remcos | b528b21b9d7de9c759e0249ae2d30582255cc370f159eb9cd6a115da0f9923dc

General

Target

Request for quotation and No_863972 order,pdf.exe
Size

544KB
MD5

e84d1f5c3a8f6c79d8516f221104191c
SHA1

a8b97e5f46d406c15c0abb55accf6fe2da3dfbec
SHA256

e17255079fd94918e8e003447c4698ec67af308f62fdadec71e9751d24d5d93f
SHA512

eb5257c6f0e649f7418a77b6f4840fb39e6d6dcb68e53a26790bf3909e9a7af533624679dc75aac3b5e37d9d267228d04002fa358a2d46372d9219fed4e88f6a

Score

10^/10

remcos september boy evasion rat

Malware Config

Extracted

Family

remcos

Version

2.7.0 Pro

Botnet

september boy

C2

jackyjian1965.hopto.org:5285

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-C4E1UN
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Request for quotation and No_863972 order,pdf.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Request for quotation and No_863972 order,pdf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Request for quotation and No_863972 order,pdf.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Request for quotation and No_863972 order,pdf.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Request for quotation and No_863972 order,pdf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	Request for quotation and No_863972 order,pdf.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Request for quotation and No_863972 order,pdf.exe

description pid process target process

PID 1956 set thread context of 1368 1956 Request for quotation and No_863972 order,pdf.exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

596 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Request for quotation and No_863972 order,pdf.exe

pid process

1956 Request for quotation and No_863972 order,pdf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Request for quotation and No_863972 order,pdf.exe

description pid process

Token: SeDebugPrivilege 1956 Request for quotation and No_863972 order,pdf.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

1368 vbc.exe

description	pid	process	target process
PID 1956 set thread context of 1368	1956	Request for quotation and No_863972 order,pdf.exe	vbc.exe

pid	process
596	schtasks.exe

pid	process
1956	Request for quotation and No_863972 order,pdf.exe

description	pid	process
Token: SeDebugPrivilege	1956	Request for quotation and No_863972 order,pdf.exe

pid	process
1368	vbc.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Request for quotation and No_863972 order,pdf.exe

description	pid	process	target process
PID 1956 wrote to memory of 596	1956	Request for quotation and No_863972 order,pdf.exe	schtasks.exe
PID 1956 wrote to memory of 596	1956	Request for quotation and No_863972 order,pdf.exe	schtasks.exe
PID 1956 wrote to memory of 596	1956	Request for quotation and No_863972 order,pdf.exe	schtasks.exe
PID 1956 wrote to memory of 596	1956	Request for quotation and No_863972 order,pdf.exe	schtasks.exe
PID 1956 wrote to memory of 1368	1956	Request for quotation and No_863972 order,pdf.exe	vbc.exe
PID 1956 wrote to memory of 1368	1956	Request for quotation and No_863972 order,pdf.exe	vbc.exe
PID 1956 wrote to memory of 1368	1956	Request for quotation and No_863972 order,pdf.exe	vbc.exe
PID 1956 wrote to memory of 1368	1956	Request for quotation and No_863972 order,pdf.exe	vbc.exe
PID 1956 wrote to memory of 1368	1956	Request for quotation and No_863972 order,pdf.exe	vbc.exe
PID 1956 wrote to memory of 1368	1956	Request for quotation and No_863972 order,pdf.exe	vbc.exe
PID 1956 wrote to memory of 1368	1956	Request for quotation and No_863972 order,pdf.exe	vbc.exe
PID 1956 wrote to memory of 1368	1956	Request for quotation and No_863972 order,pdf.exe	vbc.exe
PID 1956 wrote to memory of 1368	1956	Request for quotation and No_863972 order,pdf.exe	vbc.exe
PID 1956 wrote to memory of 1368	1956	Request for quotation and No_863972 order,pdf.exe	vbc.exe
PID 1956 wrote to memory of 1368	1956	Request for quotation and No_863972 order,pdf.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\Request for quotation and No_863972 order,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Request for quotation and No_863972 order,pdf.exe"
1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBRulPV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2FF7.tmp"
2⤵
- Creates scheduled task(s)
PID:596

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1368

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Scripting

1

T1064

Credential Access

Discovery

Query Registry

4

T1012

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2FF7.tmp
Filesize
1KB

MD5
eb44c35030593825f5be649b5b13c9bc

SHA1
3d3c09a4fd13b5b88ad4ed87431e48c34918ca98

SHA256
f4dfa43e050c86a173c87e5dfc05ef30a20926c0b4f5c8fc082569c87994da84

SHA512
03a933b0d1f9709b2583d0219d75ea6725299e86485b0f5e42e00da5302be33af5d4f136437eacf312e299298119581a0f26e46deb7a4d1cd7dd3a0cce662551

Download Submit
memory/596-59-0x0000000000000000-mapping.dmp

Download
memory/1368-66-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1368-70-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1368-75-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1368-74-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1368-71-0x0000000000413E54-mapping.dmp

Download
memory/1368-61-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1368-62-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1368-64-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1368-67-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1368-68-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1956-55-0x0000000075F61000-0x0000000075F63000-memory.dmp

Filesize
8KB

Download
memory/1956-54-0x0000000000860000-0x00000000008EE000-memory.dmp

Filesize
568KB

Download
memory/1956-57-0x0000000004EE0000-0x0000000004F3C000-memory.dmp

Filesize
368KB

Download
memory/1956-56-0x00000000004C0000-0x00000000004D0000-memory.dmp

Filesize
64KB

Download
memory/1956-58-0x0000000002010000-0x0000000002046000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads