remcos | 4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb

General

Target

4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe
Size

2.2MB
MD5

9f7d50137e6e95183c4d2a00489e78b7
SHA1

c059ee047b9a808efc09d40f7cf9c90bdbd87f4e
SHA256

4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb
SHA512

1cf107f8526374280614075ef474708d2a432033c7c34d60b8b7e0c33c390dd670baa5f492a1105c8ca79e88858f687f8fb628d92c51440dae0b415e2f000774
SSDEEP

12288:VPBxkfVOwE9dfLEazhIxRBtrGT3qOa2B9ARdn2VTudpOHjnWZQzjFeM6DJOjB9sT:rRwf0sqVTudpODnYQb6VOPOsMhaNI7

Score

10^/10

remcos bankhost rat

Malware Config

Extracted

Family

remcos

Botnet

BankHost

C2

aryexpcrt.ddns.net:36225

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-S4O8S2
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4956 set thread context of 4232	4956	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	87

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
912	powershell.exe
912	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4956	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe
Token: SeDebugPrivilege	912	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4232	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 912	4956	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	77
PID 4956 wrote to memory of 912	4956	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	77
PID 4956 wrote to memory of 912	4956	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	77
PID 4956 wrote to memory of 4232	4956	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	87
PID 4956 wrote to memory of 4232	4956	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	87
PID 4956 wrote to memory of 4232	4956	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	87
PID 4956 wrote to memory of 4232	4956	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	87
PID 4956 wrote to memory of 4232	4956	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	87
PID 4956 wrote to memory of 4232	4956	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	87
PID 4956 wrote to memory of 4232	4956	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	87
PID 4956 wrote to memory of 4232	4956	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	87
PID 4956 wrote to memory of 4232	4956	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	87
PID 4956 wrote to memory of 4232	4956	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	87
PID 4956 wrote to memory of 4232	4956	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	87
PID 4956 wrote to memory of 4232	4956	4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe	87

C:\Users\Admin\AppData\Local\Temp\4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe
"C:\Users\Admin\AppData\Local\Temp\4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA1AA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:912
- C:\Users\Admin\AppData\Local\Temp\4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe
  C:\Users\Admin\AppData\Local\Temp\4f87ea2f7ba54d6d806c0755aa5ce59310905450a48e996369d9f1dfd83faeeb.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/912-140-0x00000000075C0000-0x0000000007C3A000-memory.dmp

Filesize
6.5MB

Download
memory/912-141-0x0000000006460000-0x000000000647A000-memory.dmp

Filesize
104KB

Download
memory/912-135-0x0000000002630000-0x0000000002666000-memory.dmp

Filesize
216KB

Download
memory/912-136-0x0000000005250000-0x0000000005878000-memory.dmp

Filesize
6.2MB

Download
memory/912-137-0x00000000051D0000-0x0000000005236000-memory.dmp

Filesize
408KB

Download
memory/912-139-0x0000000005F60000-0x0000000005F7E000-memory.dmp

Filesize
120KB

Download
memory/912-138-0x0000000005930000-0x0000000005996000-memory.dmp

Filesize
408KB

Download
memory/4232-143-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4232-144-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4232-145-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4232-146-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4232-147-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4956-132-0x0000000000FF0000-0x0000000001224000-memory.dmp

Filesize
2.2MB

Download
memory/4956-133-0x0000000005F20000-0x0000000005F42000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing