remcos | 53a35d0a8b95fb9a8d2bf146d1a25283ade24cf75df41328ff8336df06b218f7

General

Target
doc 20230214004004000010100.pdf.exe
Size 507KB
Sample230214-mgejsscf46
SHA256 75aeaaf27afdce05ee46fc6da053fb253d77a2b0ed930a3b3078cfdcd4bc6c2e
MD5 a6b962dee2a0ab0278f9529696b634f2
SHA1 262a1cbc2695c59ba528e20cac57f3903e166b5e
SHA512 0da452c6902877b4c068305ccb632703bb0fd3613fbdc836fb20de0688f77f85fcaffce6b9d13622c4f47b76bd34b8125c3e8b22d8582481cf47ba30e78981df
SSDEEP 12288:/YLnfSWzlGjNXgL0ObaSYfxCR9VXHAHs3h7t3Il5IBkoI6Q:/YLfTIE0OvsWSah54l5IBkL6Q
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

report1.duckdns.org:5890

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-O5GSXS
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
4748	rzwqslxpya.exe
2004	rzwqslxpya.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jykuuecj = "C:\\Users\\Admin\\AppData\\Roaming\\ccrqsghftj\\ugxllyr.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\rzwqslxpya.exe\" C:\\Users\\Admin\\AppData\\Lo"	rzwqslxpya.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4748 set thread context of 2004	4748	rzwqslxpya.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4748	rzwqslxpya.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2004	rzwqslxpya.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 4748	4820	doc 20230214004004000010100.pdf.exe	79
PID 4820 wrote to memory of 4748	4820	doc 20230214004004000010100.pdf.exe	79
PID 4820 wrote to memory of 4748	4820	doc 20230214004004000010100.pdf.exe	79
PID 4748 wrote to memory of 2004	4748	rzwqslxpya.exe	80
PID 4748 wrote to memory of 2004	4748	rzwqslxpya.exe	80
PID 4748 wrote to memory of 2004	4748	rzwqslxpya.exe	80
PID 4748 wrote to memory of 2004	4748	rzwqslxpya.exe	80

C:\Users\Admin\AppData\Local\Temp\doc 20230214004004000010100.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\doc 20230214004004000010100.pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Users\Admin\AppData\Local\Temp\rzwqslxpya.exe
  "C:\Users\Admin\AppData\Local\Temp\rzwqslxpya.exe" C:\Users\Admin\AppData\Local\Temp\nqmevjk.k
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Users\Admin\AppData\Local\Temp\rzwqslxpya.exe
    "C:\Users\Admin\AppData\Local\Temp\rzwqslxpya.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

nqmevjk.k

Path C:\Users\Admin\AppData\Local\Temp\nqmevjk.k
Size 7KB
SHA256 154d38cbe4ad8c7a07f16dde556b8f92a04554b39d21e524fb3cc2f846b9d41e
MD5 333782d8841c3470bc6a9b7ecf7ea00a
SHA1 88c93dba5b57cb6f002e78396316610240769cb6
SHA512 060e4ead4dcb91462606e4c64e8d7fa9fc4b7fb76eb77c12b6f8b0498be454801d8c06b75eb033f82794ec7b1a1c9425ac843773e9b714023b51ef6cfbd71628
SSDEEP 192:darcitQvArWiPvubb9DGSDmGXLcbZC0U151hJLrLXC:uCYrNPvuf/D57cb40U5hJTy
MD5 SHA1 SHA512 SSDEEP

Submit Download

rzwqslxpya.exe

Path C:\Users\Admin\AppData\Local\Temp\rzwqslxpya.exe
Size 70KB
SHA256 62a16520f7463870e08d8ba0c4cc43298c047fb2a2537471263538f6fd8454c0
MD5 58051d669cd3d3f6e14843d3ce106a0e
SHA1 0a6ddf589bea94f229d8e36a1e846869fc3eec74
SHA512 db5c7f39a34f57551613c5f6af46c31a7c663414aa6218c1a7afc1db56f4d3f52c0db1a8d9ff779d1211c749e4293d92f0b0690969ff8778af1f6a87e2990e6f
SSDEEP 1536:BFIUn3hHFeTNX55DMRWhZYLL4rnG7lQoPGb6kbIhX:bIU9FIha/4etv
MD5 SHA1 SHA512 SSDEEP

Submit Download

rzwqslxpya.exe

Path C:\Users\Admin\AppData\Local\Temp\rzwqslxpya.exe
Size 70KB
SHA256 62a16520f7463870e08d8ba0c4cc43298c047fb2a2537471263538f6fd8454c0
MD5 58051d669cd3d3f6e14843d3ce106a0e
SHA1 0a6ddf589bea94f229d8e36a1e846869fc3eec74
SHA512 db5c7f39a34f57551613c5f6af46c31a7c663414aa6218c1a7afc1db56f4d3f52c0db1a8d9ff779d1211c749e4293d92f0b0690969ff8778af1f6a87e2990e6f
SSDEEP 1536:BFIUn3hHFeTNX55DMRWhZYLL4rnG7lQoPGb6kbIhX:bIU9FIha/4etv
MD5 SHA1 SHA512 SSDEEP

Submit Download

rzwqslxpya.exe

Path C:\Users\Admin\AppData\Local\Temp\rzwqslxpya.exe
Size 70KB
SHA256 62a16520f7463870e08d8ba0c4cc43298c047fb2a2537471263538f6fd8454c0
MD5 58051d669cd3d3f6e14843d3ce106a0e
SHA1 0a6ddf589bea94f229d8e36a1e846869fc3eec74
SHA512 db5c7f39a34f57551613c5f6af46c31a7c663414aa6218c1a7afc1db56f4d3f52c0db1a8d9ff779d1211c749e4293d92f0b0690969ff8778af1f6a87e2990e6f
SSDEEP 1536:BFIUn3hHFeTNX55DMRWhZYLL4rnG7lQoPGb6kbIhX:bIU9FIha/4etv
MD5 SHA1 SHA512 SSDEEP

Submit Download

xchrvaqi.f

Path C:\Users\Admin\AppData\Local\Temp\xchrvaqi.f
Size 495KB
SHA256 4023f1950ad101327a35de5bf71a011aef3ebc79ddb4fdb2d7a36ea41eed3f4a
MD5 37deec1f6b9cb6b50e834d0349e48593
SHA1 8d26f18c6c4ce38ebe664cd4d757f7caf8d455d0
SHA512 1020a68fc5ca438ecb049f383b4c1c15588f242f16b291f3e9e8c32e858485cb57822b70052b216c3b43e2376679a801bae158eb6f4cb79cf0269ad9faeaf69b
SSDEEP 12288:HPM97tWvzuLDy3qpgC9ZViZ6JAuikX7ZbMJPM9n3QIXbFxQRRPhvUrt:6ZWSLkCfVisB7t3nqZMR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2004-139-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2004-140-0x0000000000400000-0x0000000000480000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads