remcos | 9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b

General

Target

9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe
Size

1.3MB
MD5

f002365d4b7c8dae7d740213242de512
SHA1

d1b7ad2a7554a8c3cbe34e0097edb55690a41c87
SHA256

9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b
SHA512

3a0775247be9a03e74cc3473eb592722e2b56da6973d99cdede6db7a1504d29ef6a5858f7fad69c61ded935bd423aa5f33c22bf318a0ee3c6ad7839854101b7b

Score

10^/10

remcos host rat

Malware Config

Extracted

Family

remcos

Version

1.8.2 Pro

Botnet

Host

C2

casillas.hicam.net:2404

casillasmx.chickenkiller.com:2404

casillas45.hopto.org:2404

casillas.libfoobar.so:2404

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
casillas-RL8G2N
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Drops startup file 1 IoCs

Processes:

9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ex1f2BUVIG.eu.url	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe

description	pid	process	target process
PID 1412 set thread context of 588	1412	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe

pid	process
1412	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe
1412	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe
1412	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe
1412	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe
1412	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe
1412	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe

pid process

588 9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe

pid	process
588	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe

description	pid	process	target process
PID 1412 wrote to memory of 320	1412	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe
PID 1412 wrote to memory of 320	1412	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe
PID 1412 wrote to memory of 320	1412	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe
PID 1412 wrote to memory of 320	1412	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe
PID 1412 wrote to memory of 588	1412	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe
PID 1412 wrote to memory of 588	1412	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe
PID 1412 wrote to memory of 588	1412	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe
PID 1412 wrote to memory of 588	1412	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe
PID 1412 wrote to memory of 588	1412	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe
PID 1412 wrote to memory of 588	1412	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe	9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe

C:\Users\Admin\AppData\Local\Temp\9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe
"C:\Users\Admin\AppData\Local\Temp\9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1412

C:\Users\Admin\AppData\Local\Temp\9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe
"C:\Users\Admin\AppData\Local\Temp\9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe"
2⤵
PID:320

C:\Users\Admin\AppData\Local\Temp\9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe
"C:\Users\Admin\AppData\Local\Temp\9eae55206b5108a848fcd2678346a5f6db3346eb49e68f08281bed4c5abcc81b.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:588

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/588-55-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/588-56-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/588-62-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1412-54-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads