALIYESINI DHL_119040,PDF.EXE	79
PID 1080 wrote to memory of 1628	1080	cmd.exe	81
PID 1080 wrote to memory of 1628	1080	cmd.exe	81
PID 1080 wrote to memory of 1628	1080	cmd.exe	81

C:\Users\Admin\AppData\Local\Temp\from-iso_BELGE ALIS IRSALIYESINI DHL_119040,PDF.EXE
"C:\Users\Admin\AppData\Local\Temp\from-iso_BELGE ALIS IRSALIYESINI DHL_119040,PDF.EXE"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\mobsync.exe
  C:\Windows\System32\mobsync.exe
  2⤵
  PID:2196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Trast.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2856
  - - C:\Windows\SysWOW64\reg.exe
      reg delete hkcu\Environment /v windir /f
      4⤵
      Modifies registry key
      PID:1800
  - - C:\Windows\SysWOW64\reg.exe
      reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
      4⤵
      Modifies registry key
      PID:604
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
      4⤵
      PID:1124
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\nest.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Windows\SysWOW64\reg.exe
    reg delete hkcu\Environment /v windir /f
    3⤵
    - Modifies registry key
    PID:1628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2136-116-0x0000000003D01000-0x0000000003D15000-memory.dmp

Download

memory/2136-115-0x0000000002260000-0x0000000002261000-memory.dmp

Download

memory/2196-119-0x0000000000B80000-0x0000000000B81000-memory.dmp

Download

memory/2196-122-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/2196-123-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Download

memory/2196-120-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Download

memory/2196-121-0x0000000072600000-0x000000007267C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads