remcos | 8bd7c472ccc01bdc5bc39c49af563d4f17b283b61a9612d0048eda5510a1741f

General

Target

SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe
Size

997KB
MD5

5be047c4918352d2c4e0b7b767442f49
SHA1

b1e516c00130153bb1e16168be84c192d37f70da
SHA256

8bd7c472ccc01bdc5bc39c49af563d4f17b283b61a9612d0048eda5510a1741f
SHA512

18d6f2134e76faacac43f644db391d15b3f2c43db829f3e4b876fca701d582e5ac028f1cecb6aba89115880bc482fdd4ea499c71db945d90b86fd86c53a7c03a
SSDEEP

24576:s+TdsTkf6lDpUVM7fMbzoHND3PwG3KNLctcRKX/N8I:xT2S6sGMb8HpwybtcRul

Score

10^/10

remcos evans persistence rat

Malware Config

Extracted

Family

remcos

Version

2.7.1 Pro

Botnet

Evans

C2

46.183.216.163:8107

127.0.0.1:8107

10.26.173.68:8107

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-EFXK55
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Szfsg = "\"C:\\Users\\Admin\\AppData\\Roaming\\Vbmmscmkft\\Szfsg.exe\""	SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1940 set thread context of 1648	1940	SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1476	powershell.exe
1688	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1476	powershell.exe
Token: SeDebugPrivilege	1940	SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe
Token: SeDebugPrivilege	1688	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1476	1940	SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe	27
PID 1940 wrote to memory of 1476	1940	SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe	27
PID 1940 wrote to memory of 1476	1940	SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe	27
PID 1940 wrote to memory of 1476	1940	SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe	27
PID 1940 wrote to memory of 1688	1940	SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe	29
PID 1940 wrote to memory of 1688	1940	SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe	29
PID 1940 wrote to memory of 1688	1940	SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe	29
PID 1940 wrote to memory of 1688	1940	SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe	29
PID 1940 wrote to memory of 1648	1940	SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe	31
PID 1940 wrote to memory of 1648	1940	SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe	31
PID 1940 wrote to memory of 1648	1940	SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe	31
PID 1940 wrote to memory of 1648	1940	SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe	31
PID 1940 wrote to memory of 1648	1940	SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe	31
PID 1940 wrote to memory of 1648	1940	SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe	31
PID 1940 wrote to memory of 1648	1940	SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe	31
PID 1940 wrote to memory of 1648	1940	SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe	31
PID 1940 wrote to memory of 1648	1940	SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe	31
PID 1940 wrote to memory of 1648	1940	SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe	31
PID 1940 wrote to memory of 1648	1940	SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe	31

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1476
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMQAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1688
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe
  C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILHeracles.52650.5533.14419.exe
  2⤵
  PID:1648

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
77e67cd303d8d9189c64184fdaed82fe

SHA1
fcd8d6935ac9ccab82961284a1e52a7f2eb18ff2

SHA256
4e54d0cee69aa92ee6c1b7c0a03bd978e8427995b529e8d9c20afce086e7fe7d

SHA512
5b10f10ea6b0a6890a0ed4fb151fe4acb67dc9a789a67616426450801a69c053ba49cfb8f5880bbd39ccf5585976945e9b21aaf11191aac6ab010c74440dc932

Download Submit
memory/1476-59-0x0000000070340000-0x00000000708EB000-memory.dmp

Filesize
5.7MB

Download
memory/1476-58-0x0000000070340000-0x00000000708EB000-memory.dmp

Filesize
5.7MB

Download
memory/1648-73-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1648-81-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1648-80-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1648-79-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1648-75-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1648-66-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1648-67-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1648-69-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1648-71-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1648-72-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1688-65-0x000000006ED10000-0x000000006F2BB000-memory.dmp

Filesize
5.7MB

Download
memory/1688-64-0x000000006ED10000-0x000000006F2BB000-memory.dmp

Filesize
5.7MB

Download
memory/1940-54-0x0000000000980000-0x0000000000A7E000-memory.dmp

Filesize
1016KB

Download
memory/1940-60-0x0000000005AD0000-0x0000000005CF8000-memory.dmp

Filesize
2.2MB

Download
memory/1940-55-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing