remcos | aed9dfb7ea1e556b7c3046fd5169d0e335ec18b1f59bc88b45b8b419c100fe87

General

Target

36fa8014af4492c716b6c183aa8bd2c3.exe
Size

6KB
MD5

36fa8014af4492c716b6c183aa8bd2c3
SHA1

a8b97702b4ca9c93a81c96701a477c78f73369f4
SHA256

aed9dfb7ea1e556b7c3046fd5169d0e335ec18b1f59bc88b45b8b419c100fe87
SHA512

0a69db5624f4ddfd26d275965302eb86ed5617f74ba55be9da58deef3170555170ad8c526babb4d5ef3f2c6841bf1c09cc37ac63c42f13b17b79888ce51c2362
SSDEEP

96:yHAusqedIuZaNFx0gS1dRJVRVD4ZLEaqrBtxkaEtdrKFnU:yHAuknJVUV/0BkN7/

Score

10^/10

remcos subir-gente rat

Malware Config

Extracted

Family

remcos

Botnet

SUBIR-GENTE

C2

relocosrelocos.dyndns-at-home.com:3078

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-HXMVXC
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	36fa8014af4492c716b6c183aa8bd2c3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1140 set thread context of 3492	1140	36fa8014af4492c716b6c183aa8bd2c3.exe	91

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	InstallUtil.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2452	powershell.exe
2452	powershell.exe
1140	36fa8014af4492c716b6c183aa8bd2c3.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1140	36fa8014af4492c716b6c183aa8bd2c3.exe
Token: SeDebugPrivilege	2452	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3492	InstallUtil.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 2452	1140	36fa8014af4492c716b6c183aa8bd2c3.exe	83
PID 1140 wrote to memory of 2452	1140	36fa8014af4492c716b6c183aa8bd2c3.exe	83
PID 1140 wrote to memory of 2452	1140	36fa8014af4492c716b6c183aa8bd2c3.exe	83
PID 1140 wrote to memory of 3492	1140	36fa8014af4492c716b6c183aa8bd2c3.exe	91
PID 1140 wrote to memory of 3492	1140	36fa8014af4492c716b6c183aa8bd2c3.exe	91
PID 1140 wrote to memory of 3492	1140	36fa8014af4492c716b6c183aa8bd2c3.exe	91
PID 1140 wrote to memory of 3492	1140	36fa8014af4492c716b6c183aa8bd2c3.exe	91
PID 1140 wrote to memory of 3492	1140	36fa8014af4492c716b6c183aa8bd2c3.exe	91
PID 1140 wrote to memory of 3492	1140	36fa8014af4492c716b6c183aa8bd2c3.exe	91
PID 1140 wrote to memory of 3492	1140	36fa8014af4492c716b6c183aa8bd2c3.exe	91
PID 1140 wrote to memory of 3492	1140	36fa8014af4492c716b6c183aa8bd2c3.exe	91
PID 1140 wrote to memory of 3492	1140	36fa8014af4492c716b6c183aa8bd2c3.exe	91
PID 1140 wrote to memory of 3492	1140	36fa8014af4492c716b6c183aa8bd2c3.exe	91
PID 1140 wrote to memory of 3492	1140	36fa8014af4492c716b6c183aa8bd2c3.exe	91
PID 1140 wrote to memory of 3492	1140	36fa8014af4492c716b6c183aa8bd2c3.exe	91
PID 3492 wrote to memory of 1544	3492	InstallUtil.exe	93
PID 3492 wrote to memory of 1544	3492	InstallUtil.exe	93
PID 3492 wrote to memory of 1544	3492	InstallUtil.exe	93

C:\Users\Admin\AppData\Local\Temp\36fa8014af4492c716b6c183aa8bd2c3.exe
"C:\Users\Admin\AppData\Local\Temp\36fa8014af4492c716b6c183aa8bd2c3.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2452
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ysgrtpupgkqxxthorghbuyhs.vbs"
    3⤵
    PID:1544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ysgrtpupgkqxxthorghbuyhs.vbs

Filesize
382B

MD5
3db952c728fab3baa68a61db75d074c8

SHA1
67f61b864fe60acee701cea9cb65469395ff8f30

SHA256
b1860633c96be2e60353cf76801c6ea53df1761af69383337b297487748a044b

SHA512
a1046e6de280772b293d7f4bb1afd2729d0f435265591ed3e3861607ab8366176e3d53b1a1b628d1adaa396475d6612ea8531ee593198e9ac99d1f5d5bbecea1

Download Submit
memory/1140-132-0x0000000000950000-0x0000000000958000-memory.dmp

Filesize
32KB

Download
memory/1140-133-0x0000000006AE0000-0x0000000006B02000-memory.dmp

Filesize
136KB

Download
memory/2452-140-0x00000000079F0000-0x000000000806A000-memory.dmp

Filesize
6.5MB

Download
memory/2452-135-0x0000000002DA0000-0x0000000002DD6000-memory.dmp

Filesize
216KB

Download
memory/2452-138-0x0000000005D50000-0x0000000005DB6000-memory.dmp

Filesize
408KB

Download
memory/2452-139-0x0000000006380000-0x000000000639E000-memory.dmp

Filesize
120KB

Download
memory/2452-136-0x0000000005640000-0x0000000005C68000-memory.dmp

Filesize
6.2MB

Download
memory/2452-141-0x0000000006870000-0x000000000688A000-memory.dmp

Filesize
104KB

Download
memory/2452-137-0x0000000005CE0000-0x0000000005D46000-memory.dmp

Filesize
408KB

Download
memory/3492-143-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3492-145-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3492-146-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3492-147-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3492-144-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3492-149-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download

Analysis

Sharing