remcos | 511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49

General

Target

511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe
Size

620KB
MD5

2a88af960ce758f837016434feabcbd4
SHA1

4e6d0cc285515f8a28e59a79d59257138f1f4999
SHA256

511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49
SHA512

090e786519b3ca5a73db6ceb8d199fc3d7eb796e9f64aa390d78d6a688aea4bb1fa83a76bfacab1aab95b922ce6c933c4a24447bd3683c25e43c68b5a253bed2

Score

10^/10

remcos xxxxxxxxxxx persistence rat

Malware Config

Extracted

Family

remcos

Version

2.7.1 Light

Botnet

xxxxxxxxxxx

C2

perrymason.ac.ug:6969

macapslafg.ug:6969

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
cvxdsaxzcas-C19IL8
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bcgw = "C:\\Users\\Admin\\AppData\\Local\\wgcB.url"	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Modifies registry key 1 TTPs 3 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exe

pid process

2156 reg.exe
2180 reg.exe
2208 reg.exe

pid	process
2156	reg.exe
2180	reg.exe
2208	reg.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe

description	pid	process	target process
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe
PID 1640 wrote to memory of 1932	1640	511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe	Notepad.exe

C:\Users\Admin\AppData\Local\Temp\511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe
"C:\Users\Admin\AppData\Local\Temp\511f80f432a9e567ed622957540923b74f91eaec6a3abf87005e803b23e7ad49.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\Notepad.exe
"C:\Windows\System32\Notepad.exe"
2⤵
PID:1932

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Public\Natso.bat
3⤵
PID:2076

C:\Windows\SysWOW64\reg.exe
reg delete hkcu\Environment /v windir /f
4⤵
- Modifies registry key
PID:2156

C:\Windows\SysWOW64\reg.exe
reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "
4⤵
- Modifies registry key
PID:2180

C:\Windows\SysWOW64\schtasks.exe
schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
4⤵
PID:2192

C:\Windows\SysWOW64\reg.exe
reg delete hkcu\Environment /v windir /f
4⤵
- Modifies registry key
PID:2208

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Public\Natso.bat
3⤵
PID:2244

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
2⤵
PID:2104

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Natso.bat
Filesize
283B

MD5
5cc1682955fd9f5800a8f1530c9a4334

SHA1
e09b6a4d729f2f4760ee42520ec30c3192c85548

SHA256
5562cc607d2f698327efacc4a21bd079bb14a99b03e7a01b3c67f8440e341cb3

SHA512
80767263aad44c739236161d4338d5dd8b0b58613f22cd173c3e88ebf143220ee56bbf93ace69a07d3c2f00daff0adbaa8461a1d53d12699725395c931c43cb6

Download Submit
memory/1640-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1932-55-0x0000000000000000-mapping.dmp

Download
memory/1932-57-0x0000000050480000-0x000000005049A000-memory.dmp

Filesize
104KB

Download
memory/1932-60-0x0000000050480000-0x000000005049A000-memory.dmp

Filesize
104KB

Download
memory/2076-59-0x0000000000000000-mapping.dmp

Download
memory/2104-62-0x0000000010530000-0x000000001054B000-memory.dmp

Filesize
108KB

Download
memory/2104-61-0x0000000000000000-mapping.dmp

Download
memory/2104-70-0x0000000010530000-0x000000001054B000-memory.dmp

Filesize
108KB

Download
memory/2104-71-0x00000000002E0000-0x00000000002F8000-memory.dmp

Filesize
96KB

Download
memory/2156-66-0x0000000000000000-mapping.dmp

Download
memory/2180-67-0x0000000000000000-mapping.dmp

Download
memory/2192-68-0x0000000000000000-mapping.dmp

Download
memory/2208-69-0x0000000000000000-mapping.dmp

Download
memory/2244-72-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing