remcos | 94b791ca9e928c7c8b03d1690221f50bd111425b76e7043a4a4a9232a6501415

General

Target

Offer Request 6100003768,pdf.exe
Size

289KB
MD5

b41cc5d5d29433eba84d43adae2f53aa
SHA1

985bd980736009c65be2b0307a18abe01cdcd6ab
SHA256

313a41fbc3104d06f0930f422d0ac01d6113cbe01be85c9024873ee7f0214b02
SHA512

a12b232bfa41c4e2d9b9d64cdac37642fd33ec619eed65a270b2333fd31b81bd133095ef33a4069518f58263d7e0947a399898cd2b6b6b951e82b824349e4d6b

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

RemoteHost

C2

ifeanyiogbunebe.ddns.net:1965

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-30G8UD
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Offer Request 6100003768,pdf.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	Offer Request 6100003768,pdf.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

Offer Request 6100003768,pdf.exe

description pid process target process

PID 1616 set thread context of 5048 1616 Offer Request 6100003768,pdf.exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

5116 schtasks.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

5048 vbc.exe

description	pid	process	target process
PID 1616 set thread context of 5048	1616	Offer Request 6100003768,pdf.exe	vbc.exe

pid	process
5116	schtasks.exe

pid	process
5048	vbc.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

Offer Request 6100003768,pdf.exe

description	pid	process	target process
PID 1616 wrote to memory of 5116	1616	Offer Request 6100003768,pdf.exe	schtasks.exe
PID 1616 wrote to memory of 5116	1616	Offer Request 6100003768,pdf.exe	schtasks.exe
PID 1616 wrote to memory of 5116	1616	Offer Request 6100003768,pdf.exe	schtasks.exe
PID 1616 wrote to memory of 5048	1616	Offer Request 6100003768,pdf.exe	vbc.exe
PID 1616 wrote to memory of 5048	1616	Offer Request 6100003768,pdf.exe	vbc.exe
PID 1616 wrote to memory of 5048	1616	Offer Request 6100003768,pdf.exe	vbc.exe
PID 1616 wrote to memory of 5048	1616	Offer Request 6100003768,pdf.exe	vbc.exe
PID 1616 wrote to memory of 5048	1616	Offer Request 6100003768,pdf.exe	vbc.exe
PID 1616 wrote to memory of 5048	1616	Offer Request 6100003768,pdf.exe	vbc.exe
PID 1616 wrote to memory of 5048	1616	Offer Request 6100003768,pdf.exe	vbc.exe
PID 1616 wrote to memory of 5048	1616	Offer Request 6100003768,pdf.exe	vbc.exe
PID 1616 wrote to memory of 5048	1616	Offer Request 6100003768,pdf.exe	vbc.exe
PID 1616 wrote to memory of 5048	1616	Offer Request 6100003768,pdf.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\Offer Request 6100003768,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Offer Request 6100003768,pdf.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1616

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\EvVOvjDGKzkGs" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF39C.tmp"
2⤵
- Creates scheduled task(s)
PID:5116

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"{path}"
2⤵
- Suspicious use of SetWindowsHookEx
PID:5048

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF39C.tmp
Filesize
1KB

MD5
2c14e4cf2e7f3fc4aa69127c83aabe8d

SHA1
3a134a03d95d2cfc6e6e201146d4b65c619aae40

SHA256
090e892ad69ad36b81df2422c7646d37c350469402865759173248c8dcb6d568

SHA512
6d9f2f8ee3dc953c7add8d06849093c541380a2d305b16a96abba395227f0391d226f910d95d2611e666168cfbe46204e54fc14f9c15e81bcd4f8d6358f7d602

Download Submit
memory/1616-130-0x0000000000F40000-0x0000000000F8E000-memory.dmp

Filesize
312KB

Download
memory/1616-131-0x0000000005FF0000-0x0000000006594000-memory.dmp

Filesize
5.6MB

Download
memory/1616-132-0x0000000005920000-0x00000000059B2000-memory.dmp

Filesize
584KB

Download
memory/1616-133-0x00000000059D0000-0x00000000059DA000-memory.dmp

Filesize
40KB

Download
memory/1616-134-0x00000000092B0000-0x000000000934C000-memory.dmp

Filesize
624KB

Download
memory/5048-137-0x0000000000000000-mapping.dmp

Download
memory/5048-138-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5048-140-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5048-141-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5116-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads