remcos | 94b791ca9e928c7c8b03d1690221f50bd111425b76e7043a4a4a9232a6501415

General

Target

Offer Request 6100003768,pdf.exe
Size

289KB
MD5

b41cc5d5d29433eba84d43adae2f53aa
SHA1

985bd980736009c65be2b0307a18abe01cdcd6ab
SHA256

313a41fbc3104d06f0930f422d0ac01d6113cbe01be85c9024873ee7f0214b02
SHA512

a12b232bfa41c4e2d9b9d64cdac37642fd33ec619eed65a270b2333fd31b81bd133095ef33a4069518f58263d7e0947a399898cd2b6b6b951e82b824349e4d6b

Score

10^/10

remcos remotehost coreentity rat rezer0

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

RemoteHost

C2

ifeanyiogbunebe.ddns.net:1965

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-30G8UD
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

CoreEntity .NET Packer 1 IoCs

A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

coreentity

Processes:

resource	yara_rule
behavioral1/memory/1920-56-0x0000000000310000-0x0000000000318000-memory.dmp	coreentity

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/1920-57-0x0000000000910000-0x000000000093C000-memory.dmp	rezer0

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

Offer Request 6100003768,pdf.exe

description pid process target process

PID 1920 set thread context of 1776 1920 Offer Request 6100003768,pdf.exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1152 schtasks.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

1776 vbc.exe

description	pid	process	target process
PID 1920 set thread context of 1776	1920	Offer Request 6100003768,pdf.exe	vbc.exe

pid	process
1152	schtasks.exe

pid	process
1776	vbc.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Offer Request 6100003768,pdf.exe

description	pid	process	target process
PID 1920 wrote to memory of 1152	1920	Offer Request 6100003768,pdf.exe	schtasks.exe
PID 1920 wrote to memory of 1152	1920	Offer Request 6100003768,pdf.exe	schtasks.exe
PID 1920 wrote to memory of 1152	1920	Offer Request 6100003768,pdf.exe	schtasks.exe
PID 1920 wrote to memory of 1152	1920	Offer Request 6100003768,pdf.exe	schtasks.exe
PID 1920 wrote to memory of 1776	1920	Offer Request 6100003768,pdf.exe	vbc.exe
PID 1920 wrote to memory of 1776	1920	Offer Request 6100003768,pdf.exe	vbc.exe
PID 1920 wrote to memory of 1776	1920	Offer Request 6100003768,pdf.exe	vbc.exe
PID 1920 wrote to memory of 1776	1920	Offer Request 6100003768,pdf.exe	vbc.exe
PID 1920 wrote to memory of 1776	1920	Offer Request 6100003768,pdf.exe	vbc.exe
PID 1920 wrote to memory of 1776	1920	Offer Request 6100003768,pdf.exe	vbc.exe
PID 1920 wrote to memory of 1776	1920	Offer Request 6100003768,pdf.exe	vbc.exe
PID 1920 wrote to memory of 1776	1920	Offer Request 6100003768,pdf.exe	vbc.exe
PID 1920 wrote to memory of 1776	1920	Offer Request 6100003768,pdf.exe	vbc.exe
PID 1920 wrote to memory of 1776	1920	Offer Request 6100003768,pdf.exe	vbc.exe
PID 1920 wrote to memory of 1776	1920	Offer Request 6100003768,pdf.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\Offer Request 6100003768,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Offer Request 6100003768,pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EvVOvjDGKzkGs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6B90.tmp"
2⤵
- Creates scheduled task(s)
PID:1152

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"{path}"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1776

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6B90.tmp
Filesize
1KB

MD5
4e2777b8c0225027db898ea6f2c10d25

SHA1
0bd15d39fb32230ceb3d69fadc4d75fd2e5c815a

SHA256
e95a46725835b205b150f842f6bed2c2fb52ad01552ce5c35bda18a92f41e2f4

SHA512
6150db925b69d6779fc8201282ca889586090c3505c1920707e55a73c14c4ecca9ad138fa95b0126e4dcab5db963bbaf723d12ab87d2470872220a3f362d677d

Download Submit
memory/1152-58-0x0000000000000000-mapping.dmp

Download
memory/1776-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1776-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1776-74-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1776-73-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1776-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1776-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1776-70-0x0000000000413A84-mapping.dmp

Download
memory/1776-69-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1776-66-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1776-67-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1920-57-0x0000000000910000-0x000000000093C000-memory.dmp

Filesize
176KB

Download
memory/1920-54-0x0000000000270000-0x00000000002BE000-memory.dmp

Filesize
312KB

Download
memory/1920-55-0x0000000075F61000-0x0000000075F63000-memory.dmp

Filesize
8KB

Download
memory/1920-56-0x0000000000310000-0x0000000000318000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads