remcos | 4a843bea699f8a40ae3b92c04e01139d61880ce1c519e369a966e814593d1d81

General

Target

a603a8a69bbcd08f4899a605ab1c68e4.exe
Size

463KB
MD5

a603a8a69bbcd08f4899a605ab1c68e4
SHA1

59f7a2f88a8a3fc13f685672b72506b28ba1614e
SHA256

4a843bea699f8a40ae3b92c04e01139d61880ce1c519e369a966e814593d1d81
SHA512

367238cbdaadbfbe42e08da5596f44efb00844505b7a415a57fd3a2d969b8ca83ac4b6ab3c0a4f6c348d9fec0229baee760bb0798768325710a7e70a3f8a4612

Score

10^/10

remcos remrem102 evasion rat trojan

Malware Config

Extracted

Family

remcos

Version

3.3.2 Pro

Botnet

remrem102

C2

18.218.132.40:2404

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
jre
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-QIKEGJ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Suspicious use of SetThreadContext 1 IoCs

Processes:

a603a8a69bbcd08f4899a605ab1c68e4.exe

description pid process target process

PID 1268 set thread context of 968 1268 a603a8a69bbcd08f4899a605ab1c68e4.exe svchost.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

340 reg.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

a603a8a69bbcd08f4899a605ab1c68e4.exe

pid process

1268 a603a8a69bbcd08f4899a605ab1c68e4.exe

description	pid	process	target process
PID 1268 set thread context of 968	1268	a603a8a69bbcd08f4899a605ab1c68e4.exe	svchost.exe

pid	process
340	reg.exe

pid	process
1268	a603a8a69bbcd08f4899a605ab1c68e4.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

a603a8a69bbcd08f4899a605ab1c68e4.execmd.exe

description	pid	process	target process
PID 1268 wrote to memory of 620	1268	a603a8a69bbcd08f4899a605ab1c68e4.exe	cmd.exe
PID 1268 wrote to memory of 620	1268	a603a8a69bbcd08f4899a605ab1c68e4.exe	cmd.exe
PID 1268 wrote to memory of 620	1268	a603a8a69bbcd08f4899a605ab1c68e4.exe	cmd.exe
PID 1268 wrote to memory of 620	1268	a603a8a69bbcd08f4899a605ab1c68e4.exe	cmd.exe
PID 1268 wrote to memory of 968	1268	a603a8a69bbcd08f4899a605ab1c68e4.exe	svchost.exe
PID 1268 wrote to memory of 968	1268	a603a8a69bbcd08f4899a605ab1c68e4.exe	svchost.exe
PID 1268 wrote to memory of 968	1268	a603a8a69bbcd08f4899a605ab1c68e4.exe	svchost.exe
PID 1268 wrote to memory of 968	1268	a603a8a69bbcd08f4899a605ab1c68e4.exe	svchost.exe
PID 1268 wrote to memory of 968	1268	a603a8a69bbcd08f4899a605ab1c68e4.exe	svchost.exe
PID 1268 wrote to memory of 968	1268	a603a8a69bbcd08f4899a605ab1c68e4.exe	svchost.exe
PID 1268 wrote to memory of 968	1268	a603a8a69bbcd08f4899a605ab1c68e4.exe	svchost.exe
PID 1268 wrote to memory of 968	1268	a603a8a69bbcd08f4899a605ab1c68e4.exe	svchost.exe
PID 1268 wrote to memory of 968	1268	a603a8a69bbcd08f4899a605ab1c68e4.exe	svchost.exe
PID 620 wrote to memory of 340	620	cmd.exe	reg.exe
PID 620 wrote to memory of 340	620	cmd.exe	reg.exe
PID 620 wrote to memory of 340	620	cmd.exe	reg.exe
PID 620 wrote to memory of 340	620	cmd.exe	reg.exe
PID 1268 wrote to memory of 968	1268	a603a8a69bbcd08f4899a605ab1c68e4.exe	svchost.exe
PID 1268 wrote to memory of 968	1268	a603a8a69bbcd08f4899a605ab1c68e4.exe	svchost.exe
PID 1268 wrote to memory of 968	1268	a603a8a69bbcd08f4899a605ab1c68e4.exe	svchost.exe
PID 1268 wrote to memory of 968	1268	a603a8a69bbcd08f4899a605ab1c68e4.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\a603a8a69bbcd08f4899a605ab1c68e4.exe
"C:\Users\Admin\AppData\Local\Temp\a603a8a69bbcd08f4899a605ab1c68e4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\SysWOW64\cmd.exe
/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
2⤵
- Suspicious use of WriteProcessMemory
PID:620

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
3⤵
- Modifies registry key
PID:340

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe
2⤵
PID:968

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

1

T1089

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/340-63-0x0000000000000000-mapping.dmp

Download
memory/620-56-0x0000000000000000-mapping.dmp

Download
memory/968-61-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/968-58-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/968-59-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/968-60-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/968-57-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/968-62-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/968-65-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/968-64-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/968-66-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/968-67-0x0000000000430472-mapping.dmp

Download
memory/968-69-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1268-55-0x0000000075821000-0x0000000075823000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing