remcos | ef52872464a8c0cac5d8a40077c607cdebdc496f7aeae799b80b993128f233d8

General

Target

Best price inquiry.exe
Size

768KB
MD5

b5d80c839eed720a63fbc6cd47a80a9e
SHA1

ef4bf7a44f3f7da17798ad1be32055e359ecd90b
SHA256

643d6f1a9a24b68a77de03bbe2ccf63751c072976b14607bb224eda31887f2de
SHA512

5355d606140ad0c10d8db7bea8fe1b4a8468947fdc2605f05520ccd931f8aa1c5eb9dc0420b2efa376a9311c85c2cd12431d24a9965bd018e29f48d455fdf46d
SSDEEP

24576:aMwf+m50w/dByz9z+NTUv91fZ5ZM1P3A6YlBE5Gw9:aMwf0w/dsYqjfrW93AXbEN9

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

darren2023.sytes.net:2115

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
scs.exe
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_path
%AppData%
mouse_option
false
mutex
Rmc-3YNKQ0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Best price inquiry.exeBest price inquiry.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	Best price inquiry.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	Best price inquiry.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Best price inquiry.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	Best price inquiry.exe

Executes dropped EXE 1 IoCs

Processes:

scs.exe

pid process

1628 scs.exe
Loads dropped DLL 2 IoCs

Processes:

Best price inquiry.exescs.exe

pid process

4640 Best price inquiry.exe
1628 scs.exe

pid	process
1628	scs.exe

pid	process
4640	Best price inquiry.exe
1628	scs.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Best price inquiry.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Windows\CurrentVersion\Run\	Best price inquiry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\scs.exe\""	Best price inquiry.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	Best price inquiry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remcos = "\"C:\\Users\\Admin\\AppData\\Roaming\\scs.exe\""	Best price inquiry.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

Best price inquiry.exe

pid process

3476 Best price inquiry.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Best price inquiry.exeBest price inquiry.exe

pid process

4640 Best price inquiry.exe
3476 Best price inquiry.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Best price inquiry.exe

description pid process target process

PID 4640 set thread context of 3476 4640 Best price inquiry.exe Best price inquiry.exe

pid	process
3476	Best price inquiry.exe

pid	process
4640	Best price inquiry.exe
3476	Best price inquiry.exe

description	pid	process	target process
PID 4640 set thread context of 3476	4640	Best price inquiry.exe	Best price inquiry.exe

Drops file in Program Files directory 2 IoCs

Processes:

Best price inquiry.exescs.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Servantry.ini	Best price inquiry.exe
File opened for modification	C:\Program Files (x86)\Servantry.ini	scs.exe

Drops file in Windows directory 1 IoCs

Processes:

Best price inquiry.exe

description ioc process

File opened for modification C:\Windows\Akustikerne\Blinker42.Vel33 Best price inquiry.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Best price inquiry.exe

pid process

4640 Best price inquiry.exe

description	ioc	process
File opened for modification	C:\Windows\Akustikerne\Blinker42.Vel33	Best price inquiry.exe

pid	process
4640	Best price inquiry.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

Best price inquiry.exeBest price inquiry.exe

description	pid	process	target process
PID 4640 wrote to memory of 3476	4640	Best price inquiry.exe	Best price inquiry.exe
PID 4640 wrote to memory of 3476	4640	Best price inquiry.exe	Best price inquiry.exe
PID 4640 wrote to memory of 3476	4640	Best price inquiry.exe	Best price inquiry.exe
PID 4640 wrote to memory of 3476	4640	Best price inquiry.exe	Best price inquiry.exe
PID 3476 wrote to memory of 1628	3476	Best price inquiry.exe	scs.exe
PID 3476 wrote to memory of 1628	3476	Best price inquiry.exe	scs.exe
PID 3476 wrote to memory of 1628	3476	Best price inquiry.exe	scs.exe

C:\Users\Admin\AppData\Local\Temp\Best price inquiry.exe
"C:\Users\Admin\AppData\Local\Temp\Best price inquiry.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4640

C:\Users\Admin\AppData\Local\Temp\Best price inquiry.exe
"C:\Users\Admin\AppData\Local\Temp\Best price inquiry.exe"
2⤵
- Checks QEMU agent file
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3476

C:\Users\Admin\AppData\Roaming\scs.exe
"C:\Users\Admin\AppData\Roaming\scs.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:1628

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsl530E.tmp\System.dll
Filesize
12KB

MD5
564bb0373067e1785cba7e4c24aab4bf

SHA1
7c9416a01d821b10b2eef97b80899d24014d6fc1

SHA256
7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5

SHA512
22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsl530E.tmp\System.dll
Filesize
12KB

MD5
564bb0373067e1785cba7e4c24aab4bf

SHA1
7c9416a01d821b10b2eef97b80899d24014d6fc1

SHA256
7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5

SHA512
22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnA7FE.tmp\System.dll
Filesize
12KB

MD5
564bb0373067e1785cba7e4c24aab4bf

SHA1
7c9416a01d821b10b2eef97b80899d24014d6fc1

SHA256
7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5

SHA512
22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Danskvandernes\Unselfconsciousness\penial\Unfooted\Fodermestrene\Wainer\Blackland22.Sta
Filesize
98KB

MD5
f1c8c629cb85183aacc7cf48089b5c4b

SHA1
a1902dfc003b9ec0b17115e71a41ec1fb8695c30

SHA256
dcab505b1a5cfc6eb7ad308ba934b15132af881089a1ccd829a33b2be3efb6e6

SHA512
e22a0de27171bfcd1ba1d03413781e01cacbccae7896a8fc59f5ff051334067ed3e097938294cf1fe1954a5866c5b2525e888b4edca8ba72da90d20f34b06025

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Danskvandernes\Unselfconsciousness\penial\Unfooted\Fodermestrene\Wainer\Caesura.Pic
Filesize
237KB

MD5
bf854859a5af013bf3670f26c4f2e11d

SHA1
f781202f218a1a999af14c8636bd488737221ed7

SHA256
89e2b117d576e4bfd257072d00103860c28b1e737a50a02ca2acd92994c9a6e1

SHA512
931e89c6bf79e5ab72c6ba45f8a0503d1c967aa39b4fa5d80aa005e34ba23309e17408af0c343f6fc88d923a0dd5c7e5a0d1da1efea91354efec90385744ccbb

Download Submit
C:\Users\Admin\AppData\Roaming\scs.exe
Filesize
768KB

MD5
b5d80c839eed720a63fbc6cd47a80a9e

SHA1
ef4bf7a44f3f7da17798ad1be32055e359ecd90b

SHA256
643d6f1a9a24b68a77de03bbe2ccf63751c072976b14607bb224eda31887f2de

SHA512
5355d606140ad0c10d8db7bea8fe1b4a8468947fdc2605f05520ccd931f8aa1c5eb9dc0420b2efa376a9311c85c2cd12431d24a9965bd018e29f48d455fdf46d

Download Submit
C:\Users\Admin\AppData\Roaming\scs.exe
Filesize
768KB

MD5
b5d80c839eed720a63fbc6cd47a80a9e

SHA1
ef4bf7a44f3f7da17798ad1be32055e359ecd90b

SHA256
643d6f1a9a24b68a77de03bbe2ccf63751c072976b14607bb224eda31887f2de

SHA512
5355d606140ad0c10d8db7bea8fe1b4a8468947fdc2605f05520ccd931f8aa1c5eb9dc0420b2efa376a9311c85c2cd12431d24a9965bd018e29f48d455fdf46d

Download Submit
C:\Users\Admin\AppData\Roaming\scs.exe
Filesize
768KB

MD5
b5d80c839eed720a63fbc6cd47a80a9e

SHA1
ef4bf7a44f3f7da17798ad1be32055e359ecd90b

SHA256
643d6f1a9a24b68a77de03bbe2ccf63751c072976b14607bb224eda31887f2de

SHA512
5355d606140ad0c10d8db7bea8fe1b4a8468947fdc2605f05520ccd931f8aa1c5eb9dc0420b2efa376a9311c85c2cd12431d24a9965bd018e29f48d455fdf46d

Download Submit
memory/3476-163-0x0000000001660000-0x0000000004F11000-memory.dmp

Filesize
56.7MB

Download
memory/3476-159-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3476-146-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3476-174-0x0000000001660000-0x0000000004F11000-memory.dmp

Filesize
56.7MB

Download
memory/3476-182-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads