remcos | efcc97c8dac23a0c8bc179fd3b54efd3594e71d5103f211bf468e2a6e550590e

General

Target

SYN2023060702.exe
Size

551KB
MD5

e550594dbf07c3a445d0ee6d44325c96
SHA1

ac62125f63e40ed06e6b3cf7a4b180543894d797
SHA256

efcc97c8dac23a0c8bc179fd3b54efd3594e71d5103f211bf468e2a6e550590e
SHA512

92924f57caf0c7b5fc08576d807079c7c060ccecc882766c5298af18288c9cbd9a9d01bd325007b52d983e669e90db9b42fcbe525442887e3de66d9246c1565e
SSDEEP

12288:ZLLsWrDu24O0XFrfiPfuw91uhQ9TaQX5eQ4L1NbRHgWAvHv3cIXsSlwjFh:ZLLTrfj9TaY5eV5N95AfUVSoFh

Score

10^/10

remcos remotehost discovery rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

155.94.185.15:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-FUG8H1
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks QEMU agent file 2 TTPs 2 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	SYN2023060702.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	SYN2023060702.exe

Loads dropped DLL 1 IoCs

pid	Process
1676	SYN2023060702.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1004	SYN2023060702.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1676	SYN2023060702.exe
1004	SYN2023060702.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1676 set thread context of 1004	1676	SYN2023060702.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1676	SYN2023060702.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1004	SYN2023060702.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1004	1676	SYN2023060702.exe	28
PID 1676 wrote to memory of 1004	1676	SYN2023060702.exe	28
PID 1676 wrote to memory of 1004	1676	SYN2023060702.exe	28
PID 1676 wrote to memory of 1004	1676	SYN2023060702.exe	28
PID 1676 wrote to memory of 1004	1676	SYN2023060702.exe	28

C:\Users\Admin\AppData\Local\Temp\SYN2023060702.exe
"C:\Users\Admin\AppData\Local\Temp\SYN2023060702.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Users\Admin\AppData\Local\Temp\SYN2023060702.exe
  "C:\Users\Admin\AppData\Local\Temp\SYN2023060702.exe"
  2⤵
  - Checks QEMU agent file
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:1004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
ffb588dbaf6e119b0c7c6b4cda9b11d4

SHA1
0960632b507b431f93bdf242588acfe02bdb78e8

SHA256
6a15c10368155bebd37ecfcfed9bc2dc0f47f22ff917e50a6ff6ac30ed51168f

SHA512
4f07db6768e8a99a8f819be4ad449d74b363fa82154a2f36f1223c2ef6052f5501cb30238a58085b2589578b0fd97b13be765913f930d8612c5c5068074a0200

Download Submit
\Users\Admin\AppData\Local\Temp\nsyF8A4.tmp\System.dll

Filesize
11KB

MD5
c9473cb90d79a374b2ba6040ca16e45c

SHA1
ab95b54f12796dce57210d65f05124a6ed81234a

SHA256
b80a5cba69d1853ed5979b0ca0352437bf368a5cfb86cb4528edadd410e11352

SHA512
eafe7d5894622bc21f663bca4dd594392ee0f5b29270b6b56b0187093d6a3a103545464ff6398ad32d2cf15dab79b1f133218ba9ba337ddc01330b5ada804d7b

Download Submit
memory/1004-87-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1004-69-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1004-73-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1004-77-0x0000000001470000-0x00000000055F4000-memory.dmp

Filesize
65.5MB

Download
memory/1004-80-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1004-84-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1004-70-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1004-71-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1004-91-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1004-95-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1004-99-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1004-103-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1004-106-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1004-110-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download

Analysis

Sharing