remcos | d328fce566cf2ff066a42f8d9eecc3f62c918e91d4f59098f5f83e7ff4bfe75f

General

Target

d328fce566cf2ff066a42f8d9eecc3f62c918e91d4f59098f5f83e7ff4bfe75f.exe
Size

817KB
MD5

c2b21337f90d034c0fc4c3ffaa1e0c6d
SHA1

af2ebb666bda08e1832c504c61942aa92db10b03
SHA256

d328fce566cf2ff066a42f8d9eecc3f62c918e91d4f59098f5f83e7ff4bfe75f
SHA512

b1b7067897445b895fc18523afe2887647f85485b86fb1cb15549c5001cefafd4a6082ea8201a7c5623ba992726f803082396c28d1ede6b82e0c948935442f8d

Score

10^/10

remcos veintiseis rat

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

VEINTISEIS

C2

veintiseisremcs.duckdns.org:1011

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-H9SRG1
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Blocklisted process makes network request 5 IoCs

Processes:

cmd.exe

flow pid process

24 2924 cmd.exe
26 2924 cmd.exe
27 2924 cmd.exe
30 2924 cmd.exe
31 2924 cmd.exe
Loads dropped DLL 2 IoCs

Processes:

d328fce566cf2ff066a42f8d9eecc3f62c918e91d4f59098f5f83e7ff4bfe75f.exerundll32.exe

pid process

3440 d328fce566cf2ff066a42f8d9eecc3f62c918e91d4f59098f5f83e7ff4bfe75f.exe
3052 rundll32.exe
Drops file in Windows directory 1 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Windows\Tasks\finger.job cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	pid	process
24	2924	cmd.exe
26	2924	cmd.exe
27	2924	cmd.exe
30	2924	cmd.exe
31	2924	cmd.exe

pid	process
3440	d328fce566cf2ff066a42f8d9eecc3f62c918e91d4f59098f5f83e7ff4bfe75f.exe
3052	rundll32.exe

description	ioc	process
File created	C:\Windows\Tasks\finger.job	cmd.exe

Modifies registry class 2 IoCs

Processes:

d328fce566cf2ff066a42f8d9eecc3f62c918e91d4f59098f5f83e7ff4bfe75f.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\bittorrent\EditFlags = 00000100	d328fce566cf2ff066a42f8d9eecc3f62c918e91d4f59098f5f83e7ff4bfe75f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bittorrent	d328fce566cf2ff066a42f8d9eecc3f62c918e91d4f59098f5f83e7ff4bfe75f.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

3052 rundll32.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

rundll32.exe

pid process

3052 rundll32.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

cmd.exe

pid process

2924 cmd.exe

pid	process
3052	rundll32.exe

pid	process
3052	rundll32.exe

pid	process
2924	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d328fce566cf2ff066a42f8d9eecc3f62c918e91d4f59098f5f83e7ff4bfe75f.exerundll32.exe

description	pid	process	target process
PID 3440 wrote to memory of 3052	3440	d328fce566cf2ff066a42f8d9eecc3f62c918e91d4f59098f5f83e7ff4bfe75f.exe	rundll32.exe
PID 3440 wrote to memory of 3052	3440	d328fce566cf2ff066a42f8d9eecc3f62c918e91d4f59098f5f83e7ff4bfe75f.exe	rundll32.exe
PID 3440 wrote to memory of 3052	3440	d328fce566cf2ff066a42f8d9eecc3f62c918e91d4f59098f5f83e7ff4bfe75f.exe	rundll32.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe
PID 3052 wrote to memory of 2924	3052	rundll32.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\d328fce566cf2ff066a42f8d9eecc3f62c918e91d4f59098f5f83e7ff4bfe75f.exe
"C:\Users\Admin\AppData\Local\Temp\d328fce566cf2ff066a42f8d9eecc3f62c918e91d4f59098f5f83e7ff4bfe75f.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3440

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.exe PetioleLaryngology,Michelle
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3052

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2924

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CapeOocyte
MD5
75895bad5dfdbfd8e6498116fb77e70f

SHA1
2912f2a3a2a8d2d6978cf752e44c1a6ff8e20748

SHA256
49aa01f19390be57abb36696729debe1e596d71e629bb5b89f392056e2f5e0e3

SHA512
752ade44abf1514a0848b4e81a47578bf69754cebdacda713d8bd453dd836fd4aa764c991f1f0ae26512b9a07dcd5cca24e23e2abef90ff82d56c653eaf2233d

Download Submit
C:\Users\Admin\AppData\Local\Temp\PetioleLaryngology.DLL
MD5
b000a0f4ab9c6b2d8951bd1d947abc6f

SHA1
7caa54aee44e15976063bd63b937a4d5c205c663

SHA256
5490f3ebd14e7c763fe83f032152ff583452777031dbd36bfb607d82a9b2e8d7

SHA512
eb9fdc89c4f1bd9441dfea394d4f18e9bb4891b1bcae3de1c2e307f160edddfa134fffb25f0a528ee942c96d14cabc8f7035d2efb31097938ac73f8e04e21566

Download Submit
\Users\Admin\AppData\Local\Temp\PetioleLaryngology.dll
MD5
b000a0f4ab9c6b2d8951bd1d947abc6f

SHA1
7caa54aee44e15976063bd63b937a4d5c205c663

SHA256
5490f3ebd14e7c763fe83f032152ff583452777031dbd36bfb607d82a9b2e8d7

SHA512
eb9fdc89c4f1bd9441dfea394d4f18e9bb4891b1bcae3de1c2e307f160edddfa134fffb25f0a528ee942c96d14cabc8f7035d2efb31097938ac73f8e04e21566

Download Submit
\Users\Admin\AppData\Local\Temp\nsrD4D7.tmp\UserInfo.dll
MD5
e167f9a565781a30c03ff10370033319

SHA1
1858758b076946073de375c6eb1bec9867aa3689

SHA256
a912514823df595ba3a048099d3b89e925a4d41742afc67e772060952892f312

SHA512
96d8f5ac8e2c0961ba71075de52d12515e7a058cddf3fa1ec14e77545b0b5f4e29324a13e2eb287a447f1d24dc9f09e0a70b0a25401b0ef8d90e6e4a96ce6c61

Download Submit
memory/2924-125-0x00000000775E9000-0x00000000775EA000-memory.dmp

Filesize
4KB

Download
memory/2924-131-0x00007FFE4CB10000-0x00007FFE4CCEB000-memory.dmp

Filesize
1.9MB

Download
memory/2924-141-0x0000000003200000-0x0000000003206000-memory.dmp

Filesize
24KB

Download
memory/2924-157-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3052-122-0x0000000075F00000-0x0000000075F67000-memory.dmp

Filesize
412KB

Download
memory/3052-123-0x0000000002E00000-0x0000000002F4A000-memory.dmp

Filesize
1.3MB

Download
memory/3052-124-0x00007FFE4CB10000-0x00007FFE4CCEB000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing