remcos | f9dbb342e635717b55ef19c20e7943858acf892e6040a9a4f3609eaa41981bc9

General

Target
image_2022_11_31T21_40_57_475Z.exe
Size 481KB
Sample221107-sa1rcaceh8
SHA256 f9dbb342e635717b55ef19c20e7943858acf892e6040a9a4f3609eaa41981bc9
MD5 921c1764462feb206d4ca0b44452254c
SHA1 37e69ebe6e65ff3067d3e7e319caedb489feee23
SHA512 91c46b426a2c21389aa5d6938ad2962562501a947c8c1b8e3935885b2a4ea21e29e61b1602c28bc5274efda3925aa52be5ee9f40b059dd90ca6e21526d59bb8b
SSDEEP 12288:XAeZvHnOr6uf2x7ctE9Szu1qqNR+o3nSxmJbMHM:XAyuWuf2x7ca9Szkso3nSBM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehoststar persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHostStar

C2

41.216.183.226:41900

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-0OUDX5
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
3804	gorajh.exe
2248	gorajh.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdjttpf = "C:\\Users\\Admin\\AppData\\Roaming\\pdytypem\\eyfjldcq.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\gorajh.exe\""	gorajh.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3804 set thread context of 2248	3804	gorajh.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3804	gorajh.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 3804	644	image_2022_11_31T21_40_57_475Z.exe	81
PID 644 wrote to memory of 3804	644	image_2022_11_31T21_40_57_475Z.exe	81
PID 644 wrote to memory of 3804	644	image_2022_11_31T21_40_57_475Z.exe	81
PID 3804 wrote to memory of 2248	3804	gorajh.exe	82
PID 3804 wrote to memory of 2248	3804	gorajh.exe	82
PID 3804 wrote to memory of 2248	3804	gorajh.exe	82
PID 3804 wrote to memory of 2248	3804	gorajh.exe	82

C:\Users\Admin\AppData\Local\Temp\image_2022_11_31T21_40_57_475Z.exe
"C:\Users\Admin\AppData\Local\Temp\image_2022_11_31T21_40_57_475Z.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:644
- C:\Users\Admin\AppData\Local\Temp\gorajh.exe
  "C:\Users\Admin\AppData\Local\Temp\gorajh.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Users\Admin\AppData\Local\Temp\gorajh.exe
    "C:\Users\Admin\AppData\Local\Temp\gorajh.exe"
    3⤵
    - Executes dropped EXE
    PID:2248

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gorajh.exe

Path C:\Users\Admin\AppData\Local\Temp\gorajh.exe
Size 5KB
SHA256 a82758db14cf0a6096bd16bc7000cc00168be1fecca6882415e57af1528b7a0f
MD5 7b781ed35f737e4fcb01f95911ddd4ef
SHA1 bd41d5f509a1e6f52d84e969de76fb77e7d298eb
SHA512 70b80d665a5b4027a184d58950b1db5ef8bc66b845cfefa36054fc8ce9dec4d389a298c3ea930c93e4ec8c2ea0bd431ecc5f06b5728ec29b4e1d3e506b56851f
SSDEEP 48:SA+7LfArQ3LdPvh5ZymvnZH3+1gQaFkUmRCZr8BruAUKXRuqS:OPfArsAenB3+1QFP3ZYDhBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

gorajh.exe

Path C:\Users\Admin\AppData\Local\Temp\gorajh.exe
Size 5KB
SHA256 a82758db14cf0a6096bd16bc7000cc00168be1fecca6882415e57af1528b7a0f
MD5 7b781ed35f737e4fcb01f95911ddd4ef
SHA1 bd41d5f509a1e6f52d84e969de76fb77e7d298eb
SHA512 70b80d665a5b4027a184d58950b1db5ef8bc66b845cfefa36054fc8ce9dec4d389a298c3ea930c93e4ec8c2ea0bd431ecc5f06b5728ec29b4e1d3e506b56851f
SSDEEP 48:SA+7LfArQ3LdPvh5ZymvnZH3+1gQaFkUmRCZr8BruAUKXRuqS:OPfArsAenB3+1QFP3ZYDhBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

gorajh.exe

Path C:\Users\Admin\AppData\Local\Temp\gorajh.exe
Size 5KB
SHA256 a82758db14cf0a6096bd16bc7000cc00168be1fecca6882415e57af1528b7a0f
MD5 7b781ed35f737e4fcb01f95911ddd4ef
SHA1 bd41d5f509a1e6f52d84e969de76fb77e7d298eb
SHA512 70b80d665a5b4027a184d58950b1db5ef8bc66b845cfefa36054fc8ce9dec4d389a298c3ea930c93e4ec8c2ea0bd431ecc5f06b5728ec29b4e1d3e506b56851f
SSDEEP 48:SA+7LfArQ3LdPvh5ZymvnZH3+1gQaFkUmRCZr8BruAUKXRuqS:OPfArsAenB3+1QFP3ZYDhBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

pvhjwfxp.y

Path C:\Users\Admin\AppData\Local\Temp\pvhjwfxp.y
Size 7KB
SHA256 5184c7ca1bd7610466443477a98319886176b3668aa095e795171583221f1b27
MD5 e1e7d8126744a35a5de85ba86be52d3e
SHA1 a9e4c07dfd17a01daa0df2a8917fe9d998a69d7e
SHA512 b6e7d1cffe7de9599f400e1ff0c59e9b65f287bb96e7a0a2e382e08ece726d5b77407e1a145d5f3139ef82240324ff9f0e2b89088c111581e6db6b8affca5f68
SSDEEP 192:qoH4SDJsCXS1xyoiPjiUP3WYXv1j1uKL5RN+ugqj0x:q8rCqoYOUGYXt5ugRNMBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

xflfwje.crr

Path C:\Users\Admin\AppData\Local\Temp\xflfwje.crr
Size 469KB
SHA256 bc15a695c89e2fc20b7043b95771e838af3424293f55957bd674899d3ff15238
MD5 194d439ce08f6b52c4c350bf053ff37f
SHA1 f262ed451055a92ba4e893d03a81efe1194fc779
SHA512 7611f6514486c1d9e3d889c419fe5e38638682a75cdf25635868ed7b4b5783f18f31fcdf9c5f7d09e99a5598bdd12d40d577403521c861a16a8179f0a5c07c3e
SSDEEP 12288:DgTynOiBCBdtpY/sT/BDQo2zCuwHd/PWB57:AynOi8dKsTJDQZzDw+/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2248-139-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/2248-140-0x0000000000400000-0x000000000047F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads