remcos | e1f130eaed82441c051ac3c8869fa7c76b3d60810a2b641b3bfb70cfdbdf9b1b

General

Target
PO-202206688474799388u8747hf34574-0007456829fh87921_doc.exe
Size 470KB
Sample220603-sefa7sadc4
SHA256 e1f130eaed82441c051ac3c8869fa7c76b3d60810a2b641b3bfb70cfdbdf9b1b
MD5 0a8b520df98bd9d297863955a3e19bc6
SHA1 c44b00d8ba4f32ea05a7d8f97f093dd3fde48171
SHA512 b1c1fe9cbd5f1316f9b33ce2e2c16270425ce426c14b4fb90ddee25ef55a588deec8a4ebc31618786567671760ba8ae2658bfebadf372f71d0183eb26cf9669f
MD5 SHA1 SHA512

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

172.94.127.61:5888

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-D2IMG2
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
2700	wcsdp.exe
4236	wcsdp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\auxr = "C:\\Users\\Admin\\AppData\\Roaming\\xgajylrfivyvan\\wgfqernxubhxy.exe"	wcsdp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2700	2256	PO-202206688474799388u8747hf34574-0007456829fh87921_doc.exe	78
PID 2256 wrote to memory of 2700	2256	PO-202206688474799388u8747hf34574-0007456829fh87921_doc.exe	78
PID 2256 wrote to memory of 2700	2256	PO-202206688474799388u8747hf34574-0007456829fh87921_doc.exe	78
PID 2700 wrote to memory of 4236	2700	wcsdp.exe	80
PID 2700 wrote to memory of 4236	2700	wcsdp.exe	80
PID 2700 wrote to memory of 4236	2700	wcsdp.exe	80
PID 2700 wrote to memory of 4236	2700	wcsdp.exe	80
PID 2700 wrote to memory of 4236	2700	wcsdp.exe	80
PID 2700 wrote to memory of 4236	2700	wcsdp.exe	80
PID 2700 wrote to memory of 4236	2700	wcsdp.exe	80
PID 2700 wrote to memory of 4236	2700	wcsdp.exe	80
PID 2700 wrote to memory of 4236	2700	wcsdp.exe	80
PID 2700 wrote to memory of 4236	2700	wcsdp.exe	80
PID 2700 wrote to memory of 4236	2700	wcsdp.exe	80
PID 2700 wrote to memory of 4236	2700	wcsdp.exe	80

C:\Users\Admin\AppData\Local\Temp\PO-202206688474799388u8747hf34574-0007456829fh87921_doc.exe
"C:\Users\Admin\AppData\Local\Temp\PO-202206688474799388u8747hf34574-0007456829fh87921_doc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\wcsdp.exe
  C:\Users\Admin\AppData\Local\Temp\wcsdp.exe C:\Users\Admin\AppData\Local\Temp\pvjyeujzbs
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Users\Admin\AppData\Local\Temp\wcsdp.exe
    C:\Users\Admin\AppData\Local\Temp\wcsdp.exe C:\Users\Admin\AppData\Local\Temp\pvjyeujzbs
    3⤵
    - Executes dropped EXE
    PID:4236

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

czzqqs7z2cifuy3cn2l

Path C:\Users\Admin\AppData\Local\Temp\czzqqs7z2cifuy3cn2l
Size 463KB
SHA256 3fd5e4a0b7c6a0b1bb5b67f43c31709ed972b7b9b82ed3c8e319169f7e70fae8
MD5 c97372172c591cd889e3c27f9e916a1b
SHA1 c4d9c03e5343666773b33a92a30a68169c8e9dae
SHA512 04a883db978a9215abd12d1bb61e1a3a598bb885dbaeaeb0f6607dfc2adc98a3e2787728562bedcec3710fb7cab396e99f639200c04e0132a4ccc28da90c9d6c
SSDEEP 6144:C6zEQlkQWKbSJSYc4fosSVTJe3p6RPkXuGnqGngGkmpTTRJWrjMj/P5OmVCpDyqv:Colyw7/kosSdJeZqfGvTRJKEP7UyJ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

pvjyeujzbs

Path C:\Users\Admin\AppData\Local\Temp\pvjyeujzbs
Size 7KB
SHA256 393961ef9c79d9d0ee4ea2ed739af99dd29fd48c9b83a137afe37d5a274c6a00
MD5 94f2572c8697648b65219ced6e865cef
SHA1 52e8fcf924946de026625a6e701028f9744a7434
SHA512 007b37e7da13f4013c12baaf816f14ce1dba360183e4f50cd555a09440f12f51b45117493c102e2926e28ffe029305eea03deacd0afcdd925305e219585b79e3
SSDEEP 192:5M/YLgbQi1Z4rexfL0aTa+pl3qY8cwPZoPwLnspaNgLxbBNcyxTKa:aYLAQi1ZE0l3ycwPZ7LlNgLtBNPZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

wcsdp.exe

Path C:\Users\Admin\AppData\Local\Temp\wcsdp.exe
Size 4KB
SHA256 eb5a1f8df1c644b419fe9d83fcc8ecf6f00d3bf8f7f741eb7e5dacdf9e17790c
MD5 ac63c8560a5793d134b40c38ce29d395
SHA1 263ea662b63519076e4cc6707dca69c486ac21ee
SHA512 afc238620e5f8f64e6a5cfbc91ce1e51144b1c8f9d782b505462f779941195dafa683e3adcc326f68dcfd267e3d96e584ce6b02fb3086ddac4d5f340992d85a9
SSDEEP 48:SYFNX3vgV5VfqAV6MR3ZfAtQGX0+H6cGhF68FDKrVJfAtQGX0FZHYP4oyl1:tNHvgJdR3Zot2+beUzot2FZ4P4oyn
MD5 SHA1 SHA512 SSDEEP

Submit Download

wcsdp.exe

Path C:\Users\Admin\AppData\Local\Temp\wcsdp.exe
Size 4KB
SHA256 eb5a1f8df1c644b419fe9d83fcc8ecf6f00d3bf8f7f741eb7e5dacdf9e17790c
MD5 ac63c8560a5793d134b40c38ce29d395
SHA1 263ea662b63519076e4cc6707dca69c486ac21ee
SHA512 afc238620e5f8f64e6a5cfbc91ce1e51144b1c8f9d782b505462f779941195dafa683e3adcc326f68dcfd267e3d96e584ce6b02fb3086ddac4d5f340992d85a9
SSDEEP 48:SYFNX3vgV5VfqAV6MR3ZfAtQGX0+H6cGhF68FDKrVJfAtQGX0FZHYP4oyl1:tNHvgJdR3Zot2+beUzot2FZ4P4oyn
MD5 SHA1 SHA512 SSDEEP

Submit Download

wcsdp.exe

Path C:\Users\Admin\AppData\Local\Temp\wcsdp.exe
Size 4KB
SHA256 eb5a1f8df1c644b419fe9d83fcc8ecf6f00d3bf8f7f741eb7e5dacdf9e17790c
MD5 ac63c8560a5793d134b40c38ce29d395
SHA1 263ea662b63519076e4cc6707dca69c486ac21ee
SHA512 afc238620e5f8f64e6a5cfbc91ce1e51144b1c8f9d782b505462f779941195dafa683e3adcc326f68dcfd267e3d96e584ce6b02fb3086ddac4d5f340992d85a9
SSDEEP 48:SYFNX3vgV5VfqAV6MR3ZfAtQGX0+H6cGhF68FDKrVJfAtQGX0FZHYP4oyl1:tNHvgJdR3Zot2+beUzot2FZ4P4oyn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4236-137-0x0000000000410000-0x000000000048B000-memory.dmp

Download

memory/4236-142-0x0000000000410000-0x000000000048B000-memory.dmp

Download

memory/4236-147-0x0000000000410000-0x000000000048B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads