remcos | e6ccfb81e116a6c7d498051b0d0e32eea2e9ab9a2ed71cd43e8c1a8385fd4a86

General

Target
e6ccfb81e116a6c7d498051b0d0e32eea2e9ab9a2ed71cd43e8c1a8385fd4a86.exe
Size 471KB
Sample230211-bybzfsac3w
SHA256 e6ccfb81e116a6c7d498051b0d0e32eea2e9ab9a2ed71cd43e8c1a8385fd4a86
MD5 346053019efa6f39a24201cbbc997395
SHA1 6495f24aa6a4b0446a7403f8a878bfc1f6550ed9
SHA512 45df6b59390b8c29f4e1524a45ca877574c8ae21c8180a042a93ac5e8ad47f77520436f0d432d106567130bcdeee7e26d41171d9380f4a657ce74fe571ef6002
SSDEEP 6144:EbdjQFiTrgVohW1ydxCrLkE7ZFCSq1zeH4L5WIMOHsAOZZL1XBcY2k4:EbdUYCohW1kMfkEbCSqxeYdsfZLek4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost evasion persistence rat trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

141.95.16.111:2420

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
msedge.exe
copy_folder
Edge
delete_file
false
hide_file
true
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
text
keylog_path
%AppData%
mouse_option
false
mutex
Rmc-C9Y748
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
msedge
take_screenshot_option
true
take_screenshot_time
5
take_screenshot_title
paypal;gmail;mail;exodus;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	e6ccfb81e116a6c7d498051b0d0e32eea2e9ab9a2ed71cd43e8c1a8385fd4a86.exe

Executes dropped EXE 1 IoCs

pid	Process
2900	msedge.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msedge = "\"C:\\ProgramData\\Edge\\msedge.exe\""	e6ccfb81e116a6c7d498051b0d0e32eea2e9ab9a2ed71cd43e8c1a8385fd4a86.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msedge = "\"C:\\ProgramData\\Edge\\msedge.exe\""	msedge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msedge = "\"C:\\ProgramData\\Edge\\msedge.exe\""	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	e6ccfb81e116a6c7d498051b0d0e32eea2e9ab9a2ed71cd43e8c1a8385fd4a86.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msedge = "\"C:\\ProgramData\\Edge\\msedge.exe\""	e6ccfb81e116a6c7d498051b0d0e32eea2e9ab9a2ed71cd43e8c1a8385fd4a86.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	e6ccfb81e116a6c7d498051b0d0e32eea2e9ab9a2ed71cd43e8c1a8385fd4a86.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2900 set thread context of 4160	2900	msedge.exe	89

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	e6ccfb81e116a6c7d498051b0d0e32eea2e9ab9a2ed71cd43e8c1a8385fd4a86.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4052	reg.exe
4928	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2900	msedge.exe
2900	msedge.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2900	msedge.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 1364	4640	e6ccfb81e116a6c7d498051b0d0e32eea2e9ab9a2ed71cd43e8c1a8385fd4a86.exe	79
PID 4640 wrote to memory of 1364	4640	e6ccfb81e116a6c7d498051b0d0e32eea2e9ab9a2ed71cd43e8c1a8385fd4a86.exe	79
PID 4640 wrote to memory of 1364	4640	e6ccfb81e116a6c7d498051b0d0e32eea2e9ab9a2ed71cd43e8c1a8385fd4a86.exe	79
PID 1364 wrote to memory of 4052	1364	cmd.exe	81
PID 1364 wrote to memory of 4052	1364	cmd.exe	81
PID 1364 wrote to memory of 4052	1364	cmd.exe	81
PID 4640 wrote to memory of 1384	4640	e6ccfb81e116a6c7d498051b0d0e32eea2e9ab9a2ed71cd43e8c1a8385fd4a86.exe	82
PID 4640 wrote to memory of 1384	4640	e6ccfb81e116a6c7d498051b0d0e32eea2e9ab9a2ed71cd43e8c1a8385fd4a86.exe	82
PID 4640 wrote to memory of 1384	4640	e6ccfb81e116a6c7d498051b0d0e32eea2e9ab9a2ed71cd43e8c1a8385fd4a86.exe	82
PID 1384 wrote to memory of 1912	1384	WScript.exe	83
PID 1384 wrote to memory of 1912	1384	WScript.exe	83
PID 1384 wrote to memory of 1912	1384	WScript.exe	83
PID 1912 wrote to memory of 2900	1912	cmd.exe	85
PID 1912 wrote to memory of 2900	1912	cmd.exe	85
PID 1912 wrote to memory of 2900	1912	cmd.exe	85
PID 2900 wrote to memory of 3444	2900	msedge.exe	87
PID 2900 wrote to memory of 3444	2900	msedge.exe	87
PID 2900 wrote to memory of 3444	2900	msedge.exe	87
PID 2900 wrote to memory of 4160	2900	msedge.exe	89
PID 2900 wrote to memory of 4160	2900	msedge.exe	89
PID 2900 wrote to memory of 4160	2900	msedge.exe	89
PID 2900 wrote to memory of 4160	2900	msedge.exe	89
PID 3444 wrote to memory of 4928	3444	cmd.exe	90
PID 3444 wrote to memory of 4928	3444	cmd.exe	90
PID 3444 wrote to memory of 4928	3444	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\e6ccfb81e116a6c7d498051b0d0e32eea2e9ab9a2ed71cd43e8c1a8385fd4a86.exe
"C:\Users\Admin\AppData\Local\Temp\e6ccfb81e116a6c7d498051b0d0e32eea2e9ab9a2ed71cd43e8c1a8385fd4a86.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\SysWOW64\cmd.exe
  /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - Modifies registry key
    PID:4052
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dkypuonyuupwirfobtsmsztpp.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Edge\msedge.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\ProgramData\Edge\msedge.exe
      C:\ProgramData\Edge\msedge.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2900
    - - C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3444
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        UAC bypass
        Modifies registry key
        
        PID:4928
    - - \??\c:\program files (x86)\internet explorer\iexplore.exe
        
        "c:\program files (x86)\internet explorer\iexplore.exe"
        5⤵
        
        PID:4160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msedge.exe

Path C:\ProgramData\Edge\msedge.exe
Size 471KB
SHA256 e6ccfb81e116a6c7d498051b0d0e32eea2e9ab9a2ed71cd43e8c1a8385fd4a86
MD5 346053019efa6f39a24201cbbc997395
SHA1 6495f24aa6a4b0446a7403f8a878bfc1f6550ed9
SHA512 45df6b59390b8c29f4e1524a45ca877574c8ae21c8180a042a93ac5e8ad47f77520436f0d432d106567130bcdeee7e26d41171d9380f4a657ce74fe571ef6002
SSDEEP 6144:EbdjQFiTrgVohW1ydxCrLkE7ZFCSq1zeH4L5WIMOHsAOZZL1XBcY2k4:EbdUYCohW1kMfkEbCSqxeYdsfZLek4
MD5 SHA1 SHA512 SSDEEP

Submit Download

msedge.exe

Path C:\ProgramData\Edge\msedge.exe
Size 471KB
SHA256 e6ccfb81e116a6c7d498051b0d0e32eea2e9ab9a2ed71cd43e8c1a8385fd4a86
MD5 346053019efa6f39a24201cbbc997395
SHA1 6495f24aa6a4b0446a7403f8a878bfc1f6550ed9
SHA512 45df6b59390b8c29f4e1524a45ca877574c8ae21c8180a042a93ac5e8ad47f77520436f0d432d106567130bcdeee7e26d41171d9380f4a657ce74fe571ef6002
SSDEEP 6144:EbdjQFiTrgVohW1ydxCrLkE7ZFCSq1zeH4L5WIMOHsAOZZL1XBcY2k4:EbdUYCohW1kMfkEbCSqxeYdsfZLek4
MD5 SHA1 SHA512 SSDEEP

Submit Download

dkypuonyuupwirfobtsmsztpp.vbs

Path C:\Users\Admin\AppData\Local\Temp\dkypuonyuupwirfobtsmsztpp.vbs
Size 382B
SHA256 5d376fd3456c206dbc15d7aa6d80693e0ecd82dd9ef27ee4839cfc9a3c26c16d
MD5 80c8cf651402c302cdc7e95075ecc444
SHA1 e8ace9a33b8c69b09e69246b98b78096be3f2b2b
SHA512 29abb58bd387e5979311aa8f814becdb90a253991127dbc02ed85820430a367f263a23149a7acbeb46c4cf8393d14f6f7d8908eec6299f77f95339fb3bdba9c7
MD5 SHA1 SHA512

Submit Download

memory/4160-142-0x0000000000740000-0x00000000007BF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads