remcos | 1e77a63d27b905f5e8ca03706a05367522c8a4fe900d1b2e3f0cb06cc5ff78a3

General

Target

95.214.24.120_-_vect_-_WWEESSCXDDGJ.exe___4dd854935958419bfa8c5b5990ef0cc4.exe
Size

582KB
MD5

4dd854935958419bfa8c5b5990ef0cc4
SHA1

8b60819fd23f870d850b25bb5cb7cbe8ffdc835f
SHA256

1e77a63d27b905f5e8ca03706a05367522c8a4fe900d1b2e3f0cb06cc5ff78a3
SHA512

ed283da562669017d18f719d2a51578f78c080706f15ba9fceacdae43b4223578d8ca893382756675e2a3ec814af60e7743c511e0146a352590d2b106d461eb4
SSDEEP

12288:9rWfmDi7yIEnMcEz0bwVaYGUJ5ThYpPR7:9rW3OEowQqxhQ7

Score

10^/10

remcos new persistence rat

Malware Config

Extracted

Family

remcos

Botnet

NEW

C2

remcapi.duckdns.org:2028

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
FILE.EXE
copy_folder
work
delete_file
true
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-L9LQMY
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
file
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

aspnet_compiler.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	aspnet_compiler.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\file = "\"C:\\ProgramData\\work\\FILE.EXE\""	aspnet_compiler.exe

Executes dropped EXE 1 IoCs

Processes:

FILE.EXE

pid process

1764 FILE.EXE

pid	process
1764	FILE.EXE

Drops startup file 2 IoCs

Processes:

Powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysDHTHtem.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysDHTHtem.exe	Powershell.exe

Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

1312 cmd.exe

pid	process
1312	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

95.214.24.120_-_vect_-_WWEESSCXDDGJ.exe___4dd854935958419bfa8c5b5990ef0cc4.exe

description	pid	process	target process
PID 1388 set thread context of 2024	1388	95.214.24.120_-_vect_-_WWEESSCXDDGJ.exe___4dd854935958419bfa8c5b5990ef0cc4.exe	aspnet_compiler.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Powershell.exe

pid process

1964 Powershell.exe

pid	process
1964	Powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

95.214.24.120_-_vect_-_WWEESSCXDDGJ.exe___4dd854935958419bfa8c5b5990ef0cc4.exePowershell.exe

description	pid	process
Token: SeDebugPrivilege	1388	95.214.24.120_-_vect_-_WWEESSCXDDGJ.exe___4dd854935958419bfa8c5b5990ef0cc4.exe
Token: SeDebugPrivilege	1964	Powershell.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

95.214.24.120_-_vect_-_WWEESSCXDDGJ.exe___4dd854935958419bfa8c5b5990ef0cc4.exeaspnet_compiler.exeWScript.execmd.exe

description	pid	process	target process
PID 1388 wrote to memory of 1964	1388	95.214.24.120_-_vect_-_WWEESSCXDDGJ.exe___4dd854935958419bfa8c5b5990ef0cc4.exe	Powershell.exe
PID 1388 wrote to memory of 1964	1388	95.214.24.120_-_vect_-_WWEESSCXDDGJ.exe___4dd854935958419bfa8c5b5990ef0cc4.exe	Powershell.exe
PID 1388 wrote to memory of 1964	1388	95.214.24.120_-_vect_-_WWEESSCXDDGJ.exe___4dd854935958419bfa8c5b5990ef0cc4.exe	Powershell.exe
PID 1388 wrote to memory of 1964	1388	95.214.24.120_-_vect_-_WWEESSCXDDGJ.exe___4dd854935958419bfa8c5b5990ef0cc4.exe	Powershell.exe
PID 1388 wrote to memory of 2024	1388	95.214.24.120_-_vect_-_WWEESSCXDDGJ.exe___4dd854935958419bfa8c5b5990ef0cc4.exe	aspnet_compiler.exe
PID 1388 wrote to memory of 2024	1388	95.214.24.120_-_vect_-_WWEESSCXDDGJ.exe___4dd854935958419bfa8c5b5990ef0cc4.exe	aspnet_compiler.exe
PID 1388 wrote to memory of 2024	1388	95.214.24.120_-_vect_-_WWEESSCXDDGJ.exe___4dd854935958419bfa8c5b5990ef0cc4.exe	aspnet_compiler.exe
PID 1388 wrote to memory of 2024	1388	95.214.24.120_-_vect_-_WWEESSCXDDGJ.exe___4dd854935958419bfa8c5b5990ef0cc4.exe	aspnet_compiler.exe
PID 1388 wrote to memory of 2024	1388	95.214.24.120_-_vect_-_WWEESSCXDDGJ.exe___4dd854935958419bfa8c5b5990ef0cc4.exe	aspnet_compiler.exe
PID 1388 wrote to memory of 2024	1388	95.214.24.120_-_vect_-_WWEESSCXDDGJ.exe___4dd854935958419bfa8c5b5990ef0cc4.exe	aspnet_compiler.exe
PID 1388 wrote to memory of 2024	1388	95.214.24.120_-_vect_-_WWEESSCXDDGJ.exe___4dd854935958419bfa8c5b5990ef0cc4.exe	aspnet_compiler.exe
PID 1388 wrote to memory of 2024	1388	95.214.24.120_-_vect_-_WWEESSCXDDGJ.exe___4dd854935958419bfa8c5b5990ef0cc4.exe	aspnet_compiler.exe
PID 1388 wrote to memory of 2024	1388	95.214.24.120_-_vect_-_WWEESSCXDDGJ.exe___4dd854935958419bfa8c5b5990ef0cc4.exe	aspnet_compiler.exe
PID 1388 wrote to memory of 2024	1388	95.214.24.120_-_vect_-_WWEESSCXDDGJ.exe___4dd854935958419bfa8c5b5990ef0cc4.exe	aspnet_compiler.exe
PID 1388 wrote to memory of 2024	1388	95.214.24.120_-_vect_-_WWEESSCXDDGJ.exe___4dd854935958419bfa8c5b5990ef0cc4.exe	aspnet_compiler.exe
PID 1388 wrote to memory of 2024	1388	95.214.24.120_-_vect_-_WWEESSCXDDGJ.exe___4dd854935958419bfa8c5b5990ef0cc4.exe	aspnet_compiler.exe
PID 1388 wrote to memory of 2024	1388	95.214.24.120_-_vect_-_WWEESSCXDDGJ.exe___4dd854935958419bfa8c5b5990ef0cc4.exe	aspnet_compiler.exe
PID 2024 wrote to memory of 1924	2024	aspnet_compiler.exe	WScript.exe
PID 2024 wrote to memory of 1924	2024	aspnet_compiler.exe	WScript.exe
PID 2024 wrote to memory of 1924	2024	aspnet_compiler.exe	WScript.exe
PID 2024 wrote to memory of 1924	2024	aspnet_compiler.exe	WScript.exe
PID 1924 wrote to memory of 1312	1924	WScript.exe	cmd.exe
PID 1924 wrote to memory of 1312	1924	WScript.exe	cmd.exe
PID 1924 wrote to memory of 1312	1924	WScript.exe	cmd.exe
PID 1924 wrote to memory of 1312	1924	WScript.exe	cmd.exe
PID 1312 wrote to memory of 1764	1312	cmd.exe	FILE.EXE
PID 1312 wrote to memory of 1764	1312	cmd.exe	FILE.EXE
PID 1312 wrote to memory of 1764	1312	cmd.exe	FILE.EXE
PID 1312 wrote to memory of 1764	1312	cmd.exe	FILE.EXE

C:\Users\Admin\AppData\Local\Temp\95.214.24.120_-_vect_-_WWEESSCXDDGJ.exe___4dd854935958419bfa8c5b5990ef0cc4.exe
"C:\Users\Admin\AppData\Local\Temp\95.214.24.120_-_vect_-_WWEESSCXDDGJ.exe___4dd854935958419bfa8c5b5990ef0cc4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
"Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\95.214.24.120_-_vect_-_WWEESSCXDDGJ.exe___4dd854935958419bfa8c5b5990ef0cc4.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysDHTHtem.exe'
2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1964

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
2⤵
- Adds policy Run key to start application
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
3⤵
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c "C:\ProgramData\work\FILE.EXE"
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1312

C:\ProgramData\work\FILE.EXE
C:\ProgramData\work\FILE.EXE
5⤵
- Executes dropped EXE
PID:1764

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\work\FILE.EXE
Filesize
54KB

MD5
1e98e92a982af948ee18ee819a2d8ad1

SHA1
6cb0bd87815118351e5e32c50b434079dfba255c

SHA256
235d3f96a78ce2dad584e6eb1a25fc386b3ae5e332c4d3c56f03b0a4978be778

SHA512
6711de2e00462c49852cee03fd8ef720310c4ffa5b3a653c08f2913a6146974f28b8a3b3ff38b3097310852a5aa3b964b77945bcefef3856911eb9acd0e42c6f

Download Submit
C:\ProgramData\work\FILE.EXE
Filesize
54KB

MD5
1e98e92a982af948ee18ee819a2d8ad1

SHA1
6cb0bd87815118351e5e32c50b434079dfba255c

SHA256
235d3f96a78ce2dad584e6eb1a25fc386b3ae5e332c4d3c56f03b0a4978be778

SHA512
6711de2e00462c49852cee03fd8ef720310c4ffa5b3a653c08f2913a6146974f28b8a3b3ff38b3097310852a5aa3b964b77945bcefef3856911eb9acd0e42c6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\install.vbs
Filesize
544B

MD5
88f5d22d281c19ca952ece4be401a79b

SHA1
718e7a6cbb2fa8a80a847c90500c7c6cdb3e2b8b

SHA256
cfaa9a4e27d62f30fdbe1e28ccdff39589a5e3995eabb51d1afc9ae3f964c379

SHA512
064d09ef43db19665f5a907af5c6f20a95d22fe7b1c3a79f4fd2e588ab31f8ef9097d580da4193a5ff3019e7da9461cc2e0a3cf99f54b1725d02e196b60e88f1

Download Submit
\ProgramData\work\FILE.EXE
Filesize
54KB

MD5
1e98e92a982af948ee18ee819a2d8ad1

SHA1
6cb0bd87815118351e5e32c50b434079dfba255c

SHA256
235d3f96a78ce2dad584e6eb1a25fc386b3ae5e332c4d3c56f03b0a4978be778

SHA512
6711de2e00462c49852cee03fd8ef720310c4ffa5b3a653c08f2913a6146974f28b8a3b3ff38b3097310852a5aa3b964b77945bcefef3856911eb9acd0e42c6f

Download Submit
memory/1312-83-0x0000000000000000-mapping.dmp

Download
memory/1388-54-0x0000000000E80000-0x0000000000F14000-memory.dmp

Filesize
592KB

Download
memory/1388-59-0x00000000003C0000-0x00000000003DC000-memory.dmp

Filesize
112KB

Download
memory/1388-56-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1388-55-0x0000000004890000-0x0000000004922000-memory.dmp

Filesize
584KB

Download
memory/1764-86-0x0000000000000000-mapping.dmp

Download
memory/1764-88-0x0000000000970000-0x0000000000980000-memory.dmp

Filesize
64KB

Download
memory/1924-77-0x0000000000000000-mapping.dmp

Download
memory/1964-57-0x0000000000000000-mapping.dmp

Download
memory/1964-82-0x000000006FD20000-0x00000000702CB000-memory.dmp

Filesize
5.7MB

Download
memory/1964-81-0x000000006FD20000-0x00000000702CB000-memory.dmp

Filesize
5.7MB

Download
memory/2024-61-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2024-76-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2024-78-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2024-73-0x00000000004327A4-mapping.dmp

Download
memory/2024-72-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2024-70-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2024-68-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2024-67-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2024-66-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2024-65-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2024-63-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2024-60-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads