remcos | 932ca48307370d1019ade8c5f9312d6f96f7d565715f48f4a4c35a045702cef2

General

Target

RFQ TRQ22-06-20200051_pdf.exe
Size

315KB
MD5

154aa4440eee43b6472416eeb938f9e8
SHA1

643b61955b6743f33db01be7ecf93463fd887da1
SHA256

d69aa1932b2e702e5065ee19da9fc9cf2b05e7dbaa617141b14eaa501a14955e
SHA512

2a225d7128166394a26e226febd275f1ca1dead61666136008ff843b4a21eb0bf16a5b66c055a2d213d272d63c940d2cce02270475c9bb2551135a58cff77020

Score

10^/10

remcos xxxxxxxxxxxx rat

Malware Config

Extracted

Family

remcos

Version

2.5.1 Pro

Botnet

xxxxxxxxxxxx

C2

109.169.89.116:2021

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
s.sex
keylog_flag
false
keylog_folder
ssssss
keylog_path
%UserProfile%
mouse_option
false
mutex
fuckhere-M9W1LK
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ TRQ22-06-20200051_pdf.exe

description pid process target process

PID 1948 set thread context of 1700 1948 RFQ TRQ22-06-20200051_pdf.exe RFQ TRQ22-06-20200051_pdf.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1392 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

RFQ TRQ22-06-20200051_pdf.exe

pid process

1948 RFQ TRQ22-06-20200051_pdf.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RFQ TRQ22-06-20200051_pdf.exe

description pid process

Token: SeDebugPrivilege 1948 RFQ TRQ22-06-20200051_pdf.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RFQ TRQ22-06-20200051_pdf.exe

pid process

1700 RFQ TRQ22-06-20200051_pdf.exe

description	pid	process	target process
PID 1948 set thread context of 1700	1948	RFQ TRQ22-06-20200051_pdf.exe	RFQ TRQ22-06-20200051_pdf.exe

pid	process
1392	schtasks.exe

pid	process
1948	RFQ TRQ22-06-20200051_pdf.exe

description	pid	process
Token: SeDebugPrivilege	1948	RFQ TRQ22-06-20200051_pdf.exe

pid	process
1700	RFQ TRQ22-06-20200051_pdf.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

RFQ TRQ22-06-20200051_pdf.exe

description	pid	process	target process
PID 1948 wrote to memory of 1392	1948	RFQ TRQ22-06-20200051_pdf.exe	schtasks.exe
PID 1948 wrote to memory of 1392	1948	RFQ TRQ22-06-20200051_pdf.exe	schtasks.exe
PID 1948 wrote to memory of 1392	1948	RFQ TRQ22-06-20200051_pdf.exe	schtasks.exe
PID 1948 wrote to memory of 1392	1948	RFQ TRQ22-06-20200051_pdf.exe	schtasks.exe
PID 1948 wrote to memory of 1700	1948	RFQ TRQ22-06-20200051_pdf.exe	RFQ TRQ22-06-20200051_pdf.exe
PID 1948 wrote to memory of 1700	1948	RFQ TRQ22-06-20200051_pdf.exe	RFQ TRQ22-06-20200051_pdf.exe
PID 1948 wrote to memory of 1700	1948	RFQ TRQ22-06-20200051_pdf.exe	RFQ TRQ22-06-20200051_pdf.exe
PID 1948 wrote to memory of 1700	1948	RFQ TRQ22-06-20200051_pdf.exe	RFQ TRQ22-06-20200051_pdf.exe
PID 1948 wrote to memory of 1700	1948	RFQ TRQ22-06-20200051_pdf.exe	RFQ TRQ22-06-20200051_pdf.exe
PID 1948 wrote to memory of 1700	1948	RFQ TRQ22-06-20200051_pdf.exe	RFQ TRQ22-06-20200051_pdf.exe
PID 1948 wrote to memory of 1700	1948	RFQ TRQ22-06-20200051_pdf.exe	RFQ TRQ22-06-20200051_pdf.exe
PID 1948 wrote to memory of 1700	1948	RFQ TRQ22-06-20200051_pdf.exe	RFQ TRQ22-06-20200051_pdf.exe
PID 1948 wrote to memory of 1700	1948	RFQ TRQ22-06-20200051_pdf.exe	RFQ TRQ22-06-20200051_pdf.exe
PID 1948 wrote to memory of 1700	1948	RFQ TRQ22-06-20200051_pdf.exe	RFQ TRQ22-06-20200051_pdf.exe
PID 1948 wrote to memory of 1700	1948	RFQ TRQ22-06-20200051_pdf.exe	RFQ TRQ22-06-20200051_pdf.exe

C:\Users\Admin\AppData\Local\Temp\RFQ TRQ22-06-20200051_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ TRQ22-06-20200051_pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FAcxLxvdLu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9DA7.tmp"
2⤵
- Creates scheduled task(s)
PID:1392

C:\Users\Admin\AppData\Local\Temp\RFQ TRQ22-06-20200051_pdf.exe
"{path}"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1700

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9DA7.tmp
Filesize
1KB

MD5
f3a7ae1cc94ca28e1dc5086495751ede

SHA1
e80db9a98478247e2c8fab75338ca9bf8b654da3

SHA256
115e1d865c556a8e3b3de618cf64c360fc753f99986c4a785611e36f04d62f8a

SHA512
bb15929b88317edd6d13dbd2e2c992111f17272e5414dcbc7cf3a2ace9870d9170dd04a2bbdf08a8070ca7bd265f191fd4fe7fa8d4836b93c9d9d6508432e2e1

Download Submit
memory/1392-58-0x0000000000000000-mapping.dmp

Download
memory/1700-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1700-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1700-74-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1700-73-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1700-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1700-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1700-70-0x0000000000413B74-mapping.dmp

Download
memory/1700-67-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1700-66-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1700-69-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1948-57-0x0000000076191000-0x0000000076193000-memory.dmp

Filesize
8KB

Download
memory/1948-54-0x0000000000EB0000-0x0000000000F06000-memory.dmp

Filesize
344KB

Download
memory/1948-55-0x0000000000AB0000-0x0000000000ACC000-memory.dmp

Filesize
112KB

Download
memory/1948-56-0x0000000000C40000-0x0000000000C6E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads