remcos | 4628836ee082fa27270656dfa61109178e78fde1e55364b00c27ad10d77ee6ae

General

Target

izvod plačila pdf (613KB).exe
Size

1.2MB
MD5

bfebe3347722d3c30d47ee8ccfc7a990
SHA1

80d10707a7dbdfeacb0a431c9bfbf34a58cf33ec
SHA256

4628836ee082fa27270656dfa61109178e78fde1e55364b00c27ad10d77ee6ae
SHA512

6ea08e4a4be32d56ff5450b9a61aeeccba3fef4114dada88565fc91886f96642d1237dfb7d419d6a7a716568516ae14bcb9c90dc7822a5b545f04ecbcba14087
SSDEEP

24576:GnrnaS36mDrycFwbDFEsxxJHoVYdX1QCosRa9ZH6h7iuWsDcWI:8F364ebDFxxJQC1QCosR26Au/D

Score

10^/10

remcos remotehost ewa cartoon rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost Ewa Cartoon

C2

64.44.102.244:1960

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-QU3UHQ
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

izvod plačila pdf (613KB).exe

description pid process target process

PID 1980 set thread context of 1884 1980 izvod plačila pdf (613KB).exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2044 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

izvod plačila pdf (613KB).exepowershell.exe

pid process

1980 izvod plačila pdf (613KB).exe
1980 izvod plačila pdf (613KB).exe
1732 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

izvod plačila pdf (613KB).exepowershell.exe

description pid process

Token: SeDebugPrivilege 1980 izvod plačila pdf (613KB).exe
Token: SeDebugPrivilege 1732 powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

1884 vbc.exe

description	pid	process	target process
PID 1980 set thread context of 1884	1980	izvod plačila pdf (613KB).exe	vbc.exe

pid	process
2044	schtasks.exe

pid	process
1980	izvod plačila pdf (613KB).exe
1980	izvod plačila pdf (613KB).exe
1732	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1980	izvod plačila pdf (613KB).exe
Token: SeDebugPrivilege	1732	powershell.exe

pid	process
1884	vbc.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

izvod plačila pdf (613KB).exe

description	pid	process	target process
PID 1980 wrote to memory of 1732	1980	izvod plačila pdf (613KB).exe	powershell.exe
PID 1980 wrote to memory of 1732	1980	izvod plačila pdf (613KB).exe	powershell.exe
PID 1980 wrote to memory of 1732	1980	izvod plačila pdf (613KB).exe	powershell.exe
PID 1980 wrote to memory of 1732	1980	izvod plačila pdf (613KB).exe	powershell.exe
PID 1980 wrote to memory of 2044	1980	izvod plačila pdf (613KB).exe	schtasks.exe
PID 1980 wrote to memory of 2044	1980	izvod plačila pdf (613KB).exe	schtasks.exe
PID 1980 wrote to memory of 2044	1980	izvod plačila pdf (613KB).exe	schtasks.exe
PID 1980 wrote to memory of 2044	1980	izvod plačila pdf (613KB).exe	schtasks.exe
PID 1980 wrote to memory of 1884	1980	izvod plačila pdf (613KB).exe	vbc.exe
PID 1980 wrote to memory of 1884	1980	izvod plačila pdf (613KB).exe	vbc.exe
PID 1980 wrote to memory of 1884	1980	izvod plačila pdf (613KB).exe	vbc.exe
PID 1980 wrote to memory of 1884	1980	izvod plačila pdf (613KB).exe	vbc.exe
PID 1980 wrote to memory of 1884	1980	izvod plačila pdf (613KB).exe	vbc.exe
PID 1980 wrote to memory of 1884	1980	izvod plačila pdf (613KB).exe	vbc.exe
PID 1980 wrote to memory of 1884	1980	izvod plačila pdf (613KB).exe	vbc.exe
PID 1980 wrote to memory of 1884	1980	izvod plačila pdf (613KB).exe	vbc.exe
PID 1980 wrote to memory of 1884	1980	izvod plačila pdf (613KB).exe	vbc.exe
PID 1980 wrote to memory of 1884	1980	izvod plačila pdf (613KB).exe	vbc.exe
PID 1980 wrote to memory of 1884	1980	izvod plačila pdf (613KB).exe	vbc.exe
PID 1980 wrote to memory of 1884	1980	izvod plačila pdf (613KB).exe	vbc.exe
PID 1980 wrote to memory of 1884	1980	izvod plačila pdf (613KB).exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\izvod plačila pdf (613KB).exe
"C:\Users\Admin\AppData\Local\Temp\izvod plačila pdf (613KB).exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\CiGOFVCodFJd.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1732

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CiGOFVCodFJd" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE773.tmp"
2⤵
- Creates scheduled task(s)
PID:2044

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1884

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE773.tmp
Filesize
1KB

MD5
07a18deca1d8f68a4ddfb1bdfbf4b4fe

SHA1
f78e50776e60e8c6e29609cd0c5062bcc75f1f45

SHA256
1afb94e3d9353c1a74ebd8b0c8f11b26a404a44b260e26cb9ba9a8cae220b1b9

SHA512
872b6f3354417406900e3b9bf1d85515326cfdeb5029dea8658b85a333c6d7ddba58a20534e9930271bfe9b0c9b3ee0d9fc36ab5ed83d85da36866c83eb14c15

Download Submit
memory/1732-59-0x0000000000000000-mapping.dmp

Download
memory/1732-83-0x000000006EB10000-0x000000006F0BB000-memory.dmp

Filesize
5.7MB

Download
memory/1732-82-0x000000006EB10000-0x000000006F0BB000-memory.dmp

Filesize
5.7MB

Download
memory/1884-77-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1884-72-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1884-85-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1884-84-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1884-81-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1884-78-0x00000000004327A4-mapping.dmp

Download
memory/1884-65-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1884-66-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1884-68-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1884-70-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1884-71-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1884-75-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1884-73-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1980-58-0x0000000005E70000-0x0000000005F42000-memory.dmp

Filesize
840KB

Download
memory/1980-54-0x0000000000B90000-0x0000000000CBE000-memory.dmp

Filesize
1.2MB

Download
memory/1980-64-0x0000000007F70000-0x0000000007FF8000-memory.dmp

Filesize
544KB

Download
memory/1980-63-0x0000000004380000-0x0000000004386000-memory.dmp

Filesize
24KB

Download
memory/1980-56-0x0000000000360000-0x0000000000382000-memory.dmp

Filesize
136KB

Download
memory/1980-55-0x0000000075861000-0x0000000075863000-memory.dmp

Filesize
8KB

Download
memory/1980-57-0x0000000000710000-0x000000000071C000-memory.dmp

Filesize
48KB

Download
memory/2044-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads