remcos | 136323478fd3e7267b27501ec5842ec44521355cde59927d937592072f6eaf7d

General

Target

136323478fd3e7267b27501ec5842ec44521355cde59927d937592072f6eaf7d.exe
Size

601KB
MD5

acae2d53ce7306de623253231a20fbfd
SHA1

56d620570ac28af58bff4ef3a84c4881af1935dc
SHA256

136323478fd3e7267b27501ec5842ec44521355cde59927d937592072f6eaf7d
SHA512

ad5a451627c32c2c13960fa316916720b308689fa3f764c421481edaaa571fab6e8e338434d83909c0f889e0a2495dc87af2407f873d9fdc16ff4ee9a6a31b0d

Score

10^/10

remcos host persistence rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

chimmyxx.ipq.co:24462

chiboy22.ddns.net:24462

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
ffsgdgshdn.exe
copy_folder
Iexplorer
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
remcos_twxpgawnqoqduxy
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
4864	ffsgdgshdn.exe
4624	ffsgdgshdn.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	136323478fd3e7267b27501ec5842ec44521355cde59927d937592072f6eaf7d.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\Run\	136323478fd3e7267b27501ec5842ec44521355cde59927d937592072f6eaf7d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\Iexplorer\\ffsgdgshdn.exe\""	136323478fd3e7267b27501ec5842ec44521355cde59927d937592072f6eaf7d.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1128 set thread context of 4536	1128	136323478fd3e7267b27501ec5842ec44521355cde59927d937592072f6eaf7d.exe	85
PID 4864 set thread context of 4624	4864	ffsgdgshdn.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4704	PING.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1128	136323478fd3e7267b27501ec5842ec44521355cde59927d937592072f6eaf7d.exe
4864	ffsgdgshdn.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 4536	1128	136323478fd3e7267b27501ec5842ec44521355cde59927d937592072f6eaf7d.exe	85
PID 1128 wrote to memory of 4536	1128	136323478fd3e7267b27501ec5842ec44521355cde59927d937592072f6eaf7d.exe	85
PID 1128 wrote to memory of 4536	1128	136323478fd3e7267b27501ec5842ec44521355cde59927d937592072f6eaf7d.exe	85
PID 4536 wrote to memory of 948	4536	136323478fd3e7267b27501ec5842ec44521355cde59927d937592072f6eaf7d.exe	87
PID 4536 wrote to memory of 948	4536	136323478fd3e7267b27501ec5842ec44521355cde59927d937592072f6eaf7d.exe	87
PID 4536 wrote to memory of 948	4536	136323478fd3e7267b27501ec5842ec44521355cde59927d937592072f6eaf7d.exe	87
PID 948 wrote to memory of 4704	948	cmd.exe	89
PID 948 wrote to memory of 4704	948	cmd.exe	89
PID 948 wrote to memory of 4704	948	cmd.exe	89
PID 948 wrote to memory of 4864	948	cmd.exe	90
PID 948 wrote to memory of 4864	948	cmd.exe	90
PID 948 wrote to memory of 4864	948	cmd.exe	90
PID 4864 wrote to memory of 4624	4864	ffsgdgshdn.exe	91
PID 4864 wrote to memory of 4624	4864	ffsgdgshdn.exe	91
PID 4864 wrote to memory of 4624	4864	ffsgdgshdn.exe	91

C:\Users\Admin\AppData\Local\Temp\136323478fd3e7267b27501ec5842ec44521355cde59927d937592072f6eaf7d.exe
"C:\Users\Admin\AppData\Local\Temp\136323478fd3e7267b27501ec5842ec44521355cde59927d937592072f6eaf7d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Users\Admin\AppData\Local\Temp\136323478fd3e7267b27501ec5842ec44521355cde59927d937592072f6eaf7d.exe
  C:\Users\Admin\AppData\Local\Temp\136323478fd3e7267b27501ec5842ec44521355cde59927d937592072f6eaf7d.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:948
  - - C:\Windows\SysWOW64\PING.EXE
      PING 127.0.0.1 -n 2
      4⤵
      Runs ping.exe
      PID:4704
  - - C:\Users\Admin\AppData\Roaming\Iexplorer\ffsgdgshdn.exe
      "C:\Users\Admin\AppData\Roaming\Iexplorer\ffsgdgshdn.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4864
    - - C:\Users\Admin\AppData\Roaming\Iexplorer\ffsgdgshdn.exe
        
        C:\Users\Admin\AppData\Roaming\Iexplorer\ffsgdgshdn.exe"
        5⤵
        Executes dropped EXE
        
        PID:4624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.bat

Filesize
106B

MD5
e879aa5b99cecd71c3f4620e159ef15d

SHA1
c8a546f333cd0737dbbf248c9510c6e6ab69c1f8

SHA256
c8d41165b86621c6b916c65540c0eff6a5360caaefa48dbe70e37952ea422ee4

SHA512
815e7e0b492fb48b9116626750781d2acfc925779e48367cb1c0f888b190d10c3e819e9e6ca8a0b3c55f4fb90da41061d040b8473c97d182c371092cd8e83aa4

Download Submit
C:\Users\Admin\AppData\Roaming\Iexplorer\ffsgdgshdn.exe

Filesize
601KB

MD5
acae2d53ce7306de623253231a20fbfd

SHA1
56d620570ac28af58bff4ef3a84c4881af1935dc

SHA256
136323478fd3e7267b27501ec5842ec44521355cde59927d937592072f6eaf7d

SHA512
ad5a451627c32c2c13960fa316916720b308689fa3f764c421481edaaa571fab6e8e338434d83909c0f889e0a2495dc87af2407f873d9fdc16ff4ee9a6a31b0d

Download Submit
C:\Users\Admin\AppData\Roaming\Iexplorer\ffsgdgshdn.exe

Filesize
601KB

MD5
acae2d53ce7306de623253231a20fbfd

SHA1
56d620570ac28af58bff4ef3a84c4881af1935dc

SHA256
136323478fd3e7267b27501ec5842ec44521355cde59927d937592072f6eaf7d

SHA512
ad5a451627c32c2c13960fa316916720b308689fa3f764c421481edaaa571fab6e8e338434d83909c0f889e0a2495dc87af2407f873d9fdc16ff4ee9a6a31b0d

Download Submit
C:\Users\Admin\AppData\Roaming\Iexplorer\ffsgdgshdn.exe

Filesize
601KB

MD5
acae2d53ce7306de623253231a20fbfd

SHA1
56d620570ac28af58bff4ef3a84c4881af1935dc

SHA256
136323478fd3e7267b27501ec5842ec44521355cde59927d937592072f6eaf7d

SHA512
ad5a451627c32c2c13960fa316916720b308689fa3f764c421481edaaa571fab6e8e338434d83909c0f889e0a2495dc87af2407f873d9fdc16ff4ee9a6a31b0d

Download Submit
memory/1128-134-0x0000000077BA0000-0x0000000077D43000-memory.dmp

Filesize
1.6MB

Download
memory/1128-132-0x0000000002300000-0x0000000002307000-memory.dmp

Filesize
28KB

Download
memory/4536-137-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4536-141-0x0000000077BA0000-0x0000000077D43000-memory.dmp

Filesize
1.6MB

Download
memory/4864-151-0x0000000077BA0000-0x0000000077D43000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing