remcos | ba8d32d0c7844fdd2e5c4311fc6dc7a400d7c1ff97bebd9760d62308c669fb8f

General

Target
( PRE-ALERT) BL INF222300126.exe
Size 500KB
Sample220509-kcfvyscgf8
SHA256 ba8d32d0c7844fdd2e5c4311fc6dc7a400d7c1ff97bebd9760d62308c669fb8f
MD5 f38e504fbd59c1a0e71a4d2e381c3f9c
SHA1 90d915f7953812ca0153a8e4a65c0e65a96c6fe8
SHA512 f76b86f7322fb2f4a69546e53b5ec5e5d27dff2d2b3dead095615aaff2cdc7ac0e410cf2ceadc3360997bfda0debc90229d2fcd0c07dd82bd1093527d3be6e7a
MD5 SHA1 SHA512

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

172.94.88.13:5888

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-NQF7UP
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
4568	bojawlyxxv.exe
3792	bojawlyxxv.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\alkk = "C:\\Users\\Admin\\AppData\\Roaming\\yvnculvyhbubdh\\wvriarrqtfddba.exe"	bojawlyxxv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 4568	2876	( PRE-ALERT) BL INF222300126.exe	81
PID 2876 wrote to memory of 4568	2876	( PRE-ALERT) BL INF222300126.exe	81
PID 2876 wrote to memory of 4568	2876	( PRE-ALERT) BL INF222300126.exe	81
PID 4568 wrote to memory of 3792	4568	bojawlyxxv.exe	82
PID 4568 wrote to memory of 3792	4568	bojawlyxxv.exe	82
PID 4568 wrote to memory of 3792	4568	bojawlyxxv.exe	82
PID 4568 wrote to memory of 3792	4568	bojawlyxxv.exe	82
PID 4568 wrote to memory of 3792	4568	bojawlyxxv.exe	82
PID 4568 wrote to memory of 3792	4568	bojawlyxxv.exe	82
PID 4568 wrote to memory of 3792	4568	bojawlyxxv.exe	82
PID 4568 wrote to memory of 3792	4568	bojawlyxxv.exe	82
PID 4568 wrote to memory of 3792	4568	bojawlyxxv.exe	82
PID 4568 wrote to memory of 3792	4568	bojawlyxxv.exe	82
PID 4568 wrote to memory of 3792	4568	bojawlyxxv.exe	82
PID 4568 wrote to memory of 3792	4568	bojawlyxxv.exe	82

C:\Users\Admin\AppData\Local\Temp\( PRE-ALERT) BL INF222300126.exe
"C:\Users\Admin\AppData\Local\Temp\( PRE-ALERT) BL INF222300126.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Users\Admin\AppData\Local\Temp\bojawlyxxv.exe
  C:\Users\Admin\AppData\Local\Temp\bojawlyxxv.exe C:\Users\Admin\AppData\Local\Temp\xmzjzkhh
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Users\Admin\AppData\Local\Temp\bojawlyxxv.exe
    C:\Users\Admin\AppData\Local\Temp\bojawlyxxv.exe C:\Users\Admin\AppData\Local\Temp\xmzjzkhh
    3⤵
    - Executes dropped EXE
    PID:3792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

30el11xqia9m

Path C:\Users\Admin\AppData\Local\Temp\30el11xqia9m
Size 463KB
SHA256 ae2d61d6ebcb799364379a72a38982fabb6034fc3d501163b689a168e6ef2ef5
MD5 2e7764a0e97fc14e98301fd6fbd96b91
SHA1 457357ed93c4c14e0a596070789a823123ec5c46
SHA512 4d840746b6e669ddea6cd23ac94012ef60f1f2ae97cde02d0f3432274fc1b2c85fc55e834bdb613faa44a7e005468a5245fca47fc48254ce4f95d3c6f8bcb9c7
SSDEEP 12288:CabGnnfGSd041RX85WQjZ80Ju2KsyES856PNlhbaof:CaifJq4PX80Qu0NyES8ghay
MD5 SHA1 SHA512 SSDEEP

Submit Download

bojawlyxxv.exe

Path C:\Users\Admin\AppData\Local\Temp\bojawlyxxv.exe
Size 75KB
SHA256 d2aa981d03dc43fd50a0449b6870b354313a53ef54bee69eef75044fe31fe510
MD5 e07c3c2bf454469e66c22dbcf99c4b15
SHA1 abcc8825313e710597078fd6c2653590c91c5365
SHA512 7495f11524c253e9092ec28c082f31db1bb090bf67f0c94e7f0d2709decd1712b6cc9c1103c44f33b42e6dbb67ff816a658fcd1e0ae2575a8122f9c99b53c338
SSDEEP 1536:pQWLwFql5zPLxbXwTQ6eh6n3Ybgc+25cc3MDsWjcdhs:HUFyPd563khcshs
MD5 SHA1 SHA512 SSDEEP

Submit Download

bojawlyxxv.exe

Path C:\Users\Admin\AppData\Local\Temp\bojawlyxxv.exe
Size 75KB
SHA256 d2aa981d03dc43fd50a0449b6870b354313a53ef54bee69eef75044fe31fe510
MD5 e07c3c2bf454469e66c22dbcf99c4b15
SHA1 abcc8825313e710597078fd6c2653590c91c5365
SHA512 7495f11524c253e9092ec28c082f31db1bb090bf67f0c94e7f0d2709decd1712b6cc9c1103c44f33b42e6dbb67ff816a658fcd1e0ae2575a8122f9c99b53c338
SSDEEP 1536:pQWLwFql5zPLxbXwTQ6eh6n3Ybgc+25cc3MDsWjcdhs:HUFyPd563khcshs
MD5 SHA1 SHA512 SSDEEP

Submit Download

bojawlyxxv.exe

Path C:\Users\Admin\AppData\Local\Temp\bojawlyxxv.exe
Size 75KB
SHA256 d2aa981d03dc43fd50a0449b6870b354313a53ef54bee69eef75044fe31fe510
MD5 e07c3c2bf454469e66c22dbcf99c4b15
SHA1 abcc8825313e710597078fd6c2653590c91c5365
SHA512 7495f11524c253e9092ec28c082f31db1bb090bf67f0c94e7f0d2709decd1712b6cc9c1103c44f33b42e6dbb67ff816a658fcd1e0ae2575a8122f9c99b53c338
SSDEEP 1536:pQWLwFql5zPLxbXwTQ6eh6n3Ybgc+25cc3MDsWjcdhs:HUFyPd563khcshs
MD5 SHA1 SHA512 SSDEEP

Submit Download

xmzjzkhh

Path C:\Users\Admin\AppData\Local\Temp\xmzjzkhh
Size 7KB
SHA256 919cdd36920246395d3e10313543f250676e9e45450464e0ee2cd3dfcf267e34
MD5 bfa0275fbbffd6d748cf22638d6c3399
SHA1 c51fc4e709b5167a1d0917b146f4f4700388b7a5
SHA512 5c213846ba1bd7c3df60bf535d75a499976a0fd5bfc16bf9a20a100f650a6388c43ac1e571bdd6e9812df54f1138ba539e840215c456198c2f1c53b01a1d3c87
SSDEEP 192:kDFctEQ1/yC/gZ73/b+hALWDRMvAJ1ugxBi8ZzQfxZDM3SAvI8UpD/VjinZ7c1:YFctEyHub+hALWDRMvAJ1ueBi8ZzQfl7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3792-137-0x0000000000420000-0x000000000049B000-memory.dmp

Download

memory/3792-142-0x0000000000420000-0x000000000049B000-memory.dmp

Download

memory/3792-147-0x0000000000420000-0x000000000049B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads