remcos | 1a925bac006fd8d7a5d58d0229eabe2e30634626731add96939b0ab542c446a5

General

Target

SW009858984022_DE_009838221_pdf.exe
Size

472KB
MD5

30b37d8ba42f3ca92a2f2541ab99058b
SHA1

9c6e40b657d10569cac692d6888b42ff60012a90
SHA256

1a925bac006fd8d7a5d58d0229eabe2e30634626731add96939b0ab542c446a5
SHA512

d8ebaab6a0861210fff5f8b5dba05972e77c3065085664f5980f0d74e499a8f148d38ecdbd99e13750fdcb8476495fd1e98774d6f6cada43e24905ea123d506e
SSDEEP

12288:PYNJZPg/IKOgAiojNGDAkfDMFt56ErNQq0eZdL0yoCG:PYNHPMIWAioodD056cQqHZdC

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

64.112.85.218:4888

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-5VAOMA
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Loads dropped DLL 1 IoCs

pid	Process
832	SW009858984022_DE_009838221_pdf.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\Windows\CurrentVersion\Run\jenjscx = "C:\\Users\\Admin\\AppData\\Roaming\\wsclhqmvfajso\\xtdmirbwgcluqa.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\SW009858984022_DE_009838221_pdf"	SW009858984022_DE_009838221_pdf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 832 set thread context of 1876	832	SW009858984022_DE_009838221_pdf.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
832	SW009858984022_DE_009838221_pdf.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1876	832	SW009858984022_DE_009838221_pdf.exe	28
PID 832 wrote to memory of 1876	832	SW009858984022_DE_009838221_pdf.exe	28
PID 832 wrote to memory of 1876	832	SW009858984022_DE_009838221_pdf.exe	28
PID 832 wrote to memory of 1876	832	SW009858984022_DE_009838221_pdf.exe	28
PID 832 wrote to memory of 1876	832	SW009858984022_DE_009838221_pdf.exe	28

C:\Users\Admin\AppData\Local\Temp\SW009858984022_DE_009838221_pdf.exe
"C:\Users\Admin\AppData\Local\Temp\SW009858984022_DE_009838221_pdf.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:832
- C:\Users\Admin\AppData\Local\Temp\SW009858984022_DE_009838221_pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\SW009858984022_DE_009838221_pdf.exe"
  2⤵
  PID:1876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsoF818.tmp\aczjrwktvj.dll

Filesize
5KB

MD5
74eb3dc4c5c2fb7bdca34857bd4fb99e

SHA1
8cc20d4ee502e7aab46dd6ece52e848fc62e53ef

SHA256
2284c3578fa7b263a076f2bddd6814e340188ea9b0476495ebd3d45b41d837fc

SHA512
63131b5668390b8fc0efc13c1beb0c563c621f34665144d85d7eff0aad2244e6b6ff5d7f9427acdb9ef9feb3bf3faaaa328d97ab66a6f43f0b27d107d878fe7b

Download Submit
memory/1876-62-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-64-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-65-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-66-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-67-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-68-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-69-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-71-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-72-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-73-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-74-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-75-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-76-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-77-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-78-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-79-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-80-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-81-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-82-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-83-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-84-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-85-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-86-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-87-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-88-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-89-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-91-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-92-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-93-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-95-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/1876-96-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing