remcos | 3f33700e15ff9a8943e2a67c3a435278290931183d6189095c50a33822f5e1f3

General

Target

3f33700e15ff9a8943e2a67c3a435278290931183d6189095c50a33822f5e1f3.exe
Size

984KB
MD5

d337ab73b6eb182db46e2cf94239e523
SHA1

dc0b25884c0379f1b3058b5da1d6ff3df735ef03
SHA256

3f33700e15ff9a8943e2a67c3a435278290931183d6189095c50a33822f5e1f3
SHA512

2a2b7df94ad54ed096db69fab0dee6bdc364956fff6ba1b0baadb2e1a7657b0d7b2399641bdffd7aa006593b854f32158b670e40b3b29e5c898266744d9e6084

Score

10^/10

remcos zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzsumo rat

Malware Config

Extracted

Family

remcos

Version

2.5.1 Pro

Botnet

zzzzzzzzzzzzZZZZZZZZZZZZZZZZZZZZSUMO

C2

dominoduck2100.duckdns.org:9598

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
Chrome.exe
copy_folder
Chrome
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
system
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-CQKCYO
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Blocklisted process makes network request 5 IoCs

Processes:

cmd.exe

flow pid process

23 1240 cmd.exe
26 1240 cmd.exe
28 1240 cmd.exe
30 1240 cmd.exe
31 1240 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

536 rundll32.exe
Drops file in Windows directory 1 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Windows\Tasks\setupugc.job cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

536 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

536 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

cmd.exe

pid process

1240 cmd.exe

flow	pid	process
23	1240	cmd.exe
26	1240	cmd.exe
28	1240	cmd.exe
30	1240	cmd.exe
31	1240	cmd.exe

pid	process
536	rundll32.exe

description	ioc	process
File created	C:\Windows\Tasks\setupugc.job	cmd.exe

pid	process
536	rundll32.exe

pid	process
536	rundll32.exe

pid	process
1240	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3f33700e15ff9a8943e2a67c3a435278290931183d6189095c50a33822f5e1f3.exerundll32.exe

description	pid	process	target process
PID 3536 wrote to memory of 536	3536	3f33700e15ff9a8943e2a67c3a435278290931183d6189095c50a33822f5e1f3.exe	rundll32.exe
PID 3536 wrote to memory of 536	3536	3f33700e15ff9a8943e2a67c3a435278290931183d6189095c50a33822f5e1f3.exe	rundll32.exe
PID 3536 wrote to memory of 536	3536	3f33700e15ff9a8943e2a67c3a435278290931183d6189095c50a33822f5e1f3.exe	rundll32.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe
PID 536 wrote to memory of 1240	536	rundll32.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\3f33700e15ff9a8943e2a67c3a435278290931183d6189095c50a33822f5e1f3.exe
"C:\Users\Admin\AppData\Local\Temp\3f33700e15ff9a8943e2a67c3a435278290931183d6189095c50a33822f5e1f3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3536

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe Discomfiture,Piggins
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:536

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1240

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Clomiphene
MD5
a0c78a0f5bcb482dddcf5887a672a979

SHA1
5db86d70cba8ff53d350c739b900d28945dd6288

SHA256
47d370f0301f3c2d559493ce30f7fa46cbdb0cfaae18aa98fafa0c4963c2df92

SHA512
dfab747100f07e2febba90fc4d8cf2deeb59e34b52da12b2e1e7e0d958a657814df5120b152bcbd6c7a29ce852c82967388ecb70aaf473e0c499700122d81b5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Discomfiture.DLL
MD5
8fa1a02d0f265c2f04daf196e14f4fbf

SHA1
2880c448cfca9affcdae455db69062de4a552ee5

SHA256
dd78cc40cfff39aa47189f911cbe56da634f39318163f16bc2c6b1046ab767d2

SHA512
f61c688585d7189acff1dbbe48c23559694a8f409b2e6a77cdd5155f981c5d0d8070a51ed24fe1a4ca3835a5b93d632c2c22a8bf2468215c45a538ef77640692

Download Submit
\Users\Admin\AppData\Local\Temp\Discomfiture.dll
MD5
8fa1a02d0f265c2f04daf196e14f4fbf

SHA1
2880c448cfca9affcdae455db69062de4a552ee5

SHA256
dd78cc40cfff39aa47189f911cbe56da634f39318163f16bc2c6b1046ab767d2

SHA512
f61c688585d7189acff1dbbe48c23559694a8f409b2e6a77cdd5155f981c5d0d8070a51ed24fe1a4ca3835a5b93d632c2c22a8bf2468215c45a538ef77640692

Download Submit
memory/536-118-0x00000000032F0000-0x00000000032F3000-memory.dmp

Filesize
12KB

Download
memory/536-119-0x00000000743C0000-0x0000000074427000-memory.dmp

Filesize
412KB

Download
memory/536-120-0x00007FFD86760000-0x00007FFD8693B000-memory.dmp

Filesize
1.9MB

Download
memory/1240-121-0x00000000776A9000-0x00000000776AA000-memory.dmp

Filesize
4KB

Download
memory/1240-127-0x00007FFD86760000-0x00007FFD8693B000-memory.dmp

Filesize
1.9MB

Download
memory/1240-142-0x0000000000D70000-0x0000000000D76000-memory.dmp

Filesize
24KB

Download
memory/1240-153-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing