remcos | 6a43f8d13e49fac946dfcd323542f4f77a43c813c9d52a8273d5421f1049fa9e

General

Target

FedEx 0037811_UK_2023995286_pdf.exe
Size

475KB
MD5

d2f1d062bc9a850e6cfdf6e3c20c5bd2
SHA1

0365f94938094a7a2b5831080871cb077ea64585
SHA256

6a43f8d13e49fac946dfcd323542f4f77a43c813c9d52a8273d5421f1049fa9e
SHA512

86de1a34f4a9e9d9d0c117df0a9c5131eb3a3058a2deee18a23020c2875dfc10b1671f5fb14fcc842a54858b0f45564729e9cf1a3d5eef0506b4c1a5f5b5adb6
SSDEEP

12288:vY8QzGB54XUqsEeRYThzlP7G4J48ZyO4I2CqM:vY8oa6kueElyCgO4Ih

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

64.112.85.218:4888

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-5VAOMA
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Loads dropped DLL 1 IoCs

pid	Process
4072	FedEx 0037811_UK_2023995286_pdf.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tdmirnwgcluq = "C:\\Users\\Admin\\AppData\\Roaming\\rwgplupyien\\wscxhqmvfbkgpy.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\FedEx 0037811_UK_2023995286_pdf.e"	FedEx 0037811_UK_2023995286_pdf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4072 set thread context of 4396	4072	FedEx 0037811_UK_2023995286_pdf.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4072	FedEx 0037811_UK_2023995286_pdf.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 4396	4072	FedEx 0037811_UK_2023995286_pdf.exe	85
PID 4072 wrote to memory of 4396	4072	FedEx 0037811_UK_2023995286_pdf.exe	85
PID 4072 wrote to memory of 4396	4072	FedEx 0037811_UK_2023995286_pdf.exe	85
PID 4072 wrote to memory of 4396	4072	FedEx 0037811_UK_2023995286_pdf.exe	85

C:\Users\Admin\AppData\Local\Temp\FedEx 0037811_UK_2023995286_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\FedEx 0037811_UK_2023995286_pdf.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Users\Admin\AppData\Local\Temp\FedEx 0037811_UK_2023995286_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\FedEx 0037811_UK_2023995286_pdf.exe"
  2⤵
  PID:4396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsbA55F.tmp\yfmnzyw.dll

Filesize
12KB

MD5
f8bc5c1234fa8df202017a16f6089a8e

SHA1
2a01dbbd7a406233bf210715e8717ea3143be025

SHA256
613e951602b9f6453f8a2b8b152fced5d6927fec4ff6d18408196949b46c5cba

SHA512
32375aba9e43fe0f396d96886e3b695eb31be6e2c3594f5ac7db75a0bbb39996401c11aa41cd03fbb4126312bf7f5e7e93631dde3bb3789c71f4855f3a310379

Download Submit
memory/4072-141-0x0000000003160000-0x0000000003162000-memory.dmp

Filesize
8KB

Download
memory/4396-142-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-143-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-144-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-145-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-146-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-147-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-148-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-149-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-150-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-152-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-153-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-154-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-155-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-156-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-157-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-158-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-159-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-160-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-161-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-162-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-163-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-164-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-165-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-166-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-167-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-168-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-169-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-170-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-171-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-172-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-173-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-174-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-175-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4396-176-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing