remcos | c2c1b145e3cc27c5320fc08fcf810cbf321590956ef6d7c135f4859c49da4cdf

General

Target

VER SUCESIÓNDEINCAPACIDAD20221205.exe
Size

819KB
MD5

c9d36e490b60b2e1964fd7311d8bb0bd
SHA1

ebd73e29f1fd1f2d0a5bfd0fa3ad1bfeb17a6f75
SHA256

cca6fbbbb4b240bd2d713677e01dc377ffffb4a99dedab5eea9813f9d855af56
SHA512

2d6a381619667a5b4bef7ed0237e84ef4bde77368c7a57b3e3906c14a8d75741e1d908dbad791abf525df19d1fe495f37ea331ee24264bf7e93c0a191be9671f
SSDEEP

12288:oHzdKZ26f6MgGse8hAvQHQ1aqM8Dg5SiaPeX:edKvgsaqM805SiaPe

Score

10^/10

remcos brasil rat

Malware Config

Extracted

Family

remcos

Version

2.7.0 Pro

Botnet

BRASIL

C2

brasil.con-ip.com:2001

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-WLGLS0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

VER SUCESIÓNDEINCAPACIDAD20221205.exe

description pid process target process

PID 1472 set thread context of 1708 1472 VER SUCESIÓNDEINCAPACIDAD20221205.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

756 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

VER SUCESIÓNDEINCAPACIDAD20221205.exepowershell.exe

pid process

1472 VER SUCESIÓNDEINCAPACIDAD20221205.exe
1472 VER SUCESIÓNDEINCAPACIDAD20221205.exe
768 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

VER SUCESIÓNDEINCAPACIDAD20221205.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1472 VER SUCESIÓNDEINCAPACIDAD20221205.exe
Token: SeDebugPrivilege 768 powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

1708 RegSvcs.exe

description	pid	process	target process
PID 1472 set thread context of 1708	1472	VER SUCESIÓNDEINCAPACIDAD20221205.exe	RegSvcs.exe

pid	process
756	schtasks.exe

pid	process
1472	VER SUCESIÓNDEINCAPACIDAD20221205.exe
1472	VER SUCESIÓNDEINCAPACIDAD20221205.exe
768	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1472	VER SUCESIÓNDEINCAPACIDAD20221205.exe
Token: SeDebugPrivilege	768	powershell.exe

pid	process
1708	RegSvcs.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

VER SUCESIÓNDEINCAPACIDAD20221205.exe

description	pid	process	target process
PID 1472 wrote to memory of 768	1472	VER SUCESIÓNDEINCAPACIDAD20221205.exe	powershell.exe
PID 1472 wrote to memory of 768	1472	VER SUCESIÓNDEINCAPACIDAD20221205.exe	powershell.exe
PID 1472 wrote to memory of 768	1472	VER SUCESIÓNDEINCAPACIDAD20221205.exe	powershell.exe
PID 1472 wrote to memory of 768	1472	VER SUCESIÓNDEINCAPACIDAD20221205.exe	powershell.exe
PID 1472 wrote to memory of 756	1472	VER SUCESIÓNDEINCAPACIDAD20221205.exe	schtasks.exe
PID 1472 wrote to memory of 756	1472	VER SUCESIÓNDEINCAPACIDAD20221205.exe	schtasks.exe
PID 1472 wrote to memory of 756	1472	VER SUCESIÓNDEINCAPACIDAD20221205.exe	schtasks.exe
PID 1472 wrote to memory of 756	1472	VER SUCESIÓNDEINCAPACIDAD20221205.exe	schtasks.exe
PID 1472 wrote to memory of 1708	1472	VER SUCESIÓNDEINCAPACIDAD20221205.exe	RegSvcs.exe
PID 1472 wrote to memory of 1708	1472	VER SUCESIÓNDEINCAPACIDAD20221205.exe	RegSvcs.exe
PID 1472 wrote to memory of 1708	1472	VER SUCESIÓNDEINCAPACIDAD20221205.exe	RegSvcs.exe
PID 1472 wrote to memory of 1708	1472	VER SUCESIÓNDEINCAPACIDAD20221205.exe	RegSvcs.exe
PID 1472 wrote to memory of 1708	1472	VER SUCESIÓNDEINCAPACIDAD20221205.exe	RegSvcs.exe
PID 1472 wrote to memory of 1708	1472	VER SUCESIÓNDEINCAPACIDAD20221205.exe	RegSvcs.exe
PID 1472 wrote to memory of 1708	1472	VER SUCESIÓNDEINCAPACIDAD20221205.exe	RegSvcs.exe
PID 1472 wrote to memory of 1708	1472	VER SUCESIÓNDEINCAPACIDAD20221205.exe	RegSvcs.exe
PID 1472 wrote to memory of 1708	1472	VER SUCESIÓNDEINCAPACIDAD20221205.exe	RegSvcs.exe
PID 1472 wrote to memory of 1708	1472	VER SUCESIÓNDEINCAPACIDAD20221205.exe	RegSvcs.exe
PID 1472 wrote to memory of 1708	1472	VER SUCESIÓNDEINCAPACIDAD20221205.exe	RegSvcs.exe
PID 1472 wrote to memory of 1708	1472	VER SUCESIÓNDEINCAPACIDAD20221205.exe	RegSvcs.exe
PID 1472 wrote to memory of 1708	1472	VER SUCESIÓNDEINCAPACIDAD20221205.exe	RegSvcs.exe
PID 1472 wrote to memory of 1708	1472	VER SUCESIÓNDEINCAPACIDAD20221205.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\VER SUCESIÓNDEINCAPACIDAD20221205.exe
"C:\Users\Admin\AppData\Local\Temp\VER SUCESIÓNDEINCAPACIDAD20221205.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1472

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\LaeCyBpJKSBFqo.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:768

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LaeCyBpJKSBFqo" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB8D5.tmp"
2⤵
- Creates scheduled task(s)
PID:756

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:1708

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB8D5.tmp
Filesize
1KB

MD5
0e3c99978849f7fd9c0a3e22a14bd259

SHA1
423433ba29b0b8cc22bbb5dfd22bfa4c1a778cb5

SHA256
6e7f53683852ad43f84efdddb08f0a8a84df0ca1d34b8834e416dfee8f73c3d5

SHA512
1a64a35ad8c7ff66a7161ef1a9311d5307fa8b133e303e51eb6a9ef48b76f40ed1847289643f1957d31b6d4c623b27c0c69d36847ad0f18c586725d37253ea6a

Download Submit
C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Filesize
74B

MD5
036f5eac23afcb963922d5b80f832fc1

SHA1
e0ba06f2c178bcce52333744c0b17d250fd41e3a

SHA256
dd251e7b8fef8dc54a36f1563b9f2155440345cfe9c628733814a868e456363c

SHA512
fa85d02c1f833f4ec62de97a1737676ae3797ab2e0388b2ebc9231d0e49ad71906845b0d64b9115177907b638476488ac645a94abeaf25f23c9cc3dbe43f0dc5

Download Submit
C:\Users\Admin\AppData\Roaming\remcos\logs.dat
Filesize
116B

MD5
d6a1039e575d4d2abd60a4e163c18dac

SHA1
8ad6c8641c29d1366eb68e0eb5124222d13d0e4e

SHA256
8c1a13b8af65a1108b17a4369b7c3da4a6a4037361b5e713743aa83b09250c4e

SHA512
7f57916fee7452c7888dad6469df18e8413447c948c427b7b10694a5ec4afc8beb031644370cfdef7726549542859d2bb403a2e064953d96c5e21da2e5885674

Download Submit
memory/768-84-0x00000000006D0000-0x0000000000710000-memory.dmp

Filesize
256KB

Download
memory/768-83-0x00000000006D0000-0x0000000000710000-memory.dmp

Filesize
256KB

Download
memory/1472-57-0x00000000003B0000-0x00000000003CA000-memory.dmp

Filesize
104KB

Download
memory/1472-60-0x0000000005E00000-0x0000000005E6C000-memory.dmp

Filesize
432KB

Download
memory/1472-59-0x00000000004A0000-0x00000000004AE000-memory.dmp

Filesize
56KB

Download
memory/1472-68-0x0000000004A10000-0x0000000004A46000-memory.dmp

Filesize
216KB

Download
memory/1472-58-0x0000000004AB0000-0x0000000004AF0000-memory.dmp

Filesize
256KB

Download
memory/1472-56-0x0000000004EB0000-0x0000000004F58000-memory.dmp

Filesize
672KB

Download
memory/1472-55-0x0000000004AB0000-0x0000000004AF0000-memory.dmp

Filesize
256KB

Download
memory/1472-54-0x0000000000BE0000-0x0000000000CB4000-memory.dmp

Filesize
848KB

Download
memory/1708-72-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1708-82-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1708-75-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1708-76-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1708-78-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1708-79-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1708-81-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1708-74-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1708-73-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1708-85-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1708-71-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1708-87-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1708-70-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1708-69-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads