remcos | 0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799

General

Target

0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe
Size

686KB
MD5

51da9d817874e8eb7020e708e263f79a
SHA1

2f175ccb80f9103865bf89c0c9ea7754a6d99ba3
SHA256

0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799
SHA512

366875c7f4af27f74c7603fed936bbb9ecb0f6bf2e37b2ff9f00643ab1df2753930721c41ac09cce882ca577e98ad369adb7658759f34070bc165c3aeb8de82b

Score

10^/10

remcos harry persistence rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Harry

C2

newremc22.ddns.net:2717

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
remcos_qvoysmnedqksues
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
bin
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 2 IoCs

Processes:

remcos.exeremcos.exe

pid process

1544 remcos.exe
1812 remcos.exe

pid	process
1544	remcos.exe
1812	remcos.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exeremcos.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows\CurrentVersion\Run\	0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bin = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows\CurrentVersion\Run\	remcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bin = "\"C:\\Users\\Admin\\AppData\\Roaming\\remcos\\remcos.exe\""	remcos.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exeremcos.exe

description	pid	process	target process
PID 2436 set thread context of 212	2436	0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe	0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe
PID 1544 set thread context of 1812	1544	remcos.exe	remcos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2956 PING.EXE
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

remcos.exe

pid process

1812 remcos.exe

pid	process
2956	PING.EXE

pid	process
1812	remcos.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.execmd.exeremcos.exe

description	pid	process	target process
PID 2436 wrote to memory of 212	2436	0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe	0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe
PID 2436 wrote to memory of 212	2436	0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe	0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe
PID 2436 wrote to memory of 212	2436	0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe	0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe
PID 2436 wrote to memory of 212	2436	0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe	0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe
PID 2436 wrote to memory of 212	2436	0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe	0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe
PID 2436 wrote to memory of 212	2436	0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe	0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe
PID 2436 wrote to memory of 212	2436	0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe	0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe
PID 2436 wrote to memory of 212	2436	0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe	0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe
PID 2436 wrote to memory of 212	2436	0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe	0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe
PID 212 wrote to memory of 780	212	0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe	cmd.exe
PID 212 wrote to memory of 780	212	0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe	cmd.exe
PID 212 wrote to memory of 780	212	0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe	cmd.exe
PID 780 wrote to memory of 2956	780	cmd.exe	PING.EXE
PID 780 wrote to memory of 2956	780	cmd.exe	PING.EXE
PID 780 wrote to memory of 2956	780	cmd.exe	PING.EXE
PID 780 wrote to memory of 1544	780	cmd.exe	remcos.exe
PID 780 wrote to memory of 1544	780	cmd.exe	remcos.exe
PID 780 wrote to memory of 1544	780	cmd.exe	remcos.exe
PID 1544 wrote to memory of 1812	1544	remcos.exe	remcos.exe
PID 1544 wrote to memory of 1812	1544	remcos.exe	remcos.exe
PID 1544 wrote to memory of 1812	1544	remcos.exe	remcos.exe
PID 1544 wrote to memory of 1812	1544	remcos.exe	remcos.exe
PID 1544 wrote to memory of 1812	1544	remcos.exe	remcos.exe
PID 1544 wrote to memory of 1812	1544	remcos.exe	remcos.exe
PID 1544 wrote to memory of 1812	1544	remcos.exe	remcos.exe
PID 1544 wrote to memory of 1812	1544	remcos.exe	remcos.exe
PID 1544 wrote to memory of 1812	1544	remcos.exe	remcos.exe

C:\Users\Admin\AppData\Local\Temp\0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe
"C:\Users\Admin\AppData\Local\Temp\0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2436

C:\Users\Admin\AppData\Local\Temp\0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe
"C:\Users\Admin\AppData\Local\Temp\0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799.exe"
2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:212

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:780

C:\Windows\SysWOW64\PING.EXE
PING 127.0.0.1 -n 2
4⤵
- Runs ping.exe
PID:2956

C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
"C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1544

C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
"C:\Users\Admin\AppData\Roaming\remcos\remcos.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1812

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.bat
MD5
76c1687d97dfdbcea62ef1490bec5001

SHA1
5f4d1aeafa7d840cde67b76f97416dd68efd1bed

SHA256
79f04ea049979ffd2232c459fdd57fae97a5255aea9b4a2c7dce7ead856f37a4

SHA512
da250f0628632a644f159d818a82a8b9cca8224e46843bddbe0f6f9c32a2d04f7736a620af49ab6d77616317ca7d68285e60043965fe86c03d940835bd30a925

Download Submit
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
MD5
51da9d817874e8eb7020e708e263f79a

SHA1
2f175ccb80f9103865bf89c0c9ea7754a6d99ba3

SHA256
0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799

SHA512
366875c7f4af27f74c7603fed936bbb9ecb0f6bf2e37b2ff9f00643ab1df2753930721c41ac09cce882ca577e98ad369adb7658759f34070bc165c3aeb8de82b

Download Submit
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
MD5
51da9d817874e8eb7020e708e263f79a

SHA1
2f175ccb80f9103865bf89c0c9ea7754a6d99ba3

SHA256
0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799

SHA512
366875c7f4af27f74c7603fed936bbb9ecb0f6bf2e37b2ff9f00643ab1df2753930721c41ac09cce882ca577e98ad369adb7658759f34070bc165c3aeb8de82b

Download Submit
C:\Users\Admin\AppData\Roaming\remcos\remcos.exe
MD5
51da9d817874e8eb7020e708e263f79a

SHA1
2f175ccb80f9103865bf89c0c9ea7754a6d99ba3

SHA256
0a9babd846b1edf99e75f3c9de492c6341f9ca9a8e91851ad323bf8f325f9799

SHA512
366875c7f4af27f74c7603fed936bbb9ecb0f6bf2e37b2ff9f00643ab1df2753930721c41ac09cce882ca577e98ad369adb7658759f34070bc165c3aeb8de82b

Download Submit
memory/212-137-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/212-138-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1544-142-0x000000007457E000-0x000000007457F000-memory.dmp

Filesize
4KB

Download
memory/1544-143-0x00000000055E0000-0x00000000055E1000-memory.dmp

Filesize
4KB

Download
memory/1812-146-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2436-136-0x0000000007DD0000-0x0000000007E6C000-memory.dmp

Filesize
624KB

Download
memory/2436-135-0x0000000005AF0000-0x0000000005AF1000-memory.dmp

Filesize
4KB

Download
memory/2436-134-0x0000000005A40000-0x0000000005A4A000-memory.dmp

Filesize
40KB

Download
memory/2436-133-0x00000000058B0000-0x0000000005942000-memory.dmp

Filesize
584KB

Download
memory/2436-132-0x0000000005DC0000-0x0000000006364000-memory.dmp

Filesize
5.6MB

Download
memory/2436-130-0x000000007458E000-0x000000007458F000-memory.dmp

Filesize
4KB

Download
memory/2436-131-0x0000000000E30000-0x0000000000EE2000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads