remcos | 6a41331a44711da6d020c1909dafabdca5a68357d56f1a3b702ec39fd69afda7

General

Target
Documento de entrega de envío DHL227024.exe
Size 639KB
Sample220412-se1bdafhh7
SHA256 6a41331a44711da6d020c1909dafabdca5a68357d56f1a3b702ec39fd69afda7
MD5 f51f21fc186c8520542904fc2eb83ac9
SHA1 252c96aaa362f600cff7c3b58e902d66b230f4b5
SHA512 2ba5694345e95a235896786930d9b20b1c382d4518047975fd69798e907f602827629dffec2c8607fb6ccb0dc4b63dca182e12c5ffb86532703d00dc118b59d7
MD5 SHA1 SHA512

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

boysgoblow.hopto.org:7838

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-K11KTM
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
notepad;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1928 set thread context of 2348	1928	Documento de entrega de envío DHL227024.exe	79

Program crash 1 IoCs

pid	pid_target	Process	procid_target
456	2348	WerFault.exe	79

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2348	1928	Documento de entrega de envío DHL227024.exe	79
PID 1928 wrote to memory of 2348	1928	Documento de entrega de envío DHL227024.exe	79
PID 1928 wrote to memory of 2348	1928	Documento de entrega de envío DHL227024.exe	79
PID 1928 wrote to memory of 2348	1928	Documento de entrega de envío DHL227024.exe	79
PID 1928 wrote to memory of 2348	1928	Documento de entrega de envío DHL227024.exe	79
PID 1928 wrote to memory of 2348	1928	Documento de entrega de envío DHL227024.exe	79
PID 1928 wrote to memory of 2348	1928	Documento de entrega de envío DHL227024.exe	79
PID 1928 wrote to memory of 2348	1928	Documento de entrega de envío DHL227024.exe	79
PID 1928 wrote to memory of 2348	1928	Documento de entrega de envío DHL227024.exe	79
PID 1928 wrote to memory of 2348	1928	Documento de entrega de envío DHL227024.exe	79
PID 1928 wrote to memory of 2348	1928	Documento de entrega de envío DHL227024.exe	79
PID 1928 wrote to memory of 2348	1928	Documento de entrega de envío DHL227024.exe	79

C:\Users\Admin\AppData\Local\Temp\Documento de entrega de envío DHL227024.exe
"C:\Users\Admin\AppData\Local\Temp\Documento de entrega de envío DHL227024.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2348
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 496
    3⤵
    - Program crash
    PID:456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2348 -ip 2348
1⤵
PID:4812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1928-130-0x0000000000DF0000-0x0000000000E96000-memory.dmp

Download

memory/1928-131-0x0000000005E30000-0x00000000063D4000-memory.dmp

Download

memory/1928-132-0x0000000005880000-0x0000000005912000-memory.dmp

Download

memory/2348-135-0x0000000001100000-0x0000000001179000-memory.dmp

Download

memory/2348-140-0x0000000001100000-0x0000000001179000-memory.dmp

Download

memory/2348-145-0x0000000001100000-0x0000000001179000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads