remcos | 8453736e80df77744f2e82871bbfd9dcc62f166f5ed37e3f9e1e01a98bcef6e4

General

Target
UPDATED SOA.exe
Size 529KB
Sample230209-sagcpsge3w
SHA256 8453736e80df77744f2e82871bbfd9dcc62f166f5ed37e3f9e1e01a98bcef6e4
MD5 e5f9fff610aaa0d3467e47a12dac32db
SHA1 226cc82375b5705fa1f70192110999a92e72c645
SHA512 e107dc2cd07eb6d5d2527a3cd075ea29e0a0337da08fa2fa7e76152931289473ab6b4340c2b94b8fea8c45346df09ad88f59cdc92c46e959edd82ceeaae87eb0
SSDEEP 12288:vYZC/DVA/1U0S+S8Z1D8LAJibjj731SGa/rf1Q:vYZyDSNUV+SwDEAAbjP31q1Q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

45.87.61.104:3033

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-QWPMSY
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
3000	jmgtvybab.exe
2556	jmgtvybab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3000 set thread context of 2556	3000	jmgtvybab.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3000	jmgtvybab.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 3000	528	UPDATED SOA.exe	81
PID 528 wrote to memory of 3000	528	UPDATED SOA.exe	81
PID 528 wrote to memory of 3000	528	UPDATED SOA.exe	81
PID 3000 wrote to memory of 2556	3000	jmgtvybab.exe	82
PID 3000 wrote to memory of 2556	3000	jmgtvybab.exe	82
PID 3000 wrote to memory of 2556	3000	jmgtvybab.exe	82
PID 3000 wrote to memory of 2556	3000	jmgtvybab.exe	82

C:\Users\Admin\AppData\Local\Temp\UPDATED SOA.exe
"C:\Users\Admin\AppData\Local\Temp\UPDATED SOA.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:528
- C:\Users\Admin\AppData\Local\Temp\jmgtvybab.exe
  "C:\Users\Admin\AppData\Local\Temp\jmgtvybab.exe" C:\Users\Admin\AppData\Local\Temp\smjkk.t
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Users\Admin\AppData\Local\Temp\jmgtvybab.exe
    "C:\Users\Admin\AppData\Local\Temp\jmgtvybab.exe"
    3⤵
    - Executes dropped EXE
    PID:2556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jmgtvybab.exe

Path C:\Users\Admin\AppData\Local\Temp\jmgtvybab.exe
Size 122KB
SHA256 b201d9c6a3a0c85acbf87df1bdc9d1377f389867e7807b7cece516b9ad6efa7b
MD5 81f312e7bff302bf19673c4c6fa3c629
SHA1 1a377e3106aedee5bbf12539592d8114586b010b
SHA512 933e6777e51723b878a58e08351a6a4ef849ac700505759bb956ad1d5a865d23d1d8e23918a9f32b862bc3ecd3bf9a593082f25c99ce48cf0b1f777a97804fc8
SSDEEP 3072:sO9HnbxJtsvSRrKBwlM6zerg+huGCH/c25U/wdijnI3vfqjDPMaqKr:9nJtRoBH6zergb/c6ighK
MD5 SHA1 SHA512 SSDEEP

Submit Download

jmgtvybab.exe

Path C:\Users\Admin\AppData\Local\Temp\jmgtvybab.exe
Size 122KB
SHA256 b201d9c6a3a0c85acbf87df1bdc9d1377f389867e7807b7cece516b9ad6efa7b
MD5 81f312e7bff302bf19673c4c6fa3c629
SHA1 1a377e3106aedee5bbf12539592d8114586b010b
SHA512 933e6777e51723b878a58e08351a6a4ef849ac700505759bb956ad1d5a865d23d1d8e23918a9f32b862bc3ecd3bf9a593082f25c99ce48cf0b1f777a97804fc8
SSDEEP 3072:sO9HnbxJtsvSRrKBwlM6zerg+huGCH/c25U/wdijnI3vfqjDPMaqKr:9nJtRoBH6zergb/c6ighK
MD5 SHA1 SHA512 SSDEEP

Submit Download

jmgtvybab.exe

Path C:\Users\Admin\AppData\Local\Temp\jmgtvybab.exe
Size 122KB
SHA256 b201d9c6a3a0c85acbf87df1bdc9d1377f389867e7807b7cece516b9ad6efa7b
MD5 81f312e7bff302bf19673c4c6fa3c629
SHA1 1a377e3106aedee5bbf12539592d8114586b010b
SHA512 933e6777e51723b878a58e08351a6a4ef849ac700505759bb956ad1d5a865d23d1d8e23918a9f32b862bc3ecd3bf9a593082f25c99ce48cf0b1f777a97804fc8
SSDEEP 3072:sO9HnbxJtsvSRrKBwlM6zerg+huGCH/c25U/wdijnI3vfqjDPMaqKr:9nJtRoBH6zergb/c6ighK
MD5 SHA1 SHA512 SSDEEP

Submit Download

smjkk.t

Path C:\Users\Admin\AppData\Local\Temp\smjkk.t
Size 5KB
SHA256 1e7f363432dddb3e2adf3298ee229ae3a8464e4b0236110802dadfcb669669f5
MD5 78e52f0c177479c75201c468c9c78684
SHA1 62bf05f1e8a856aa4f5e6981f90d5cb2ab866a2d
SHA512 1b8bb8998c3b3534956fd1e5e0cc1b9818261a1a07659ebb9090d0a932a8b8efca9becda0d16905791754316bab671800f78c46911aab7330f807406d3ed171b
SSDEEP 96:Farc6oYBg/DrYuHNk2XO5oSwsacWZEQLp6oDKA3AhqwoGgNoQXzL2gf:FarcRh1hX1ShZIEQLp6ohYiRggf
MD5 SHA1 SHA512 SSDEEP

Submit Download

wjeoscwtg.bby

Path C:\Users\Admin\AppData\Local\Temp\wjeoscwtg.bby
Size 495KB
SHA256 73e431ff0502444c0efbdcb6f64e38f7ff3998883f3de012ec0bdc227ebdfed6
MD5 95b4af3ab337879b1705fd35a4df2082
SHA1 4319e1b42c946ec48a9ea0eb2293948e22f27d0e
SHA512 7013e1cb343a8a1740529b77bbd44dae23b44282578720c1467609eecacb9e65b00d05481fd75dc832d476f29b59e7942ddda7d572e549879780137eb99f9dfa
SSDEEP 12288:8syaGPmFhWnhYcwniRV1wd854e5b8rRQZZ5S:1yBeTn3UVKC4caRQ/g
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2556-139-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2556-140-0x0000000000400000-0x0000000000480000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads