remcos | 4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb

General

Target

4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe
Size

2.2MB
MD5

9f7d50137e6e95183c4d2a00489e78b7
SHA1

c059ee047b9a808efc09d40f7cf9c90bdbd87f4e
SHA256

4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb
SHA512

1cf107f8526374280614075ef474708d2a432033c7c34d60b8b7e0c33c390dd670baa5f492a1105c8ca79e88858f687f8fb628d92c51440dae0b415e2f000774
SSDEEP

12288:VPBxkfVOwE9dfLEazhIxRBtrGT3qOa2B9ARdn2VTudpOHjnWZQzjFeM6DJOjB9sT:rRwf0sqVTudpODnYQb6VOPOsMhaNI7

Score

10^/10

remcos bankhost rat

Malware Config

Extracted

Family

remcos

Botnet

BankHost

C2

aryexpcrt.ddns.net:36225

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-S4O8S2
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1324 set thread context of 748	1324	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	30

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
644	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1324	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe
Token: SeDebugPrivilege	644	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
748	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 644	1324	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	28
PID 1324 wrote to memory of 644	1324	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	28
PID 1324 wrote to memory of 644	1324	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	28
PID 1324 wrote to memory of 644	1324	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	28
PID 1324 wrote to memory of 748	1324	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	30
PID 1324 wrote to memory of 748	1324	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	30
PID 1324 wrote to memory of 748	1324	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	30
PID 1324 wrote to memory of 748	1324	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	30
PID 1324 wrote to memory of 748	1324	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	30
PID 1324 wrote to memory of 748	1324	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	30
PID 1324 wrote to memory of 748	1324	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	30
PID 1324 wrote to memory of 748	1324	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	30
PID 1324 wrote to memory of 748	1324	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	30
PID 1324 wrote to memory of 748	1324	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	30
PID 1324 wrote to memory of 748	1324	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	30
PID 1324 wrote to memory of 748	1324	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	30
PID 1324 wrote to memory of 748	1324	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	30
PID 1324 wrote to memory of 748	1324	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	30
PID 1324 wrote to memory of 748	1324	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	30
PID 1324 wrote to memory of 748	1324	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	30

C:\Users\Admin\AppData\Local\Temp\4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe
"C:\Users\Admin\AppData\Local\Temp\4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA1AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:644
- C:\Users\Admin\AppData\Local\Temp\4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe
  C:\Users\Admin\AppData\Local\Temp\4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/644-59-0x000000006F500000-0x000000006FAAB000-memory.dmp

Filesize
5.7MB

Download
memory/644-61-0x000000006F500000-0x000000006FAAB000-memory.dmp

Filesize
5.7MB

Download
memory/644-60-0x000000006F500000-0x000000006FAAB000-memory.dmp

Filesize
5.7MB

Download
memory/644-58-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/748-65-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/748-68-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/748-80-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/748-62-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/748-63-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/748-79-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/748-67-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/748-78-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/748-69-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/748-72-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/748-70-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/748-74-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1324-56-0x0000000000DF0000-0x0000000000E82000-memory.dmp

Filesize
584KB

Download
memory/1324-54-0x0000000000EC0000-0x00000000010F4000-memory.dmp

Filesize
2.2MB

Download
memory/1324-55-0x0000000004B70000-0x0000000004C84000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing