remcos | 6debeb4cbf5037ee3b4d23e3a005dc58ebb0f26ac5f5266e910187a66760a4a0

General

Target
STATEMENT OF ACCOUNTING APR,2022.exe
Size 683KB
Sample220510-efmj1shfgp
SHA256 6debeb4cbf5037ee3b4d23e3a005dc58ebb0f26ac5f5266e910187a66760a4a0
MD5 723775e2c2939d11d3a97be870a4f1ad
SHA1 f0f9db57f7816b4024fdb15f9f3b700c29c62745
SHA512 1c7ba1dbac3f75d6e7ecc9a5d0961f063d6af27383232f8de401adbf5af115c4c1392bb74dd276df3f223b3c576ad176dba9d68a2bdd2c96dbb3435fafc42f3f
MD5 SHA1 SHA512

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

172.94.88.13:5888

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-NQF7UP
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
2288	ppjdrzqvt.exe
4964	ppjdrzqvt.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gaclqo = "C:\\Users\\Admin\\AppData\\Roaming\\flfdae\\tsfyykcqrchh.exe"	ppjdrzqvt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2288	3008	STATEMENT OF ACCOUNTING APR,2022.exe	84
PID 3008 wrote to memory of 2288	3008	STATEMENT OF ACCOUNTING APR,2022.exe	84
PID 3008 wrote to memory of 2288	3008	STATEMENT OF ACCOUNTING APR,2022.exe	84
PID 2288 wrote to memory of 4964	2288	ppjdrzqvt.exe	85
PID 2288 wrote to memory of 4964	2288	ppjdrzqvt.exe	85
PID 2288 wrote to memory of 4964	2288	ppjdrzqvt.exe	85
PID 2288 wrote to memory of 4964	2288	ppjdrzqvt.exe	85
PID 2288 wrote to memory of 4964	2288	ppjdrzqvt.exe	85
PID 2288 wrote to memory of 4964	2288	ppjdrzqvt.exe	85
PID 2288 wrote to memory of 4964	2288	ppjdrzqvt.exe	85
PID 2288 wrote to memory of 4964	2288	ppjdrzqvt.exe	85
PID 2288 wrote to memory of 4964	2288	ppjdrzqvt.exe	85
PID 2288 wrote to memory of 4964	2288	ppjdrzqvt.exe	85
PID 2288 wrote to memory of 4964	2288	ppjdrzqvt.exe	85
PID 2288 wrote to memory of 4964	2288	ppjdrzqvt.exe	85

C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNTING APR,2022.exe
"C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNTING APR,2022.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Users\Admin\AppData\Local\Temp\ppjdrzqvt.exe
  C:\Users\Admin\AppData\Local\Temp\ppjdrzqvt.exe C:\Users\Admin\AppData\Local\Temp\fbvdvf
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Users\Admin\AppData\Local\Temp\ppjdrzqvt.exe
    C:\Users\Admin\AppData\Local\Temp\ppjdrzqvt.exe C:\Users\Admin\AppData\Local\Temp\fbvdvf
    3⤵
    - Executes dropped EXE
    PID:4964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fbvdvf

Path C:\Users\Admin\AppData\Local\Temp\fbvdvf
Size 7KB
SHA256 07c7877d85eddbee6d8a6397f4f5864ee8cc751c22bae8b3391aea895f79b47b
MD5 b65d4bf3274e654f171512a81a940dea
SHA1 e8d2ed8d5842fac71eb8900abd4ec4d1c993f97b
SHA512 4675742a4ec366f0744df20ff2a4b11e02dcc1a0f5d26b17dc4508fcbae9b5a8812573a647d952e314bc96e0633286bb5a378018a63a36b45b95849a24a4229b
SSDEEP 192:j/WGyxkIQgFT0tyUuc7hTdPOzR48x2RypgklNO2TPQWTe:j+dIg9yDuc1egkXO2TPxK
MD5 SHA1 SHA512 SSDEEP

Submit Download

ppjdrzqvt.exe

Path C:\Users\Admin\AppData\Local\Temp\ppjdrzqvt.exe
Size 78KB
SHA256 1d6ed9e9767d62883009fe9318ae308e68b2034fbc68f5b7aa6cdf156b275933
MD5 aa72cde542cbe8060d61876752e6787b
SHA1 7f2a6703cb99eb267d1d981305051c4d9b60d513
SHA512 158599372a28effd7f68c7aac99c04ee71ab8d471921f201e62a5987c309677c5b0f2cb94f444d7f90ac7ef5429fe401a296322128e3cfd9b1499d04b3968e47
SSDEEP 1536:9tYl5kp1qBjWJIoFxZesP+3Ybgkmmdccn3sWjcdv833nV:11GkIovjPowV4vO3
MD5 SHA1 SHA512 SSDEEP

Submit Download

ppjdrzqvt.exe

Path C:\Users\Admin\AppData\Local\Temp\ppjdrzqvt.exe
Size 78KB
SHA256 1d6ed9e9767d62883009fe9318ae308e68b2034fbc68f5b7aa6cdf156b275933
MD5 aa72cde542cbe8060d61876752e6787b
SHA1 7f2a6703cb99eb267d1d981305051c4d9b60d513
SHA512 158599372a28effd7f68c7aac99c04ee71ab8d471921f201e62a5987c309677c5b0f2cb94f444d7f90ac7ef5429fe401a296322128e3cfd9b1499d04b3968e47
SSDEEP 1536:9tYl5kp1qBjWJIoFxZesP+3Ybgkmmdccn3sWjcdv833nV:11GkIovjPowV4vO3
MD5 SHA1 SHA512 SSDEEP

Submit Download

ppjdrzqvt.exe

Path C:\Users\Admin\AppData\Local\Temp\ppjdrzqvt.exe
Size 78KB
SHA256 1d6ed9e9767d62883009fe9318ae308e68b2034fbc68f5b7aa6cdf156b275933
MD5 aa72cde542cbe8060d61876752e6787b
SHA1 7f2a6703cb99eb267d1d981305051c4d9b60d513
SHA512 158599372a28effd7f68c7aac99c04ee71ab8d471921f201e62a5987c309677c5b0f2cb94f444d7f90ac7ef5429fe401a296322128e3cfd9b1499d04b3968e47
SSDEEP 1536:9tYl5kp1qBjWJIoFxZesP+3Ybgkmmdccn3sWjcdv833nV:11GkIovjPowV4vO3
MD5 SHA1 SHA512 SSDEEP

Submit Download

uvrtb9ra9ac8rkcw3

Path C:\Users\Admin\AppData\Local\Temp\uvrtb9ra9ac8rkcw3
Size 463KB
SHA256 bbfaa08460f4e8097383384be166874e4b195338e5597e3482e85f970934cb9b
MD5 db77e8a0f97be120c91421ed3c2d28cb
SHA1 b9b8f932cab62388589b5816d69c7c4cdc295175
SHA512 51898170fefdeb245c87e021a728e9d579932530fc453b4fe97e2e1d5abad5728794f6a9988282e8736bc9b00dc718ca980437893d28914418091729adc0bbfa
SSDEEP 12288:TIx1JqB9U8HJgys3dySXTB7rcWCi7Unr6yLTt2PXTj:A1JqB9tays3dykwWynL5kj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4964-137-0x0000000000F70000-0x0000000000FEB000-memory.dmp

Download

memory/4964-142-0x0000000000F70000-0x0000000000FEB000-memory.dmp

Download

memory/4964-147-0x0000000000F70000-0x0000000000FEB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads