remcos | 4615a040623f545be294f77b8b860c16f8b99a3475ecc790634292ff8cdaa858

General

Target

hugo.exe
Size

836KB
MD5

415bafcf36a22df02e56a9e582f39b24
SHA1

2cf9b2825d4e26eef6ba8fe1906d22788c55bc7f
SHA256

3d3c288fcea8c0ae627a42c9378871cfab1ac04ed9d62e861c84d4196691e74b
SHA512

85dc4a0107b3b975a66d299290fc504210cc2af87e363338da2c11dc8bef04a59cfe7d3101a57f34153b15bec08e0ca91abc768b309993a65023a70dd7c4d035

Score

10^/10

remcos victim persistence rat

Malware Config

Extracted

Family

remcos

Version

2.0.2 Pro

Botnet

Victim

C2

www.suchfamily.eu:5563

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
winsoft.exe
copy_folder
System32
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
BKKDNKDNODNDKNDIODNKDNK-FF5VJY
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
windonw
take_screenshot_option
true
take_screenshot_time
5
take_screenshot_title
Wire Transfer;Payment Slips;Bank Login;Bitcoins;Shares

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 2 IoCs

Processes:

winsoft.exewinsoft.exe

pid process

524 winsoft.exe
432 winsoft.exe
Loads dropped DLL 2 IoCs

Processes:

cmd.exe

pid process

320 cmd.exe
320 cmd.exe

pid	process
524	winsoft.exe
432	winsoft.exe

pid	process
320	cmd.exe
320	cmd.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

winsoft.exehugo.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\windonw = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\winsoft.exe\""	winsoft.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\	hugo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\windonw = "\"C:\\Users\\Admin\\AppData\\Roaming\\System32\\winsoft.exe\""	hugo.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\	winsoft.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

hugo.exewinsoft.exewinsoft.exe

pid process

888 hugo.exe
524 winsoft.exe
432 winsoft.exe

pid	process
888	hugo.exe
524	winsoft.exe
432	winsoft.exe

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

hugo.exehugo.exeWScript.execmd.exewinsoft.exe

description	pid	process	target process
PID 888 wrote to memory of 1212	888	hugo.exe	hugo.exe
PID 888 wrote to memory of 1212	888	hugo.exe	hugo.exe
PID 888 wrote to memory of 1212	888	hugo.exe	hugo.exe
PID 888 wrote to memory of 1212	888	hugo.exe	hugo.exe
PID 888 wrote to memory of 1212	888	hugo.exe	hugo.exe
PID 888 wrote to memory of 1212	888	hugo.exe	hugo.exe
PID 888 wrote to memory of 1212	888	hugo.exe	hugo.exe
PID 888 wrote to memory of 1212	888	hugo.exe	hugo.exe
PID 888 wrote to memory of 1212	888	hugo.exe	hugo.exe
PID 888 wrote to memory of 1212	888	hugo.exe	hugo.exe
PID 888 wrote to memory of 1212	888	hugo.exe	hugo.exe
PID 888 wrote to memory of 1212	888	hugo.exe	hugo.exe
PID 888 wrote to memory of 1212	888	hugo.exe	hugo.exe
PID 888 wrote to memory of 1212	888	hugo.exe	hugo.exe
PID 888 wrote to memory of 1212	888	hugo.exe	hugo.exe
PID 888 wrote to memory of 1212	888	hugo.exe	hugo.exe
PID 888 wrote to memory of 1212	888	hugo.exe	hugo.exe
PID 1212 wrote to memory of 1476	1212	hugo.exe	WScript.exe
PID 1212 wrote to memory of 1476	1212	hugo.exe	WScript.exe
PID 1212 wrote to memory of 1476	1212	hugo.exe	WScript.exe
PID 1212 wrote to memory of 1476	1212	hugo.exe	WScript.exe
PID 1476 wrote to memory of 320	1476	WScript.exe	cmd.exe
PID 1476 wrote to memory of 320	1476	WScript.exe	cmd.exe
PID 1476 wrote to memory of 320	1476	WScript.exe	cmd.exe
PID 1476 wrote to memory of 320	1476	WScript.exe	cmd.exe
PID 320 wrote to memory of 524	320	cmd.exe	winsoft.exe
PID 320 wrote to memory of 524	320	cmd.exe	winsoft.exe
PID 320 wrote to memory of 524	320	cmd.exe	winsoft.exe
PID 320 wrote to memory of 524	320	cmd.exe	winsoft.exe
PID 524 wrote to memory of 432	524	winsoft.exe	winsoft.exe
PID 524 wrote to memory of 432	524	winsoft.exe	winsoft.exe
PID 524 wrote to memory of 432	524	winsoft.exe	winsoft.exe
PID 524 wrote to memory of 432	524	winsoft.exe	winsoft.exe
PID 524 wrote to memory of 432	524	winsoft.exe	winsoft.exe
PID 524 wrote to memory of 432	524	winsoft.exe	winsoft.exe
PID 524 wrote to memory of 432	524	winsoft.exe	winsoft.exe
PID 524 wrote to memory of 432	524	winsoft.exe	winsoft.exe
PID 524 wrote to memory of 432	524	winsoft.exe	winsoft.exe
PID 524 wrote to memory of 432	524	winsoft.exe	winsoft.exe
PID 524 wrote to memory of 432	524	winsoft.exe	winsoft.exe
PID 524 wrote to memory of 432	524	winsoft.exe	winsoft.exe
PID 524 wrote to memory of 432	524	winsoft.exe	winsoft.exe
PID 524 wrote to memory of 432	524	winsoft.exe	winsoft.exe
PID 524 wrote to memory of 432	524	winsoft.exe	winsoft.exe
PID 524 wrote to memory of 432	524	winsoft.exe	winsoft.exe
PID 524 wrote to memory of 432	524	winsoft.exe	winsoft.exe

C:\Users\Admin\AppData\Local\Temp\hugo.exe
"C:\Users\Admin\AppData\Local\Temp\hugo.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:888

C:\Users\Admin\AppData\Local\Temp\hugo.exe
"C:\Users\Admin\AppData\Local\Temp\hugo.exe"
2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
3⤵
- Suspicious use of WriteProcessMemory
PID:1476

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\System32\winsoft.exe"
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:320

C:\Users\Admin\AppData\Roaming\System32\winsoft.exe
C:\Users\Admin\AppData\Roaming\System32\winsoft.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:524

C:\Users\Admin\AppData\Roaming\System32\winsoft.exe
C:\Users\Admin\AppData\Roaming\System32\winsoft.exe
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:432

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs
Filesize
424B

MD5
5643fb2a18890c974d7c6e5a15d5fcd5

SHA1
c2bc62799a01aed6c5ac18f8ec03a3c57ebb7486

SHA256
39fa039816b2557dd53ddfd64f53794ea53c48888c738da4d7eaf8f6b99c6240

SHA512
1d699c95f4d323f4455056cb84eabcda5216721a0ac512275926e424aa1cebcb920f234aba0e1c8f7735ded9d42a129f91b7c86632af762b7532adaaed5c5fb5

Download Submit
C:\Users\Admin\AppData\Roaming\System32\winsoft.exe
Filesize
836KB

MD5
415bafcf36a22df02e56a9e582f39b24

SHA1
2cf9b2825d4e26eef6ba8fe1906d22788c55bc7f

SHA256
3d3c288fcea8c0ae627a42c9378871cfab1ac04ed9d62e861c84d4196691e74b

SHA512
85dc4a0107b3b975a66d299290fc504210cc2af87e363338da2c11dc8bef04a59cfe7d3101a57f34153b15bec08e0ca91abc768b309993a65023a70dd7c4d035

Download Submit
C:\Users\Admin\AppData\Roaming\System32\winsoft.exe
Filesize
836KB

MD5
415bafcf36a22df02e56a9e582f39b24

SHA1
2cf9b2825d4e26eef6ba8fe1906d22788c55bc7f

SHA256
3d3c288fcea8c0ae627a42c9378871cfab1ac04ed9d62e861c84d4196691e74b

SHA512
85dc4a0107b3b975a66d299290fc504210cc2af87e363338da2c11dc8bef04a59cfe7d3101a57f34153b15bec08e0ca91abc768b309993a65023a70dd7c4d035

Download Submit
C:\Users\Admin\AppData\Roaming\System32\winsoft.exe
Filesize
836KB

MD5
415bafcf36a22df02e56a9e582f39b24

SHA1
2cf9b2825d4e26eef6ba8fe1906d22788c55bc7f

SHA256
3d3c288fcea8c0ae627a42c9378871cfab1ac04ed9d62e861c84d4196691e74b

SHA512
85dc4a0107b3b975a66d299290fc504210cc2af87e363338da2c11dc8bef04a59cfe7d3101a57f34153b15bec08e0ca91abc768b309993a65023a70dd7c4d035

Download Submit
\Users\Admin\AppData\Roaming\System32\winsoft.exe
Filesize
836KB

MD5
415bafcf36a22df02e56a9e582f39b24

SHA1
2cf9b2825d4e26eef6ba8fe1906d22788c55bc7f

SHA256
3d3c288fcea8c0ae627a42c9378871cfab1ac04ed9d62e861c84d4196691e74b

SHA512
85dc4a0107b3b975a66d299290fc504210cc2af87e363338da2c11dc8bef04a59cfe7d3101a57f34153b15bec08e0ca91abc768b309993a65023a70dd7c4d035

Download Submit
\Users\Admin\AppData\Roaming\System32\winsoft.exe
Filesize
836KB

MD5
415bafcf36a22df02e56a9e582f39b24

SHA1
2cf9b2825d4e26eef6ba8fe1906d22788c55bc7f

SHA256
3d3c288fcea8c0ae627a42c9378871cfab1ac04ed9d62e861c84d4196691e74b

SHA512
85dc4a0107b3b975a66d299290fc504210cc2af87e363338da2c11dc8bef04a59cfe7d3101a57f34153b15bec08e0ca91abc768b309993a65023a70dd7c4d035

Download Submit
memory/320-67-0x0000000000000000-mapping.dmp

Download
memory/432-82-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/432-81-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/432-80-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/432-76-0x0000000000000000-mapping.dmp

Download
memory/524-71-0x0000000000000000-mapping.dmp

Download
memory/888-56-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/888-59-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/888-57-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download
memory/1212-64-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1212-62-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1212-60-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1212-58-0x0000000000000000-mapping.dmp

Download
memory/1476-63-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing