remcos | c03cfddda1ce6811ac0aa6cd6d9957e688a3fd37c02a16c15af285bff2c9b04f

General

Target
SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.1903.6551.exe
Size 516KB
Sample221111-fa4f1shbc7
SHA256 c03cfddda1ce6811ac0aa6cd6d9957e688a3fd37c02a16c15af285bff2c9b04f
MD5 1926e44b8232320f16a9972dc6ed4b2a
SHA1 876f31a2d7f1a197d0c4ba28a44eeb547145b8a5
SHA512 9f7730624fae5d4eeca829385c22a32bd745dc347795ec809d97fba1154cd2500b4e816f1ee39b97a6ae7f7dcabd11bf819e8bd9ffbe07041872e1733bf9ba86
SSDEEP 12288:WA09x9UR7+1+H3RdPAeIuMdCeAEbeI4rbGW:J0JUR7+1+hdRNMdCeAEqjmW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos xp_no startup persistence rat

Malware Config

Extracted

Family

remcos

Botnet

Xp_no startup

C2

xpremcuz300622.ddns.net:3542

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-419DY7
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 3 IoCs

pid	Process
1584	umnrkin.exe
444	umnrkin.exe
3876	umnrkin.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ecxonf = "C:\\Users\\Admin\\AppData\\Roaming\\aykr\\ltuciancaybtwv.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\umnrkin.exe\""	umnrkin.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1584 set thread context of 3876	1584	umnrkin.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1584	umnrkin.exe
1584	umnrkin.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3876	umnrkin.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 1584	3248	SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.1903.6551.exe	82
PID 3248 wrote to memory of 1584	3248	SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.1903.6551.exe	82
PID 3248 wrote to memory of 1584	3248	SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.1903.6551.exe	82
PID 1584 wrote to memory of 444	1584	umnrkin.exe	83
PID 1584 wrote to memory of 444	1584	umnrkin.exe	83
PID 1584 wrote to memory of 444	1584	umnrkin.exe	83
PID 1584 wrote to memory of 3876	1584	umnrkin.exe	84
PID 1584 wrote to memory of 3876	1584	umnrkin.exe	84
PID 1584 wrote to memory of 3876	1584	umnrkin.exe	84
PID 1584 wrote to memory of 3876	1584	umnrkin.exe	84

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.1903.6551.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.NSISX.Spy.Gen.24.1903.6551.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Users\Admin\AppData\Local\Temp\umnrkin.exe
  "C:\Users\Admin\AppData\Local\Temp\umnrkin.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Users\Admin\AppData\Local\Temp\umnrkin.exe
    "C:\Users\Admin\AppData\Local\Temp\umnrkin.exe"
    3⤵
    - Executes dropped EXE
    PID:444
- - C:\Users\Admin\AppData\Local\Temp\umnrkin.exe
    "C:\Users\Admin\AppData\Local\Temp\umnrkin.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cyvaazygr.rtd

Path C:\Users\Admin\AppData\Local\Temp\cyvaazygr.rtd
Size 7KB
SHA256 9ecdf6459c809dd076e81c1517a7677ed6b6e212848f632d0437539b6c05a9d6
MD5 6ee022bca12d4f13bf9fe3e269ed6834
SHA1 a33853149da9cae65b3bdeff1a1f2291f945a447
SHA512 daa956118b1d786ed232f9a48263f6b00085032c14ad07c65a901c023b549c9a42b74ad7f45d3357f40419b3cbebf9d922cfdd9fd19a8e64b5507afd25f82265
SSDEEP 192:S6VsQ3FOgbusHhfRt9KwdBOZ4PYvB1RQ06OSGyaWMqUnE3LWLKCuq:pumuQVRt9KWOZ4PYF6O3FJjUltq
MD5 SHA1 SHA512 SSDEEP

Submit Download

heawrdkwqx.vts

Path C:\Users\Admin\AppData\Local\Temp\heawrdkwqx.vts
Size 464KB
SHA256 dec8966cd399c2645d7dcbae1141802ba494b4c0528db4e73cfc32c95056b9a3
MD5 29ea631b46b8bdba1b3961386dc8b69c
SHA1 71950a7b77f8c307fda7d77ea5fae321d8286800
SHA512 94b071c62a20b1bc18348976904e457de72207d4856842555311ed69f62ebd7a3f9cffc529226141f0d372507f6a87b61897d9efbb7f54f6b94c1ba6f54fb759
SSDEEP 12288:M/eSk7HqzXF1mW02c30GLlAwbXmVC68kT46WnqCJQjpY:M/Dk7HqzONE6AOm4e46OnQq
MD5 SHA1 SHA512 SSDEEP

Submit Download

umnrkin.exe

Path C:\Users\Admin\AppData\Local\Temp\umnrkin.exe
Size 74KB
SHA256 c21143b93a95d28ee1138424e1fc03c7f86faae6f0cc6c14b572e8a81406edf1
MD5 4d1f529d96a942886a5a936d70f13ea2
SHA1 59b40c33f601793e4e1109251d47fe3a6d7e234a
SHA512 5859d30dbd79fc38b18f8bc835d568627e2111afc3280ce7d9c7255bc9453a722f148006408fd17822de6e70ddfa0614a89b4e884591f4caabf4f11efd49e265
SSDEEP 1536:MxyydDhHUIcefD6LrFmbW3NYdP85/0k20IzujcAGX1NsWQcdPPIsdtCcq:adDJcefD6LrPCdP85/0k2acAGlxPQsdM
MD5 SHA1 SHA512 SSDEEP

Submit Download

umnrkin.exe

Path C:\Users\Admin\AppData\Local\Temp\umnrkin.exe
Size 74KB
SHA256 c21143b93a95d28ee1138424e1fc03c7f86faae6f0cc6c14b572e8a81406edf1
MD5 4d1f529d96a942886a5a936d70f13ea2
SHA1 59b40c33f601793e4e1109251d47fe3a6d7e234a
SHA512 5859d30dbd79fc38b18f8bc835d568627e2111afc3280ce7d9c7255bc9453a722f148006408fd17822de6e70ddfa0614a89b4e884591f4caabf4f11efd49e265
SSDEEP 1536:MxyydDhHUIcefD6LrFmbW3NYdP85/0k20IzujcAGX1NsWQcdPPIsdtCcq:adDJcefD6LrPCdP85/0k2acAGlxPQsdM
MD5 SHA1 SHA512 SSDEEP

Submit Download

umnrkin.exe

Path C:\Users\Admin\AppData\Local\Temp\umnrkin.exe
Size 74KB
SHA256 c21143b93a95d28ee1138424e1fc03c7f86faae6f0cc6c14b572e8a81406edf1
MD5 4d1f529d96a942886a5a936d70f13ea2
SHA1 59b40c33f601793e4e1109251d47fe3a6d7e234a
SHA512 5859d30dbd79fc38b18f8bc835d568627e2111afc3280ce7d9c7255bc9453a722f148006408fd17822de6e70ddfa0614a89b4e884591f4caabf4f11efd49e265
SSDEEP 1536:MxyydDhHUIcefD6LrFmbW3NYdP85/0k20IzujcAGX1NsWQcdPPIsdtCcq:adDJcefD6LrPCdP85/0k2acAGlxPQsdM
MD5 SHA1 SHA512 SSDEEP

Submit Download

umnrkin.exe

Path C:\Users\Admin\AppData\Local\Temp\umnrkin.exe
Size 74KB
SHA256 c21143b93a95d28ee1138424e1fc03c7f86faae6f0cc6c14b572e8a81406edf1
MD5 4d1f529d96a942886a5a936d70f13ea2
SHA1 59b40c33f601793e4e1109251d47fe3a6d7e234a
SHA512 5859d30dbd79fc38b18f8bc835d568627e2111afc3280ce7d9c7255bc9453a722f148006408fd17822de6e70ddfa0614a89b4e884591f4caabf4f11efd49e265
SSDEEP 1536:MxyydDhHUIcefD6LrFmbW3NYdP85/0k20IzujcAGX1NsWQcdPPIsdtCcq:adDJcefD6LrPCdP85/0k2acAGlxPQsdM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3876-141-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/3876-142-0x0000000000400000-0x000000000047B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads