remcos | 39c927965e14fb38c14b82c66c398f9cac1343d450db26e43c763b08a764b04b

General

Target

39c927965e14fb38c14b82c66c398f9cac1343d450db26e43c763b08a764b04b.exe
Size

469KB
MD5

ad56d2cba38724cdf1f46c4527db73cd
SHA1

771f9810e74f7bc0d5db969cc9bf18fd50e95452
SHA256

39c927965e14fb38c14b82c66c398f9cac1343d450db26e43c763b08a764b04b
SHA512

0a28fb71c71ac4f3a88e75b0f4fe0baeb2a0843fc9707da12e8c2f4922f51f5e80fee7ce6e0c6299164a5c17cc3e61cec121f6598f0a10d952a532b65cd1d163
SSDEEP

12288:Omnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSfAn9:2iLJbpI7I2WhQqZ749

Score

10^/10

remcos spanish money persistence rat

Malware Config

Extracted

Family

remcos

Botnet

Spanish Money

C2

51.210.137.26:3345

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
testing.exe
delete_file
false
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
nvswe.dat
keylog_flag
false
keylog_folder
fxxgjhkj
mouse_option
false
mutex
testing-YUTJTX
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
dffghhj
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 1 IoCs

pid	Process
3760	testing.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	39c927965e14fb38c14b82c66c398f9cac1343d450db26e43c763b08a764b04b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dffghhj = "\"C:\\Users\\Admin\\AppData\\Roaming\\testing.exe\""	testing.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	39c927965e14fb38c14b82c66c398f9cac1343d450db26e43c763b08a764b04b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dffghhj = "\"C:\\Users\\Admin\\AppData\\Roaming\\testing.exe\""	39c927965e14fb38c14b82c66c398f9cac1343d450db26e43c763b08a764b04b.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	testing.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3760 set thread context of 3336	3760	testing.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	39c927965e14fb38c14b82c66c398f9cac1343d450db26e43c763b08a764b04b.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3760	testing.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3760	testing.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 3908	4556	39c927965e14fb38c14b82c66c398f9cac1343d450db26e43c763b08a764b04b.exe	85
PID 4556 wrote to memory of 3908	4556	39c927965e14fb38c14b82c66c398f9cac1343d450db26e43c763b08a764b04b.exe	85
PID 4556 wrote to memory of 3908	4556	39c927965e14fb38c14b82c66c398f9cac1343d450db26e43c763b08a764b04b.exe	85
PID 3908 wrote to memory of 220	3908	WScript.exe	86
PID 3908 wrote to memory of 220	3908	WScript.exe	86
PID 3908 wrote to memory of 220	3908	WScript.exe	86
PID 220 wrote to memory of 3760	220	cmd.exe	90
PID 220 wrote to memory of 3760	220	cmd.exe	90
PID 220 wrote to memory of 3760	220	cmd.exe	90
PID 3760 wrote to memory of 3336	3760	testing.exe	91
PID 3760 wrote to memory of 3336	3760	testing.exe	91
PID 3760 wrote to memory of 3336	3760	testing.exe	91
PID 3760 wrote to memory of 3336	3760	testing.exe	91

C:\Users\Admin\AppData\Local\Temp\39c927965e14fb38c14b82c66c398f9cac1343d450db26e43c763b08a764b04b.exe
"C:\Users\Admin\AppData\Local\Temp\39c927965e14fb38c14b82c66c398f9cac1343d450db26e43c763b08a764b04b.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\testing.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:220
  - - C:\Users\Admin\AppData\Roaming\testing.exe
      C:\Users\Admin\AppData\Roaming\testing.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3760
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        
        PID:3336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.vbs

Filesize
406B

MD5
79b02f24c483121331311f6c5ac82a9a

SHA1
19f68405b87d888b59bbcd121181ce563eaec249

SHA256
0d856d4b535455ef4523c1d175ab154259f58af05083bc2939ed07a0e6c90736

SHA512
7bcff31e4a82b461d8c3f2945b1aed81e5c497b0da0bb4ddce4c4fd0bdbb1c921433d9a635458519c8d28625f56d4d4b0f585d9d1b3b5a6dbf5fdcdaa6c57e4b

Download Submit
C:\Users\Admin\AppData\Roaming\testing.exe

Filesize
469KB

MD5
ad56d2cba38724cdf1f46c4527db73cd

SHA1
771f9810e74f7bc0d5db969cc9bf18fd50e95452

SHA256
39c927965e14fb38c14b82c66c398f9cac1343d450db26e43c763b08a764b04b

SHA512
0a28fb71c71ac4f3a88e75b0f4fe0baeb2a0843fc9707da12e8c2f4922f51f5e80fee7ce6e0c6299164a5c17cc3e61cec121f6598f0a10d952a532b65cd1d163

Download Submit
C:\Users\Admin\AppData\Roaming\testing.exe

Filesize
469KB

MD5
ad56d2cba38724cdf1f46c4527db73cd

SHA1
771f9810e74f7bc0d5db969cc9bf18fd50e95452

SHA256
39c927965e14fb38c14b82c66c398f9cac1343d450db26e43c763b08a764b04b

SHA512
0a28fb71c71ac4f3a88e75b0f4fe0baeb2a0843fc9707da12e8c2f4922f51f5e80fee7ce6e0c6299164a5c17cc3e61cec121f6598f0a10d952a532b65cd1d163

Download Submit
memory/3336-139-0x0000000000B60000-0x0000000000BDF000-memory.dmp

Filesize
508KB

Download

Analysis

Sharing