remcos | a21158ed80e44fef2a41f3796204a8ae2ff23705e80e7a0e460b612276226853

General

Target

a21158ed80e44fef2a41f3796204a8ae2ff23705e80e7a0e460b612276226853.exe
Size

972KB
MD5

72bf4beb82aad6c5b74dac433ba58cbd
SHA1

c04f007881f757a7a2ffdc94f5763b61042173b7
SHA256

a21158ed80e44fef2a41f3796204a8ae2ff23705e80e7a0e460b612276226853
SHA512

c4d55c05d255fbd973dbf08c06c38fcb90bf13c8e2a7c11151286fbfd24d26a78dc47e3aea7e6618f22bea63a18518caf534cfa2ad6a22a595c5e7861986fd76

Score

10^/10

remcos zzzzzzzzzzzzzzzzzzzzzzzlibertad rat

Malware Config

Extracted

Family

remcos

Version

2.5.1 Pro

Botnet

zzzzzzzzzzzzZZZZZZZZZZZLIBERTAD

C2

dominoduck2094.duckdns.org:9596

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
Chrome.exe
copy_folder
Chrome
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
system
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-LQVOP4
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Blocklisted process makes network request 6 IoCs

Processes:

cmd.exe

flow pid process

3 544 cmd.exe
4 544 cmd.exe
5 544 cmd.exe
7 544 cmd.exe
8 544 cmd.exe
9 544 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

320 rundll32.exe
Drops file in Windows directory 1 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Windows\Tasks\autofmt.job cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

320 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

320 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

cmd.exe

pid process

544 cmd.exe

flow	pid	process
3	544	cmd.exe
4	544	cmd.exe
5	544	cmd.exe
7	544	cmd.exe
8	544	cmd.exe
9	544	cmd.exe

pid	process
320	rundll32.exe

description	ioc	process
File created	C:\Windows\Tasks\autofmt.job	cmd.exe

pid	process
320	rundll32.exe

pid	process
320	rundll32.exe

pid	process
544	cmd.exe

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

a21158ed80e44fef2a41f3796204a8ae2ff23705e80e7a0e460b612276226853.exerundll32.exe

description	pid	process	target process
PID 1220 wrote to memory of 320	1220	a21158ed80e44fef2a41f3796204a8ae2ff23705e80e7a0e460b612276226853.exe	rundll32.exe
PID 1220 wrote to memory of 320	1220	a21158ed80e44fef2a41f3796204a8ae2ff23705e80e7a0e460b612276226853.exe	rundll32.exe
PID 1220 wrote to memory of 320	1220	a21158ed80e44fef2a41f3796204a8ae2ff23705e80e7a0e460b612276226853.exe	rundll32.exe
PID 1220 wrote to memory of 320	1220	a21158ed80e44fef2a41f3796204a8ae2ff23705e80e7a0e460b612276226853.exe	rundll32.exe
PID 1220 wrote to memory of 320	1220	a21158ed80e44fef2a41f3796204a8ae2ff23705e80e7a0e460b612276226853.exe	rundll32.exe
PID 1220 wrote to memory of 320	1220	a21158ed80e44fef2a41f3796204a8ae2ff23705e80e7a0e460b612276226853.exe	rundll32.exe
PID 1220 wrote to memory of 320	1220	a21158ed80e44fef2a41f3796204a8ae2ff23705e80e7a0e460b612276226853.exe	rundll32.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe
PID 320 wrote to memory of 544	320	rundll32.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\a21158ed80e44fef2a41f3796204a8ae2ff23705e80e7a0e460b612276226853.exe
"C:\Users\Admin\AppData\Local\Temp\a21158ed80e44fef2a41f3796204a8ae2ff23705e80e7a0e460b612276226853.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1220

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe SpanielPolymorph,Shorelines
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:320

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:544

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Hypocycloid
MD5
4c661f7fe9aad8df24460b5974f83028

SHA1
640650ded87853f16c1ce7b4dc5bd1c0cc36ff43

SHA256
7b4044b8224c05913f0821a05fac81b09a5619f626f1f5d3afb03fbd718d1da8

SHA512
c033492295d27a98bd54da40b09dbe9230e1812e7c40e375c1001045c84acc9691b5b2729be33b05fe1bf86ebf15b42b1ec626ea08389fd5825ce86bd47ee975

Download Submit
C:\Users\Admin\AppData\Local\Temp\SpanielPolymorph.DLL
MD5
28c74b92530fceb2c5871b64ba0c3ea0

SHA1
9e13cdde74e97f4b94501c6fa645529edbf05285

SHA256
87a3e59ca3449d55d33c2932f6fcc0fb48289bfde35652a6fdd890d4e5b59eac

SHA512
2688cb774f660ad114a0013e27a0da9ff4c2c89927eb661976c38d62e3eb43085b239904cf7ca7243a06b2690f52a36947ad21f1cf5c986cc088974bb0458de1

Download Submit
\Users\Admin\AppData\Local\Temp\SpanielPolymorph.dll
MD5
28c74b92530fceb2c5871b64ba0c3ea0

SHA1
9e13cdde74e97f4b94501c6fa645529edbf05285

SHA256
87a3e59ca3449d55d33c2932f6fcc0fb48289bfde35652a6fdd890d4e5b59eac

SHA512
2688cb774f660ad114a0013e27a0da9ff4c2c89927eb661976c38d62e3eb43085b239904cf7ca7243a06b2690f52a36947ad21f1cf5c986cc088974bb0458de1

Download Submit
memory/320-59-0x0000000077510000-0x0000000077545000-memory.dmp

Filesize
212KB

Download
memory/320-60-0x0000000077C90000-0x0000000077E39000-memory.dmp

Filesize
1.7MB

Download
memory/320-61-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/544-63-0x0000000077C90000-0x0000000077E39000-memory.dmp

Filesize
1.7MB

Download
memory/544-65-0x0000000000190000-0x0000000000196000-memory.dmp

Filesize
24KB

Download
memory/544-69-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1220-54-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing