remcos | 4c8c59242b2c2a8b0873d6c06ce57ba6b31dd1e92859f0a444ac3f14d47d275b

General

Target

81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe
Size

502KB
MD5

d44ba5b8a9598cb8ce4d82f0b5e48d9f
SHA1

755308b8328eafa8f9b78e63e1e699717da7d718
SHA256

81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1
SHA512

f7eff85ce186faef8e6bfad30d2668d831cc09b70f0c269a2f17432a56cf89c67c93d3cd9c203928b74824aa44d2c2bcdd63831f3deba83c663a58616a57449f

Score

10^/10

remcos 14 rat

Malware Config

Extracted

Family

remcos

Version

2.7.0 Pro

Botnet

14

C2

prueba6812111.duckdns.org:1717

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-HEOTZ9
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

Processes:

81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe

description	pid	process	target process
PID 1136 set thread context of 328	1136	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	RegSvcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1360 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe

pid process

1136 81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe

description pid process

Token: SeDebugPrivilege 1136 81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

328 RegSvcs.exe

pid	process
1360	schtasks.exe

pid	process
1136	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe

description	pid	process
Token: SeDebugPrivilege	1136	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe

pid	process
328	RegSvcs.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe

description	pid	process	target process
PID 1136 wrote to memory of 1360	1136	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	schtasks.exe
PID 1136 wrote to memory of 1360	1136	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	schtasks.exe
PID 1136 wrote to memory of 1360	1136	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	schtasks.exe
PID 1136 wrote to memory of 1360	1136	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	schtasks.exe
PID 1136 wrote to memory of 328	1136	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	RegSvcs.exe
PID 1136 wrote to memory of 328	1136	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	RegSvcs.exe
PID 1136 wrote to memory of 328	1136	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	RegSvcs.exe
PID 1136 wrote to memory of 328	1136	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	RegSvcs.exe
PID 1136 wrote to memory of 328	1136	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	RegSvcs.exe
PID 1136 wrote to memory of 328	1136	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	RegSvcs.exe
PID 1136 wrote to memory of 328	1136	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	RegSvcs.exe
PID 1136 wrote to memory of 328	1136	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	RegSvcs.exe
PID 1136 wrote to memory of 328	1136	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	RegSvcs.exe
PID 1136 wrote to memory of 328	1136	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	RegSvcs.exe
PID 1136 wrote to memory of 328	1136	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	RegSvcs.exe
PID 1136 wrote to memory of 328	1136	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	RegSvcs.exe
PID 1136 wrote to memory of 328	1136	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	RegSvcs.exe
PID 1136 wrote to memory of 328	1136	81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe
"C:\Users\Admin\AppData\Local\Temp\81dcd7fc775c85bd470186ae6204fe8c1bb126e0aa23b9740b81f5b733d229d1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1136

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zCmrifXxFLnZnW" /XML "C:\Users\Admin\AppData\Local\Temp\tmp783B.tmp"
2⤵
- Creates scheduled task(s)
PID:1360

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Suspicious use of SetWindowsHookEx
PID:328

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp783B.tmp
MD5
b88425eaa55b545f280a2eb06c3063cc

SHA1
4b7a3a7b27d1391bbe30bafc1cd2de99ed792ff9

SHA256
ed270e54df2a71309f57cdbf3323c29fd268f2f3d66bd800db6cb9274fd1e042

SHA512
5c406a222a1a558029f04d8087a0a154cb25b9797aa23379a4aa0a9862d52c0331d4368b7c7256c8eded6d1a5fef3aa33d404708b1e58b039e52310425b07e4d

Download Submit
memory/328-67-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/328-66-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/328-71-0x0000000000401000-0x0000000000421000-memory.dmp

Filesize
128KB

Download
memory/328-70-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/328-68-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/328-63-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/328-65-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/328-64-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/328-62-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1136-57-0x0000000000E20000-0x0000000000E21000-memory.dmp

Filesize
4KB

Download
memory/1136-56-0x00000000763B1000-0x00000000763B3000-memory.dmp

Filesize
8KB

Download
memory/1136-55-0x0000000000FA0000-0x0000000001022000-memory.dmp

Filesize
520KB

Download
memory/1136-60-0x0000000000F60000-0x0000000000F86000-memory.dmp

Filesize
152KB

Download
memory/1136-59-0x0000000004A70000-0x0000000004AE6000-memory.dmp

Filesize
472KB

Download
memory/1136-58-0x0000000000580000-0x000000000058A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads