remcos | f8e75ae7b73058c83d8e49afd902e29dbd5dc808017d7ec736a8f1aa0ad88c51

General

Target

INVOICE ASIAN SHIPPING.exe
Size

814KB
MD5

baea8f92a509da346b2785803537713d
SHA1

35ec1fce1fd39a8fad37e88ccb25c859fc21b297
SHA256

f8e75ae7b73058c83d8e49afd902e29dbd5dc808017d7ec736a8f1aa0ad88c51
SHA512

ecc34f5cc2f8e79096a44ec235dccc2fb3f7e0e280553be51d5d2397d7c24ad2dc8ca899da6db6ea70e60fee280302fcf317efacc14603a277f642f79b0b79f1

Score

10^/10

remcos remotehost evasion rat

Malware Config

Extracted

Family

remcos

Version

3.3.0 Pro

Botnet

RemoteHost

C2

172.94.88.26:3033

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-LNYWHZ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

INVOICE ASIAN SHIPPING.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	INVOICE ASIAN SHIPPING.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	INVOICE ASIAN SHIPPING.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

INVOICE ASIAN SHIPPING.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	INVOICE ASIAN SHIPPING.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	INVOICE ASIAN SHIPPING.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

INVOICE ASIAN SHIPPING.exe

description pid process target process

PID 2064 set thread context of 2896 2064 INVOICE ASIAN SHIPPING.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

2692 powershell.exe
2692 powershell.exe
2692 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2692 powershell.exe

description	pid	process	target process
PID 2064 set thread context of 2896	2064	INVOICE ASIAN SHIPPING.exe	RegSvcs.exe

pid	process
2692	powershell.exe
2692	powershell.exe
2692	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2692	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

INVOICE ASIAN SHIPPING.exe

description	pid	process	target process
PID 2064 wrote to memory of 2692	2064	INVOICE ASIAN SHIPPING.exe	powershell.exe
PID 2064 wrote to memory of 2692	2064	INVOICE ASIAN SHIPPING.exe	powershell.exe
PID 2064 wrote to memory of 2692	2064	INVOICE ASIAN SHIPPING.exe	powershell.exe
PID 2064 wrote to memory of 2896	2064	INVOICE ASIAN SHIPPING.exe	RegSvcs.exe
PID 2064 wrote to memory of 2896	2064	INVOICE ASIAN SHIPPING.exe	RegSvcs.exe
PID 2064 wrote to memory of 2896	2064	INVOICE ASIAN SHIPPING.exe	RegSvcs.exe
PID 2064 wrote to memory of 2896	2064	INVOICE ASIAN SHIPPING.exe	RegSvcs.exe
PID 2064 wrote to memory of 2896	2064	INVOICE ASIAN SHIPPING.exe	RegSvcs.exe
PID 2064 wrote to memory of 2896	2064	INVOICE ASIAN SHIPPING.exe	RegSvcs.exe
PID 2064 wrote to memory of 2896	2064	INVOICE ASIAN SHIPPING.exe	RegSvcs.exe
PID 2064 wrote to memory of 2896	2064	INVOICE ASIAN SHIPPING.exe	RegSvcs.exe
PID 2064 wrote to memory of 2896	2064	INVOICE ASIAN SHIPPING.exe	RegSvcs.exe
PID 2064 wrote to memory of 2896	2064	INVOICE ASIAN SHIPPING.exe	RegSvcs.exe
PID 2064 wrote to memory of 2896	2064	INVOICE ASIAN SHIPPING.exe	RegSvcs.exe
PID 2064 wrote to memory of 2896	2064	INVOICE ASIAN SHIPPING.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\INVOICE ASIAN SHIPPING.exe
"C:\Users\Admin\AppData\Local\Temp\INVOICE ASIAN SHIPPING.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2064

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\INVOICE ASIAN SHIPPING.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2692

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
PID:2896

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

4

T1012

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2064-125-0x000000000DE10000-0x000000000DE11000-memory.dmp

Filesize
4KB

Download
memory/2064-117-0x000000000A9B0000-0x000000000A9B1000-memory.dmp

Filesize
4KB

Download
memory/2064-118-0x000000000A550000-0x000000000A551000-memory.dmp

Filesize
4KB

Download
memory/2064-119-0x000000000A6B0000-0x000000000A6B1000-memory.dmp

Filesize
4KB

Download
memory/2064-120-0x000000000A4B0000-0x000000000A9AE000-memory.dmp

Filesize
5.0MB

Download
memory/2064-121-0x000000000DC40000-0x000000000DC47000-memory.dmp

Filesize
28KB

Download
memory/2064-122-0x000000000C190000-0x000000000C191000-memory.dmp

Filesize
4KB

Download
memory/2064-123-0x000000000DD00000-0x000000000DD95000-memory.dmp

Filesize
596KB

Download
memory/2064-115-0x0000000000750000-0x0000000000751000-memory.dmp

Filesize
4KB

Download
memory/2692-132-0x0000000007840000-0x0000000007841000-memory.dmp

Filesize
4KB

Download
memory/2692-142-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2692-127-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2692-128-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Filesize
4KB

Download
memory/2692-129-0x0000000007920000-0x0000000007921000-memory.dmp

Filesize
4KB

Download
memory/2692-232-0x0000000004F33000-0x0000000004F34000-memory.dmp

Filesize
4KB

Download
memory/2692-231-0x000000007F030000-0x000000007F031000-memory.dmp

Filesize
4KB

Download
memory/2692-124-0x0000000000000000-mapping.dmp

Download
memory/2692-133-0x0000000007F50000-0x0000000007F51000-memory.dmp

Filesize
4KB

Download
memory/2692-162-0x0000000009BC0000-0x0000000009BC1000-memory.dmp

Filesize
4KB

Download
memory/2692-137-0x0000000004F32000-0x0000000004F33000-memory.dmp

Filesize
4KB

Download
memory/2692-136-0x0000000008330000-0x0000000008331000-memory.dmp

Filesize
4KB

Download
memory/2692-135-0x0000000004F30000-0x0000000004F31000-memory.dmp

Filesize
4KB

Download
memory/2692-139-0x0000000008070000-0x0000000008071000-memory.dmp

Filesize
4KB

Download
memory/2692-140-0x0000000008B10000-0x0000000008B11000-memory.dmp

Filesize
4KB

Download
memory/2692-141-0x00000000088B0000-0x00000000088B1000-memory.dmp

Filesize
4KB

Download
memory/2692-126-0x0000000003510000-0x0000000003511000-memory.dmp

Filesize
4KB

Download
memory/2692-149-0x00000000098C0000-0x00000000098F3000-memory.dmp

Filesize
204KB

Download
memory/2692-156-0x0000000009880000-0x0000000009881000-memory.dmp

Filesize
4KB

Download
memory/2692-161-0x00000000099F0000-0x00000000099F1000-memory.dmp

Filesize
4KB

Download
memory/2896-138-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2896-131-0x000000000042FC39-mapping.dmp

Download
memory/2896-130-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads