remcos | 0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051

General

Target

0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe
Size

521KB
MD5

e03769d25fb4f047892dc577af8cb189
SHA1

081686667c5fe822ba5c5aa0aa4b700b9554154c
SHA256

0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051
SHA512

27617e449837285f2d7ac14c51bc33ca7f5dbbf878f34b7f8ed23d16306a4341a2e63cdf8f677044005093aaca32cc3f835d6cdb8125d2db83dad2085db864ef

Score

10^/10

remcos xxxxxxxxxxx persistence rat suricata

Malware Config

Extracted

Family

remcos

Version

2.7.0 Light

Botnet

xxxxxxxxxxx

C2

perrymason.ac.ug:6969

jkhxcvklsdflujkjhgdfuyter.ru:6969

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
cvxdsaxzcas-N6K9PL
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses
suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses
suricata

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Xzsb = "C:\\Users\\Admin\\AppData\\Local\\Xzsb.url"	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exe

pid process

3328 reg.exe
1096 reg.exe
1320 reg.exe
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 39 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
3328	reg.exe
1096	reg.exe
1320	reg.exe

description	flow	ioc
HTTP User-Agent header	39	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe

description	pid	process	target process
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe
PID 1716 wrote to memory of 3204	1716	0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe	Notepad.exe

C:\Users\Admin\AppData\Local\Temp\0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe
"C:\Users\Admin\AppData\Local\Temp\0827a7dae402e11610503a39435417f571b9392e3d024d9ccb09a024e3657051.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1716

C:\Windows\SysWOW64\Notepad.exe
"C:\Windows\System32\Notepad.exe"
2⤵
PID:3204

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Public\Natso.bat
3⤵
PID:1756

C:\Windows\SysWOW64\reg.exe
reg delete hkcu\Environment /v windir /f
4⤵
- Modifies registry key
PID:3328

C:\Windows\SysWOW64\reg.exe
reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "
4⤵
- Modifies registry key
PID:1096

C:\Windows\SysWOW64\schtasks.exe
schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
4⤵
PID:1104

C:\Windows\SysWOW64\reg.exe
reg delete hkcu\Environment /v windir /f
4⤵
- Modifies registry key
PID:1320

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Public\Natso.bat
3⤵
PID:3932

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
2⤵
PID:4136

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Natso.bat
Filesize
283B

MD5
5cc1682955fd9f5800a8f1530c9a4334

SHA1
e09b6a4d729f2f4760ee42520ec30c3192c85548

SHA256
5562cc607d2f698327efacc4a21bd079bb14a99b03e7a01b3c67f8440e341cb3

SHA512
80767263aad44c739236161d4338d5dd8b0b58613f22cd173c3e88ebf143220ee56bbf93ace69a07d3c2f00daff0adbaa8461a1d53d12699725395c931c43cb6

Download Submit
memory/1096-152-0x0000000000000000-mapping.dmp

Download
memory/1104-153-0x0000000000000000-mapping.dmp

Download
memory/1320-156-0x0000000000000000-mapping.dmp

Download
memory/1716-140-0x0000000050480000-0x000000005049A000-memory.dmp

Filesize
104KB

Download
memory/1716-131-0x0000000003CF0000-0x0000000003D41000-memory.dmp

Filesize
324KB

Download
memory/1716-154-0x0000000010530000-0x000000001054A000-memory.dmp

Filesize
104KB

Download
memory/1756-146-0x0000000000000000-mapping.dmp

Download
memory/3204-147-0x0000000050480000-0x000000005049A000-memory.dmp

Filesize
104KB

Download
memory/3204-139-0x0000000000000000-mapping.dmp

Download
memory/3328-151-0x0000000000000000-mapping.dmp

Download
memory/3932-159-0x0000000000000000-mapping.dmp

Download
memory/4136-149-0x0000000000000000-mapping.dmp

Download
memory/4136-157-0x0000000010530000-0x000000001054A000-memory.dmp

Filesize
104KB

Download
memory/4136-158-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing