remcos | d68a8086daa22485827f74140e91325a1c751329c29f23f61c7c33856705b151

General

Target
74948fcfeb4232ecaee315a1e75b9756.exe
Size 100KB
Sample220724-e81bksfcg5
SHA256 d68a8086daa22485827f74140e91325a1c751329c29f23f61c7c33856705b151
MD5 74948fcfeb4232ecaee315a1e75b9756
SHA1 13a35894d0c32cbc4ceca199d383ba4b2486a6ad
SHA512 a8012f9b4789d9062002712c4c571a00a43a906e1f5fc6b13c1ea853c42fb1fc2edd13fb64e11c2ac37cfc6b8e9715dab0e0179f43ec5d6215247009f437ea4d
MD5 SHA1 SHA512

Score

10^/10

remcos president rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

President

C2

winam.ddns.net:2404
runam.ddns.net:2404
windda.ddns.net:2404
widda1.ddns.net:2404

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
180
copy_file
svchost.exe
copy_folder
updates
delete_file
true
hide_file
true
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
windows
keylog_path
%AppData%
mouse_option
false
mutex
remcos_nsttxbncgz
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
Logs
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 1 IoCs

pid	Process
1124	svchost.exe

Deletes itself 1 IoCs

pid	Process
1892	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1892	cmd.exe
1892	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1756	PING.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1124	svchost.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 1892	640	74948fcfeb4232ecaee315a1e75b9756.exe	27
PID 640 wrote to memory of 1892	640	74948fcfeb4232ecaee315a1e75b9756.exe	27
PID 640 wrote to memory of 1892	640	74948fcfeb4232ecaee315a1e75b9756.exe	27
PID 640 wrote to memory of 1892	640	74948fcfeb4232ecaee315a1e75b9756.exe	27
PID 640 wrote to memory of 1892	640	74948fcfeb4232ecaee315a1e75b9756.exe	27
PID 640 wrote to memory of 1892	640	74948fcfeb4232ecaee315a1e75b9756.exe	27
PID 640 wrote to memory of 1892	640	74948fcfeb4232ecaee315a1e75b9756.exe	27
PID 1892 wrote to memory of 1756	1892	cmd.exe	29
PID 1892 wrote to memory of 1756	1892	cmd.exe	29
PID 1892 wrote to memory of 1756	1892	cmd.exe	29
PID 1892 wrote to memory of 1756	1892	cmd.exe	29
PID 1892 wrote to memory of 1124	1892	cmd.exe	30
PID 1892 wrote to memory of 1124	1892	cmd.exe	30
PID 1892 wrote to memory of 1124	1892	cmd.exe	30
PID 1892 wrote to memory of 1124	1892	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\74948fcfeb4232ecaee315a1e75b9756.exe
"C:\Users\Admin\AppData\Local\Temp\74948fcfeb4232ecaee315a1e75b9756.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:640
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\SysWOW64\PING.EXE
    PING 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1756
- - C:\Users\Admin\AppData\Roaming\updates\svchost.exe
    "C:\Users\Admin\AppData\Roaming\updates\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.bat

Path C:\Users\Admin\AppData\Local\Temp\install.bat
Size 179B
SHA256 2f0ee730d53e8e8045cc41adfd9d202de2e9e060e6978f54d7ff641f8578e44d
MD5 64e34d5ecd595eee22f5e184177bbb8d
SHA1 733e7833cbd09fd27d34b9ada088d72a9a3b0055
SHA512 2953ed6b94a5bb5207978d302bab3928f1b8b039c3f8448ad5495dca94f0339f11da14048436b5870327c46bee7d38fad52e1b0b03242bad3bcc50132c746934
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\updates\svchost.exe
Size 100KB
SHA256 d68a8086daa22485827f74140e91325a1c751329c29f23f61c7c33856705b151
MD5 74948fcfeb4232ecaee315a1e75b9756
SHA1 13a35894d0c32cbc4ceca199d383ba4b2486a6ad
SHA512 a8012f9b4789d9062002712c4c571a00a43a906e1f5fc6b13c1ea853c42fb1fc2edd13fb64e11c2ac37cfc6b8e9715dab0e0179f43ec5d6215247009f437ea4d
SSDEEP 3072:vhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+JP/P6nrs:vhzOv2fM13jsIFSHNT7P/P6rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\updates\svchost.exe
Size 100KB
SHA256 d68a8086daa22485827f74140e91325a1c751329c29f23f61c7c33856705b151
MD5 74948fcfeb4232ecaee315a1e75b9756
SHA1 13a35894d0c32cbc4ceca199d383ba4b2486a6ad
SHA512 a8012f9b4789d9062002712c4c571a00a43a906e1f5fc6b13c1ea853c42fb1fc2edd13fb64e11c2ac37cfc6b8e9715dab0e0179f43ec5d6215247009f437ea4d
SSDEEP 3072:vhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+JP/P6nrs:vhzOv2fM13jsIFSHNT7P/P6rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path \Users\Admin\AppData\Roaming\updates\svchost.exe
Size 100KB
SHA256 d68a8086daa22485827f74140e91325a1c751329c29f23f61c7c33856705b151
MD5 74948fcfeb4232ecaee315a1e75b9756
SHA1 13a35894d0c32cbc4ceca199d383ba4b2486a6ad
SHA512 a8012f9b4789d9062002712c4c571a00a43a906e1f5fc6b13c1ea853c42fb1fc2edd13fb64e11c2ac37cfc6b8e9715dab0e0179f43ec5d6215247009f437ea4d
SSDEEP 3072:vhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+JP/P6nrs:vhzOv2fM13jsIFSHNT7P/P6rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path \Users\Admin\AppData\Roaming\updates\svchost.exe
Size 100KB
SHA256 d68a8086daa22485827f74140e91325a1c751329c29f23f61c7c33856705b151
MD5 74948fcfeb4232ecaee315a1e75b9756
SHA1 13a35894d0c32cbc4ceca199d383ba4b2486a6ad
SHA512 a8012f9b4789d9062002712c4c571a00a43a906e1f5fc6b13c1ea853c42fb1fc2edd13fb64e11c2ac37cfc6b8e9715dab0e0179f43ec5d6215247009f437ea4d
SSDEEP 3072:vhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+JP/P6nrs:vhzOv2fM13jsIFSHNT7P/P6rs
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/640-54-0x0000000076291000-0x0000000076293000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads