remcos | e6360d66b7e3b8aebee4ae5aae9e2f470ed8ba472373ff56057ad69b6c5ac54b

General

Target

notifica a usted la primera audiencia por el proceso judicial adelantado.exe
Size

790KB
MD5

81a23531cb13ca317bbe76d5331f0ce5
SHA1

8895d9aefd3ca9f3c457fe51691c4a408819e69f
SHA256

b6a42d45119abc492113b7ac0bcf51a7ffe2aec2ea5fe47c35b62af0beeefd5a
SHA512

50c5bf43f9a0a5ed17415080f5394c72777f2b549df60e4707bb4b6e775e5570acb27d01a992d1037cf1c23deedf66991434cd73d86c5233c22691ed1cf994d6
SSDEEP

12288:PUJB0O+SFTCulU37koolxZnQSYlIHSNdDhiJhNPHok3U0iTK+JuQyKJhZckedxNK:EISFfU37kRk3myN14PX4gT8Dc

Score

10^/10

remcos lunes rat

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

LUNES

C2

lunesgermanarellanos.con-ip.com:1013

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-ARW24P
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

notifica a usted la primera audiencia por el proceso judicial adelantado.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	notifica a usted la primera audiencia por el proceso judicial adelantado.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

notifica a usted la primera audiencia por el proceso judicial adelantado.exe

description	pid	process	target process
PID 3360 set thread context of 2720	3360	notifica a usted la primera audiencia por el proceso judicial adelantado.exe	RegSvcs.exe

Drops file in Windows directory 1 IoCs

Processes:

RegSvcs.exe

description ioc process

File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3476 2720 WerFault.exe RegSvcs.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4284 schtasks.exe
Modifies registry class 1 IoCs

Processes:

RegSvcs.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings RegSvcs.exe

description	ioc	process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	RegSvcs.exe

pid	pid_target	process	target process
3476	2720	WerFault.exe	RegSvcs.exe

pid	process
4284	schtasks.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

notifica a usted la primera audiencia por el proceso judicial adelantado.exepowershell.exe

pid	process
3360	notifica a usted la primera audiencia por el proceso judicial adelantado.exe
3360	notifica a usted la primera audiencia por el proceso judicial adelantado.exe
4448	powershell.exe
4448	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

notifica a usted la primera audiencia por el proceso judicial adelantado.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3360	notifica a usted la primera audiencia por el proceso judicial adelantado.exe
Token: SeDebugPrivilege	4448	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegSvcs.exe

pid process

2720 RegSvcs.exe

pid	process
2720	RegSvcs.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

notifica a usted la primera audiencia por el proceso judicial adelantado.exeRegSvcs.exe

description	pid	process	target process
PID 3360 wrote to memory of 4448	3360	notifica a usted la primera audiencia por el proceso judicial adelantado.exe	powershell.exe
PID 3360 wrote to memory of 4448	3360	notifica a usted la primera audiencia por el proceso judicial adelantado.exe	powershell.exe
PID 3360 wrote to memory of 4448	3360	notifica a usted la primera audiencia por el proceso judicial adelantado.exe	powershell.exe
PID 3360 wrote to memory of 4284	3360	notifica a usted la primera audiencia por el proceso judicial adelantado.exe	schtasks.exe
PID 3360 wrote to memory of 4284	3360	notifica a usted la primera audiencia por el proceso judicial adelantado.exe	schtasks.exe
PID 3360 wrote to memory of 4284	3360	notifica a usted la primera audiencia por el proceso judicial adelantado.exe	schtasks.exe
PID 3360 wrote to memory of 2720	3360	notifica a usted la primera audiencia por el proceso judicial adelantado.exe	RegSvcs.exe
PID 3360 wrote to memory of 2720	3360	notifica a usted la primera audiencia por el proceso judicial adelantado.exe	RegSvcs.exe
PID 3360 wrote to memory of 2720	3360	notifica a usted la primera audiencia por el proceso judicial adelantado.exe	RegSvcs.exe
PID 3360 wrote to memory of 2720	3360	notifica a usted la primera audiencia por el proceso judicial adelantado.exe	RegSvcs.exe
PID 3360 wrote to memory of 2720	3360	notifica a usted la primera audiencia por el proceso judicial adelantado.exe	RegSvcs.exe
PID 3360 wrote to memory of 2720	3360	notifica a usted la primera audiencia por el proceso judicial adelantado.exe	RegSvcs.exe
PID 3360 wrote to memory of 2720	3360	notifica a usted la primera audiencia por el proceso judicial adelantado.exe	RegSvcs.exe
PID 3360 wrote to memory of 2720	3360	notifica a usted la primera audiencia por el proceso judicial adelantado.exe	RegSvcs.exe
PID 3360 wrote to memory of 2720	3360	notifica a usted la primera audiencia por el proceso judicial adelantado.exe	RegSvcs.exe
PID 3360 wrote to memory of 2720	3360	notifica a usted la primera audiencia por el proceso judicial adelantado.exe	RegSvcs.exe
PID 2720 wrote to memory of 2488	2720	RegSvcs.exe	WScript.exe
PID 2720 wrote to memory of 2488	2720	RegSvcs.exe	WScript.exe
PID 2720 wrote to memory of 2488	2720	RegSvcs.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\notifica a usted la primera audiencia por el proceso judicial adelantado.exe
"C:\Users\Admin\AppData\Local\Temp\notifica a usted la primera audiencia por el proceso judicial adelantado.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3360

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kwPouyOzCI.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4448

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kwPouyOzCI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp56EA.tmp"
2⤵
- Creates scheduled task(s)
PID:4284

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
2⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\uninstall.vbs"
3⤵
PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 896
3⤵
- Program crash
PID:3476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2720 -ip 2720
1⤵
PID:436

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ffx3x5pc.bgl.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp56EA.tmp
Filesize
1KB

MD5
1eb5559ddbaa6ff11fbc4e3bcbd1b14c

SHA1
d88b418cf643398c0c7a89d5184af5f24fad0f66

SHA256
b4f4a717ee9c2d48da0bcee3e52e3d72a7281e6e5042c086ce0091db19d83fb1

SHA512
317ad72ce8eb36b6c6f3d6d661bc98693e1407556c5e939f2e31b8a665c2e686571430ae32a5ddd1e663895784d3a1d4a25c0870c466b1b5ac6a2048348e078a

Download Submit
C:\Users\Admin\AppData\Local\Temp\uninstall.vbs
Filesize
374B

MD5
b61ea5cc133b9c08f84d429879b1f66a

SHA1
5d4a54e2ddfe66c493308ee9d27376e365565bfc

SHA256
6d98a41887a75f2c4b92e15530226bc68282ca025b0da5266d5d3b8f55dd3853

SHA512
0ac86e43547f5662697052aa01b5710bd7b1bb519cf3b0411fd8791937bd9809fed596988ceebbdb66f702dfbee445fb2e246d2e74a7509f5a599a0e815a6c61

Download Submit
memory/2720-207-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2720-218-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2720-211-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2720-212-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2720-195-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2720-196-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2720-203-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2720-154-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2720-153-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2720-204-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2720-151-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2720-146-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2720-215-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2720-150-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2720-193-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2720-205-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2720-167-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2720-210-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2720-208-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2720-170-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2720-171-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2720-192-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2720-206-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3360-138-0x0000000005BC0000-0x0000000005BD0000-memory.dmp

Filesize
64KB

Download
memory/3360-133-0x0000000000E60000-0x0000000000F2A000-memory.dmp

Filesize
808KB

Download
memory/3360-139-0x0000000008BE0000-0x0000000008C7C000-memory.dmp

Filesize
624KB

Download
memory/3360-137-0x00000000058F0000-0x00000000058FA000-memory.dmp

Filesize
40KB

Download
memory/3360-136-0x0000000005BC0000-0x0000000005BD0000-memory.dmp

Filesize
64KB

Download
memory/3360-135-0x0000000005980000-0x0000000005A12000-memory.dmp

Filesize
584KB

Download
memory/3360-134-0x0000000005E90000-0x0000000006434000-memory.dmp

Filesize
5.6MB

Download
memory/4448-175-0x00000000707C0000-0x000000007080C000-memory.dmp

Filesize
304KB

Download
memory/4448-191-0x00000000078C0000-0x0000000007956000-memory.dmp

Filesize
600KB

Download
memory/4448-190-0x00000000076B0000-0x00000000076BA000-memory.dmp

Filesize
40KB

Download
memory/4448-189-0x0000000007640000-0x000000000765A000-memory.dmp

Filesize
104KB

Download
memory/4448-188-0x0000000007C90000-0x000000000830A000-memory.dmp

Filesize
6.5MB

Download
memory/4448-197-0x0000000007870000-0x000000000787E000-memory.dmp

Filesize
56KB

Download
memory/4448-198-0x0000000007980000-0x000000000799A000-memory.dmp

Filesize
104KB

Download
memory/4448-199-0x0000000007960000-0x0000000007968000-memory.dmp

Filesize
32KB

Download
memory/4448-187-0x000000007FCF0000-0x000000007FD00000-memory.dmp

Filesize
64KB

Download
memory/4448-185-0x0000000002B40000-0x0000000002B50000-memory.dmp

Filesize
64KB

Download
memory/4448-186-0x00000000068F0000-0x000000000690E000-memory.dmp

Filesize
120KB

Download
memory/4448-174-0x0000000006910000-0x0000000006942000-memory.dmp

Filesize
200KB

Download
memory/4448-173-0x0000000006340000-0x000000000635E000-memory.dmp

Filesize
120KB

Download
memory/4448-169-0x0000000002B40000-0x0000000002B50000-memory.dmp

Filesize
64KB

Download
memory/4448-168-0x0000000002B40000-0x0000000002B50000-memory.dmp

Filesize
64KB

Download
memory/4448-162-0x0000000005D10000-0x0000000005D76000-memory.dmp

Filesize
408KB

Download
memory/4448-156-0x0000000005CA0000-0x0000000005D06000-memory.dmp

Filesize
408KB

Download
memory/4448-155-0x0000000005470000-0x0000000005492000-memory.dmp

Filesize
136KB

Download
memory/4448-147-0x0000000005500000-0x0000000005B28000-memory.dmp

Filesize
6.2MB

Download
memory/4448-144-0x0000000002A20000-0x0000000002A56000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads