remcos | c557af22044eaf1eafbe570f708695970ad43efeaca212f6a18c3c62e29c3a0d

General

Target

c557af22044eaf1eafbe570f708695970ad43efeaca212f6a18c3c62e29c3a0d.exe
Size

741KB
MD5

33b020831073aa2daed2f89573487af8
SHA1

b5385a01025431b88b4140538f6885904a496471
SHA256

c557af22044eaf1eafbe570f708695970ad43efeaca212f6a18c3c62e29c3a0d
SHA512

a629fe3aea2717ca5dc4396af12b091801337021b829fdcc529a6f7e5106c249b0715902897da64aa7ee00935350b49e1c6a513819a6e112927962f580e096f8

Score

10^/10

remcos treintaysiete rat

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

TREINTAYSIETE

C2

treintaysieteremc.duckdns.org:1011

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-UJ9U6Z
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Blocklisted process makes network request 5 IoCs

Processes:

cmd.exe

flow pid process

23 2592 cmd.exe
26 2592 cmd.exe
27 2592 cmd.exe
29 2592 cmd.exe
30 2592 cmd.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1644 rundll32.exe
Drops file in Windows directory 1 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Windows\Tasks\gpresult.job cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1644 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

1644 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

cmd.exe

pid process

2592 cmd.exe

flow	pid	process
23	2592	cmd.exe
26	2592	cmd.exe
27	2592	cmd.exe
29	2592	cmd.exe
30	2592	cmd.exe

pid	process
1644	rundll32.exe

description	ioc	process
File created	C:\Windows\Tasks\gpresult.job	cmd.exe

pid	process
1644	rundll32.exe

pid	process
1644	rundll32.exe

pid	process
2592	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

c557af22044eaf1eafbe570f708695970ad43efeaca212f6a18c3c62e29c3a0d.exerundll32.exe

description	pid	process	target process
PID 2732 wrote to memory of 1644	2732	c557af22044eaf1eafbe570f708695970ad43efeaca212f6a18c3c62e29c3a0d.exe	rundll32.exe
PID 2732 wrote to memory of 1644	2732	c557af22044eaf1eafbe570f708695970ad43efeaca212f6a18c3c62e29c3a0d.exe	rundll32.exe
PID 2732 wrote to memory of 1644	2732	c557af22044eaf1eafbe570f708695970ad43efeaca212f6a18c3c62e29c3a0d.exe	rundll32.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe
PID 1644 wrote to memory of 2592	1644	rundll32.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\c557af22044eaf1eafbe570f708695970ad43efeaca212f6a18c3c62e29c3a0d.exe
"C:\Users\Admin\AppData\Local\Temp\c557af22044eaf1eafbe570f708695970ad43efeaca212f6a18c3c62e29c3a0d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2732

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe KakaGemot,Hurley
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2592

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Emphysema
MD5
47524c7eab55348890f071a26a029463

SHA1
2c9d2ad5ae07648d2c660d8eefe55420dd92a92e

SHA256
4e7315af8cf80ed459a12ea55714cf00c2c04a905a87514f7181ad8c027c7844

SHA512
4fadfa9b177dbbd977655f1b99fe1476a74308e9f3407db988778e91ea74c0312b1fa96b919770229f7ee0803f306c0c76f8f9b0cced22ad39fb24b208b9def2

Download Submit
C:\Users\Admin\AppData\Local\Temp\KakaGemot.DLL
MD5
c0e01643919e063ff6cd9affd17da14e

SHA1
65b873d8420b6cd2b682741a02fca4c2b21cbdc2

SHA256
68beebeceae97af14b3e80d41ad894e7e3ca28fc2297b9dbf50567efd9bf6ca3

SHA512
35aa70d36ff3bc2721bce58640114de59a405aff02083daa533e83d371eaa9efc1d44e8faecf91f723752ba92bcbd95618ce0bbcd1445677e0bc96025568f6da

Download Submit
\Users\Admin\AppData\Local\Temp\KakaGemot.dll
MD5
c0e01643919e063ff6cd9affd17da14e

SHA1
65b873d8420b6cd2b682741a02fca4c2b21cbdc2

SHA256
68beebeceae97af14b3e80d41ad894e7e3ca28fc2297b9dbf50567efd9bf6ca3

SHA512
35aa70d36ff3bc2721bce58640114de59a405aff02083daa533e83d371eaa9efc1d44e8faecf91f723752ba92bcbd95618ce0bbcd1445677e0bc96025568f6da

Download Submit
memory/1644-118-0x0000000074060000-0x00000000740C7000-memory.dmp

Filesize
412KB

Download
memory/1644-120-0x00000000005C0000-0x00000000005C2000-memory.dmp

Filesize
8KB

Download
memory/1644-119-0x00007FFBACF00000-0x00007FFBAD0DB000-memory.dmp

Filesize
1.9MB

Download
memory/2592-121-0x00000000770B9000-0x00000000770BA000-memory.dmp

Filesize
4KB

Download
memory/2592-127-0x00007FFBACF00000-0x00007FFBAD0DB000-memory.dmp

Filesize
1.9MB

Download
memory/2592-138-0x0000000000990000-0x0000000000996000-memory.dmp

Filesize
24KB

Download
memory/2592-153-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing