remcos | 20d412f4c2d2cf23a735109ee712e5df0c03e7ed6b16c0d9f61cff2f4be77549

General

Target
168b8482ffa38cfa8e0854c574738d14.exe
Size 759KB
Sample230109-rseq6aee54
SHA256 20d412f4c2d2cf23a735109ee712e5df0c03e7ed6b16c0d9f61cff2f4be77549
MD5 168b8482ffa38cfa8e0854c574738d14
SHA1 4bbd4e658d61cb25680bde5bb080c7347ec1b593
SHA512 73d095e33b446e038a79c0dc70ddae9f6f39ca101219eec0f104e2334c102f3f7fdf9f817e15d279dead603835452120359240336f4bcebeb5277337a5b66a00
SSDEEP 12288:aYshRpaV1QdiPUrjiqXbp3/9AIlTtFHlHfidyqPcQ8e7Uq7m7hA0GuyGP06Fmo:aYswVZPJkbZ/9ptidfg7A0Gu1sKmo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

favgrandson7.sytes.net:1993

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-HFW64Q
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
2440	luxdclttdd.exe
3412	luxdclttdd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2440 set thread context of 3412	2440	luxdclttdd.exe	79

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2440	luxdclttdd.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3412	luxdclttdd.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2440	1632	168b8482ffa38cfa8e0854c574738d14.exe	78
PID 1632 wrote to memory of 2440	1632	168b8482ffa38cfa8e0854c574738d14.exe	78
PID 1632 wrote to memory of 2440	1632	168b8482ffa38cfa8e0854c574738d14.exe	78
PID 2440 wrote to memory of 3412	2440	luxdclttdd.exe	79
PID 2440 wrote to memory of 3412	2440	luxdclttdd.exe	79
PID 2440 wrote to memory of 3412	2440	luxdclttdd.exe	79
PID 2440 wrote to memory of 3412	2440	luxdclttdd.exe	79

C:\Users\Admin\AppData\Local\Temp\168b8482ffa38cfa8e0854c574738d14.exe
"C:\Users\Admin\AppData\Local\Temp\168b8482ffa38cfa8e0854c574738d14.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\luxdclttdd.exe
  "C:\Users\Admin\AppData\Local\Temp\luxdclttdd.exe" C:\Users\Admin\AppData\Local\Temp\mxthmaqtcrk.fam
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Users\Admin\AppData\Local\Temp\luxdclttdd.exe
    "C:\Users\Admin\AppData\Local\Temp\luxdclttdd.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3412

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cvtepgqsfb.ve

Path C:\Users\Admin\AppData\Local\Temp\cvtepgqsfb.ve
Size 491KB
SHA256 283e0ff5b563bc8e1c24ee4715e25d80d31b32ce2df8474c4d456fb6fafe168a
MD5 d08ff5d03af837268ba20b1fd3e1576e
SHA1 42888fc86246ede8d99ff10301e49deeec2931a2
SHA512 286b6b813a9356091339c5c32ffe0f5a4bda586eff6a2ca019f58fb3acce1e6df627a47b3c73838ab659851905389f5ac5b8b9a91df25f7bc36087c26f9856dc
SSDEEP 12288:XTPnIxoKA/9HLG/eTnxqyhDtrvOhqLRYqPR8ARz5inBoD:DPIxrE9aeDxq6MhqyILlD
MD5 SHA1 SHA512 SSDEEP

Submit Download

luxdclttdd.exe

Path C:\Users\Admin\AppData\Local\Temp\luxdclttdd.exe
Size 265KB
SHA256 4743756a524fe3a4394d256f9bbf1cd91a9f00abd29187c41e7c90abf0e2d83d
MD5 aaaad257a5585f145dc40f282b6cddd3
SHA1 f91988df0bbcad60414ac5a30521e68c2d86b624
SHA512 2510f928cabea89fd84818b89c5519cf68b6c0cecb8c311b8fabfa6011f10cbd6639bd5b692c8c5d2b5fc5eec30008a6dc0d65e9d80eb30d62fb83178c6b39c9
SSDEEP 6144:TPq62SziXlHvh2boJqY9PMfEnU7y1YnCZ1RoEkY8beg+zY6Ym96U51RGgFAS:TH20iXlHvh2boJqYifEnCy1/qY2+z39N
MD5 SHA1 SHA512 SSDEEP

Submit Download

luxdclttdd.exe

Path C:\Users\Admin\AppData\Local\Temp\luxdclttdd.exe
Size 265KB
SHA256 4743756a524fe3a4394d256f9bbf1cd91a9f00abd29187c41e7c90abf0e2d83d
MD5 aaaad257a5585f145dc40f282b6cddd3
SHA1 f91988df0bbcad60414ac5a30521e68c2d86b624
SHA512 2510f928cabea89fd84818b89c5519cf68b6c0cecb8c311b8fabfa6011f10cbd6639bd5b692c8c5d2b5fc5eec30008a6dc0d65e9d80eb30d62fb83178c6b39c9
SSDEEP 6144:TPq62SziXlHvh2boJqY9PMfEnU7y1YnCZ1RoEkY8beg+zY6Ym96U51RGgFAS:TH20iXlHvh2boJqYifEnCy1/qY2+z39N
MD5 SHA1 SHA512 SSDEEP

Submit Download

luxdclttdd.exe

Path C:\Users\Admin\AppData\Local\Temp\luxdclttdd.exe
Size 265KB
SHA256 4743756a524fe3a4394d256f9bbf1cd91a9f00abd29187c41e7c90abf0e2d83d
MD5 aaaad257a5585f145dc40f282b6cddd3
SHA1 f91988df0bbcad60414ac5a30521e68c2d86b624
SHA512 2510f928cabea89fd84818b89c5519cf68b6c0cecb8c311b8fabfa6011f10cbd6639bd5b692c8c5d2b5fc5eec30008a6dc0d65e9d80eb30d62fb83178c6b39c9
SSDEEP 6144:TPq62SziXlHvh2boJqY9PMfEnU7y1YnCZ1RoEkY8beg+zY6Ym96U51RGgFAS:TH20iXlHvh2boJqYifEnCy1/qY2+z39N
MD5 SHA1 SHA512 SSDEEP

Submit Download

mxthmaqtcrk.fam

Path C:\Users\Admin\AppData\Local\Temp\mxthmaqtcrk.fam
Size 5KB
SHA256 124fff90bbf42684c4ba8bcec89f0dde36aaa348c2fc75471e4a92ae5ac57a68
MD5 2d135a36f114a827c50cce09f716acfb
SHA1 04b94b9663ea18c768900284c76fa994e7f649d2
SHA512 afab58d25ff1cdc87772ad1f5b2effc9dde9d987555d842bf44b91c778f5f4beb4bf329fb874147fed8ed6abc90ebe5904be17267460ec113a4239719e9281d4
SSDEEP 96:Farc6oYPpg/DrYuklk2XO5oSwsGBjcWMP0vEFrUbeBLCV760doT13JkD3RnTout1:FarcRmumhX1ShGBYHP0MNUCBWVWNwRrr
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3412-139-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/3412-140-0x0000000000400000-0x000000000047F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads