remcos | 5669b1eea4e4f305ea0d6f674e00638dcdb16dd08d15019996ac7f2317fdea41

Analysis

max time kernel
36s
max time network
44s
platform
windows7_x64
resource
win7-20220414-en
submitted
26/05/2022, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BL-INVOICE SHIPPING DOCUMENTS.exe
Size 544KB
Sample220526-mrm9paeefm
SHA256 900274d5916f078ac30bedfc6b3bf5812c09de4cc1bdddd4e25d5efa1e3bb1c3
MD5 ee78ff11f8acf5c63c5df8ee1a314462
SHA1 bda3f8d1087deacdc2827035a9075b17decf358a
SHA512 dd0292f33b908372c436836638cd6c53dd795726ad158a93b1b79fb3844be8b7ed1d95a5f101082d60710040aac53e9a062bb7a646db9410bf297434099102a0
MD5 SHA1 SHA512

Score

10^/10

remcos new persistence rat

Malware Config

Extracted

Family

remcos

Botnet

172.111.153.127:3033

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-6KKWZV
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
956	zaymjsmod.exe
1828	zaymjsmod.exe

Loads dropped DLL 5 IoCs

pid	Process
776	BL-INVOICE SHIPPING DOCUMENTS.exe
956	zaymjsmod.exe
800	WerFault.exe
800	WerFault.exe
800	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\avgf = "C:\\Users\\Admin\\AppData\\Roaming\\aiep\\ianhcjk.exe"	zaymjsmod.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
800	1828	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 956	776	BL-INVOICE SHIPPING DOCUMENTS.exe	28
PID 776 wrote to memory of 956	776	BL-INVOICE SHIPPING DOCUMENTS.exe	28
PID 776 wrote to memory of 956	776	BL-INVOICE SHIPPING DOCUMENTS.exe	28
PID 776 wrote to memory of 956	776	BL-INVOICE SHIPPING DOCUMENTS.exe	28
PID 956 wrote to memory of 1828	956	zaymjsmod.exe	29
PID 956 wrote to memory of 1828	956	zaymjsmod.exe	29
PID 956 wrote to memory of 1828	956	zaymjsmod.exe	29
PID 956 wrote to memory of 1828	956	zaymjsmod.exe	29
PID 956 wrote to memory of 1828	956	zaymjsmod.exe	29
PID 956 wrote to memory of 1828	956	zaymjsmod.exe	29
PID 956 wrote to memory of 1828	956	zaymjsmod.exe	29
PID 956 wrote to memory of 1828	956	zaymjsmod.exe	29
PID 956 wrote to memory of 1828	956	zaymjsmod.exe	29
PID 956 wrote to memory of 1828	956	zaymjsmod.exe	29
PID 956 wrote to memory of 1828	956	zaymjsmod.exe	29
PID 956 wrote to memory of 1828	956	zaymjsmod.exe	29
PID 956 wrote to memory of 1828	956	zaymjsmod.exe	29
PID 1828 wrote to memory of 800	1828	zaymjsmod.exe	30
PID 1828 wrote to memory of 800	1828	zaymjsmod.exe	30
PID 1828 wrote to memory of 800	1828	zaymjsmod.exe	30
PID 1828 wrote to memory of 800	1828	zaymjsmod.exe	30

C:\Users\Admin\AppData\Local\Temp\BL-INVOICE SHIPPING DOCUMENTS.exe
"C:\Users\Admin\AppData\Local\Temp\BL-INVOICE SHIPPING DOCUMENTS.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:776
- C:\Users\Admin\AppData\Local\Temp\zaymjsmod.exe
  C:\Users\Admin\AppData\Local\Temp\zaymjsmod.exe C:\Users\Admin\AppData\Local\Temp\qmkhkh
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Users\Admin\AppData\Local\Temp\zaymjsmod.exe
    C:\Users\Admin\AppData\Local\Temp\zaymjsmod.exe C:\Users\Admin\AppData\Local\Temp\qmkhkh
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1828
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 172
      4⤵
      Loads dropped DLL
      Program crash
      PID:800

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5tq9d2mjcoubez

Path C:\Users\Admin\AppData\Local\Temp\5tq9d2mjcoubez
Size 463KB
SHA256 38ec3228d00377e702f0b707ef7e869beb29945f05d529e24e1f252632c28ce7
MD5 2cb1db095e3576ff7f55cc6ffd0b2a5d
SHA1 b94ee185568392960724e4102cc289289c5827dc
SHA512 7b745ac226d8bc7add077fbe3fb93d54ae426a8938557228a6be2a6e23dd0173ef98158dedc9550ae0d1341f88e911cfcadf148bb5a681dd8110253be3e5722b
SSDEEP 12288:dsc5FV1xlUKrpJK28OtStCb0uu1l6h4paPhmag3nHx:dPj0Q8mY1l6h40PPEHx
MD5 SHA1 SHA512 SSDEEP

Submit Download

qmkhkh

Path C:\Users\Admin\AppData\Local\Temp\qmkhkh
Size 7KB
SHA256 4a453b7b84ff8234fe4661756022236d6a7b5092798db56b51e436cdc4d2c698
MD5 323519be7879abb266a72974f5bd771e
SHA1 73f6b3c9d1d115d521df6f26bb7fd3d09eb054ff
SHA512 444a66a9fbe657151e736c4f9107570514f7aec5596c6362b47a9dee9efa7791c725eb7f307d9a17ea86e8f1726036e98d8627daeac72139f420a3be26608b9b
SSDEEP 192:WPXpoeIndyz5RGwhn0pwYdiiWNeQCMjTEgBXQ:2z5RGwh0pzdz8eacgxQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

zaymjsmod.exe

Path C:\Users\Admin\AppData\Local\Temp\zaymjsmod.exe
Size 184KB
SHA256 c9c7b9634a4d5b49017f804207361a09ed20df84b5d31367278e51a8e5e5e75d
MD5 174d35b6fd242e24190fd130ea1d2df2
SHA1 21020cd355cbbdbda37eaa4e335bd32970d25270
SHA512 7b789813bf756f8732fa41bfc01250b82bd2f8cced848d8539bcc8e18f65d67fcbdd145eb521bb9b9c96e10844214808c7521d91d85c514da01d90b2e6cd8bbb
SSDEEP 3072:QwAlaoUr0/UcJV2Gj+UtGuRWP9bjWPNPFgvzSUaV3rjiygpb:DAJUKxJVxUZbjWFW9pb
MD5 SHA1 SHA512 SSDEEP

Submit Download

zaymjsmod.exe

Path C:\Users\Admin\AppData\Local\Temp\zaymjsmod.exe
Size 184KB
SHA256 c9c7b9634a4d5b49017f804207361a09ed20df84b5d31367278e51a8e5e5e75d
MD5 174d35b6fd242e24190fd130ea1d2df2
SHA1 21020cd355cbbdbda37eaa4e335bd32970d25270
SHA512 7b789813bf756f8732fa41bfc01250b82bd2f8cced848d8539bcc8e18f65d67fcbdd145eb521bb9b9c96e10844214808c7521d91d85c514da01d90b2e6cd8bbb
SSDEEP 3072:QwAlaoUr0/UcJV2Gj+UtGuRWP9bjWPNPFgvzSUaV3rjiygpb:DAJUKxJVxUZbjWFW9pb
MD5 SHA1 SHA512 SSDEEP

Submit Download

zaymjsmod.exe

Path C:\Users\Admin\AppData\Local\Temp\zaymjsmod.exe
Size 184KB
SHA256 c9c7b9634a4d5b49017f804207361a09ed20df84b5d31367278e51a8e5e5e75d
MD5 174d35b6fd242e24190fd130ea1d2df2
SHA1 21020cd355cbbdbda37eaa4e335bd32970d25270
SHA512 7b789813bf756f8732fa41bfc01250b82bd2f8cced848d8539bcc8e18f65d67fcbdd145eb521bb9b9c96e10844214808c7521d91d85c514da01d90b2e6cd8bbb
SSDEEP 3072:QwAlaoUr0/UcJV2Gj+UtGuRWP9bjWPNPFgvzSUaV3rjiygpb:DAJUKxJVxUZbjWFW9pb
MD5 SHA1 SHA512 SSDEEP

Submit Download

zaymjsmod.exe

Path \Users\Admin\AppData\Local\Temp\zaymjsmod.exe
Size 184KB
SHA256 c9c7b9634a4d5b49017f804207361a09ed20df84b5d31367278e51a8e5e5e75d
MD5 174d35b6fd242e24190fd130ea1d2df2
SHA1 21020cd355cbbdbda37eaa4e335bd32970d25270
SHA512 7b789813bf756f8732fa41bfc01250b82bd2f8cced848d8539bcc8e18f65d67fcbdd145eb521bb9b9c96e10844214808c7521d91d85c514da01d90b2e6cd8bbb
SSDEEP 3072:QwAlaoUr0/UcJV2Gj+UtGuRWP9bjWPNPFgvzSUaV3rjiygpb:DAJUKxJVxUZbjWFW9pb
MD5 SHA1 SHA512 SSDEEP

Submit Download

zaymjsmod.exe

Path \Users\Admin\AppData\Local\Temp\zaymjsmod.exe
Size 184KB
SHA256 c9c7b9634a4d5b49017f804207361a09ed20df84b5d31367278e51a8e5e5e75d
MD5 174d35b6fd242e24190fd130ea1d2df2
SHA1 21020cd355cbbdbda37eaa4e335bd32970d25270
SHA512 7b789813bf756f8732fa41bfc01250b82bd2f8cced848d8539bcc8e18f65d67fcbdd145eb521bb9b9c96e10844214808c7521d91d85c514da01d90b2e6cd8bbb
SSDEEP 3072:QwAlaoUr0/UcJV2Gj+UtGuRWP9bjWPNPFgvzSUaV3rjiygpb:DAJUKxJVxUZbjWFW9pb
MD5 SHA1 SHA512 SSDEEP

Submit Download

zaymjsmod.exe

Path \Users\Admin\AppData\Local\Temp\zaymjsmod.exe
Size 184KB
SHA256 c9c7b9634a4d5b49017f804207361a09ed20df84b5d31367278e51a8e5e5e75d
MD5 174d35b6fd242e24190fd130ea1d2df2
SHA1 21020cd355cbbdbda37eaa4e335bd32970d25270
SHA512 7b789813bf756f8732fa41bfc01250b82bd2f8cced848d8539bcc8e18f65d67fcbdd145eb521bb9b9c96e10844214808c7521d91d85c514da01d90b2e6cd8bbb
SSDEEP 3072:QwAlaoUr0/UcJV2Gj+UtGuRWP9bjWPNPFgvzSUaV3rjiygpb:DAJUKxJVxUZbjWFW9pb
MD5 SHA1 SHA512 SSDEEP

Submit Download

zaymjsmod.exe

Path \Users\Admin\AppData\Local\Temp\zaymjsmod.exe
Size 184KB
SHA256 c9c7b9634a4d5b49017f804207361a09ed20df84b5d31367278e51a8e5e5e75d
MD5 174d35b6fd242e24190fd130ea1d2df2
SHA1 21020cd355cbbdbda37eaa4e335bd32970d25270
SHA512 7b789813bf756f8732fa41bfc01250b82bd2f8cced848d8539bcc8e18f65d67fcbdd145eb521bb9b9c96e10844214808c7521d91d85c514da01d90b2e6cd8bbb
SSDEEP 3072:QwAlaoUr0/UcJV2Gj+UtGuRWP9bjWPNPFgvzSUaV3rjiygpb:DAJUKxJVxUZbjWFW9pb
MD5 SHA1 SHA512 SSDEEP

Submit Download

zaymjsmod.exe

Path \Users\Admin\AppData\Local\Temp\zaymjsmod.exe
Size 184KB
SHA256 c9c7b9634a4d5b49017f804207361a09ed20df84b5d31367278e51a8e5e5e75d
MD5 174d35b6fd242e24190fd130ea1d2df2
SHA1 21020cd355cbbdbda37eaa4e335bd32970d25270
SHA512 7b789813bf756f8732fa41bfc01250b82bd2f8cced848d8539bcc8e18f65d67fcbdd145eb521bb9b9c96e10844214808c7521d91d85c514da01d90b2e6cd8bbb
SSDEEP 3072:QwAlaoUr0/UcJV2Gj+UtGuRWP9bjWPNPFgvzSUaV3rjiygpb:DAJUKxJVxUZbjWFW9pb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/776-54-0x00000000753B1000-0x00000000753B3000-memory.dmp

Download

memory/1828-76-0x0000000000080000-0x00000000000FB000-memory.dmp

Download

memory/1828-70-0x0000000000080000-0x00000000000FB000-memory.dmp

Download

memory/1828-65-0x0000000000080000-0x00000000000FB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads