remcos | 98479f2d5e3f5147ddd504bcc7bd1a2b0a3b06ff5525f313a55ce81efc67fc28

General

Target

e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe
Size

1.1MB
MD5

d9b3775511c7538a73dfeaab0073b4b6
SHA1

e3a64adc43c5c5c0bfc725344407433b4b497fa9
SHA256

98479f2d5e3f5147ddd504bcc7bd1a2b0a3b06ff5525f313a55ce81efc67fc28
SHA512

6b685246032b7c4a09f4df63dbc1282dfdd9822911744d9b9bcb4b135139a7a25b7d0daf30fd0b62b254ede16d010dbd18e8a8adef384bcfa11400a4605e6969
SSDEEP

24576:QOwgbq09TF+lmP8iZ1P/wvDcm9puPYxsJ4gb:HrdDAvFYQsqgb

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

51.75.209.245:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-CMFPLR
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 884 set thread context of 772	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1116	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe
884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe
884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe
884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe
884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe
884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe
1724	powershell.exe
1376	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeDebugPrivilege	1724	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
772	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 1376	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe	27
PID 884 wrote to memory of 1376	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe	27
PID 884 wrote to memory of 1376	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe	27
PID 884 wrote to memory of 1376	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe	27
PID 884 wrote to memory of 1724	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe	29
PID 884 wrote to memory of 1724	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe	29
PID 884 wrote to memory of 1724	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe	29
PID 884 wrote to memory of 1724	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe	29
PID 884 wrote to memory of 1116	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe	31
PID 884 wrote to memory of 1116	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe	31
PID 884 wrote to memory of 1116	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe	31
PID 884 wrote to memory of 1116	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe	31
PID 884 wrote to memory of 772	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe	33
PID 884 wrote to memory of 772	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe	33
PID 884 wrote to memory of 772	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe	33
PID 884 wrote to memory of 772	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe	33
PID 884 wrote to memory of 772	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe	33
PID 884 wrote to memory of 772	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe	33
PID 884 wrote to memory of 772	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe	33
PID 884 wrote to memory of 772	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe	33
PID 884 wrote to memory of 772	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe	33
PID 884 wrote to memory of 772	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe	33
PID 884 wrote to memory of 772	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe	33
PID 884 wrote to memory of 772	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe	33
PID 884 wrote to memory of 772	884	e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe	33

C:\Users\Admin\AppData\Local\Temp\e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe
"C:\Users\Admin\AppData\Local\Temp\e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:884
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1376
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oCfQiTZ.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1724
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oCfQiTZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCC07.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1116
- C:\Users\Admin\AppData\Local\Temp\e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe
  "C:\Users\Admin\AppData\Local\Temp\e3a64adc43c5c5c0bfc725344407433b4b497fa9.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpCC07.tmp

Filesize
1KB

MD5
5016ef1d9d4dbd5f2676c6fdaef70d7e

SHA1
b20804b30d24b182054c1044bcf61aaeb15c5115

SHA256
6f2732a6a48d60f21ae8aab2d3e12b253d9845a99b3687e71f7b2f4fa9cc947e

SHA512
c861817c5ab39cd3e805f18e497332ea81a62f5d38edf41bb97ef7877d651581503e7b8bb92b95f45bc1cb347f0c6f78fe8a90a67b386632697f4ae78a1eb570

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
92965446a7159ac6295968cc35e92d37

SHA1
054eacd93eef0aa967231f1ac75b68c163cb9de3

SHA256
84676647f0b04c2cdefb473853a3680db84c041c5f4b7b94a6f47df5060864b0

SHA512
5863f8c87a04789b787a5908eb544f0c6cfc771b5409d1a381d437668dc1516f3f271794cd9e0fadc686630fabe90a83ea5c8f95d0235e657fef2ca45c3f0298

Download Submit
memory/772-77-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/772-83-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/772-72-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/772-88-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/772-73-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/772-86-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/772-74-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/772-79-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/772-67-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/772-68-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/772-70-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/772-75-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/884-55-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/884-58-0x0000000008080000-0x000000000814C000-memory.dmp

Filesize
816KB

Download
memory/884-54-0x0000000000FE0000-0x0000000001108000-memory.dmp

Filesize
1.2MB

Download
memory/884-66-0x00000000082A0000-0x0000000008336000-memory.dmp

Filesize
600KB

Download
memory/884-56-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/884-57-0x0000000000380000-0x000000000038A000-memory.dmp

Filesize
40KB

Download
memory/1376-84-0x000000006D9E0000-0x000000006DF8B000-memory.dmp

Filesize
5.7MB

Download
memory/1724-85-0x000000006D9E0000-0x000000006DF8B000-memory.dmp

Filesize
5.7MB

Download
memory/1724-87-0x000000006D9E0000-0x000000006DF8B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads