remcos | bdf02d5f6252b594bc27d0b8628e1b60f614533d32b63bb3848ad136b57d3cfd

General

Target

ORDER EM067022.exe
Size

6KB
MD5

6fa8af45a1f5ab2bed6933e1b982f7f1
SHA1

ddbaeb9e823b4af615cfa87212eb1171969f1d4f
SHA256

6454523a7bb0aec9d2c66c43447ea65bfe8cff6659b4b4fea26d8919571de430
SHA512

60d7d7fd0969294aa59a8817c544f14228e1437a750300165e4c248d36c51dd1cca2f4e6d4e5cb650ead4439c4171f5e1579fdc7f0a78890501e044e70b4e417
SSDEEP

96:B2EzDjDPd6GhLee9xHdAaG3xWclF1utdbyzNt:B1PdRLxz9AaG3MclF1ur0

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

172.111.234.110:5888

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-DEOEQR
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\Fdrwnq\\Vspuz.exe\","	ORDER EM067022.exe

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	ORDER EM067022.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3140 set thread context of 4972	3140	ORDER EM067022.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1568	powershell.exe
1568	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3140	ORDER EM067022.exe
Token: SeDebugPrivilege	1568	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 1568	3140	ORDER EM067022.exe	85
PID 3140 wrote to memory of 1568	3140	ORDER EM067022.exe	85
PID 3140 wrote to memory of 1568	3140	ORDER EM067022.exe	85
PID 3140 wrote to memory of 4972	3140	ORDER EM067022.exe	88
PID 3140 wrote to memory of 4972	3140	ORDER EM067022.exe	88
PID 3140 wrote to memory of 4972	3140	ORDER EM067022.exe	88
PID 3140 wrote to memory of 4972	3140	ORDER EM067022.exe	88
PID 3140 wrote to memory of 4972	3140	ORDER EM067022.exe	88
PID 3140 wrote to memory of 4972	3140	ORDER EM067022.exe	88
PID 3140 wrote to memory of 4972	3140	ORDER EM067022.exe	88
PID 3140 wrote to memory of 4972	3140	ORDER EM067022.exe	88
PID 3140 wrote to memory of 4972	3140	ORDER EM067022.exe	88
PID 3140 wrote to memory of 4972	3140	ORDER EM067022.exe	88
PID 3140 wrote to memory of 4972	3140	ORDER EM067022.exe	88
PID 3140 wrote to memory of 4972	3140	ORDER EM067022.exe	88

C:\Users\Admin\AppData\Local\Temp\ORDER EM067022.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER EM067022.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAxAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1568
- C:\Users\Admin\AppData\Local\Temp\ORDER EM067022.exe
  "C:\Users\Admin\AppData\Local\Temp\ORDER EM067022.exe"
  2⤵
  PID:4972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1568-140-0x00000000080F0000-0x000000000876A000-memory.dmp

Filesize
6.5MB

Download
memory/1568-141-0x0000000006DA0000-0x0000000006DBA000-memory.dmp

Filesize
104KB

Download
memory/1568-135-0x00000000052E0000-0x0000000005316000-memory.dmp

Filesize
216KB

Download
memory/1568-136-0x0000000005950000-0x0000000005F78000-memory.dmp

Filesize
6.2MB

Download
memory/1568-137-0x00000000061B0000-0x0000000006216000-memory.dmp

Filesize
408KB

Download
memory/1568-138-0x0000000006220000-0x0000000006286000-memory.dmp

Filesize
408KB

Download
memory/1568-139-0x0000000006880000-0x000000000689E000-memory.dmp

Filesize
120KB

Download
memory/3140-133-0x0000000008BE0000-0x0000000008C02000-memory.dmp

Filesize
136KB

Download
memory/3140-142-0x0000000009630000-0x00000000096C2000-memory.dmp

Filesize
584KB

Download
memory/3140-143-0x0000000009C80000-0x000000000A224000-memory.dmp

Filesize
5.6MB

Download
memory/3140-132-0x0000000000510000-0x0000000000518000-memory.dmp

Filesize
32KB

Download
memory/4972-149-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4972-145-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4972-146-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4972-147-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4972-148-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download

Analysis

Sharing