remcos | 132bd4d8504eb976443884e5bbd55eda4108997b2e7eea370456dbc1485f058b

General

Target

6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe
Size

2.3MB
MD5

bb9596b3f5c30793501d639848378712
SHA1

20f3e55650c2dd10e3a38d35ab5a4a9cb4f83c2d
SHA256

6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167
SHA512

5781460eeae099457aa0c061974d2ed0c8d8953ecc03a8508a7d27483fc9d0083cc89b6eb81f78c22d6419fdbe422d104d31055a114ad39cc90446780f8c8316
SSDEEP

49152:1zdHFRzHZ7Sg397xrwRRiFCyZglGDdzx2:XjzxSwaiF7ZXDdzx

Score

10^/10

remcos gmg persistence rat

Malware Config

Extracted

Family

remcos

Botnet

GMG

C2

185.206.225.51:18853

127.0.0.1:18853

10.16.225.165:18853

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-BJSRH8
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ofmltbneezt = "\"C:\\Users\\Admin\\AppData\\Roaming\\Kwdrwtd\\Ofmltbneezt.exe\""	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe

description	pid	process	target process
PID 5032 set thread context of 1776	5032	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

3832 powershell.exe
3832 powershell.exe

pid	process
3832	powershell.exe
3832	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	5032	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe
Token: SeDebugPrivilege	3832	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe

C:\Users\Admin\AppData\Local\Temp\6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe
"C:\Users\Admin\AppData\Local\Temp\6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5032

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3832

C:\Users\Admin\AppData\Local\Temp\6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe
C:\Users\Admin\AppData\Local\Temp\6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe
2⤵
PID:1776

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1776-144-0x0000000000000000-mapping.dmp

Download
memory/1776-149-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1776-148-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1776-147-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1776-146-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1776-145-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3832-136-0x0000000000000000-mapping.dmp

Download
memory/3832-139-0x00000000054B0000-0x0000000005516000-memory.dmp

Filesize
408KB

Download
memory/3832-140-0x0000000005520000-0x0000000005586000-memory.dmp

Filesize
408KB

Download
memory/3832-141-0x0000000005C40000-0x0000000005C5E000-memory.dmp

Filesize
120KB

Download
memory/3832-142-0x0000000007210000-0x000000000788A000-memory.dmp

Filesize
6.5MB

Download
memory/3832-143-0x0000000006160000-0x000000000617A000-memory.dmp

Filesize
104KB

Download
memory/3832-138-0x0000000004D10000-0x0000000005338000-memory.dmp

Filesize
6.2MB

Download
memory/3832-137-0x00000000046A0000-0x00000000046D6000-memory.dmp

Filesize
216KB

Download
memory/5032-132-0x00000000000E0000-0x0000000000334000-memory.dmp

Filesize
2.3MB

Download
memory/5032-135-0x0000000005020000-0x0000000005042000-memory.dmp

Filesize
136KB

Download
memory/5032-134-0x00000000055A0000-0x0000000005B44000-memory.dmp

Filesize
5.6MB

Download
memory/5032-133-0x0000000004F50000-0x0000000004FE2000-memory.dmp

Filesize
584KB

Download

description	pid	process	target process
PID 5032 wrote to memory of 3832	5032	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe	powershell.exe
PID 5032 wrote to memory of 3832	5032	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe	powershell.exe
PID 5032 wrote to memory of 3832	5032	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe	powershell.exe
PID 5032 wrote to memory of 1776	5032	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe
PID 5032 wrote to memory of 1776	5032	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe
PID 5032 wrote to memory of 1776	5032	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe
PID 5032 wrote to memory of 1776	5032	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe
PID 5032 wrote to memory of 1776	5032	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe
PID 5032 wrote to memory of 1776	5032	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe
PID 5032 wrote to memory of 1776	5032	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe
PID 5032 wrote to memory of 1776	5032	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe
PID 5032 wrote to memory of 1776	5032	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe
PID 5032 wrote to memory of 1776	5032	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe
PID 5032 wrote to memory of 1776	5032	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe
PID 5032 wrote to memory of 1776	5032	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe	6999418460da451de7fd4dbc160989ca4c77dc270fd640a447abb8e06d241167.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads