remcos | 259a384f986f16ffa08d8bb393d0229a074f07de6079b718e8df3020c1338885

General

Target

202577211d7d1710869244007ccb21c8fdf3140c3445481ca6e839da82fef962.exe
Size

478KB
MD5

9aa44989b63c667ede9f25e26497c20f
SHA1

28d3d9c5e486abf89ba305ca371271ceef9af55b
SHA256

202577211d7d1710869244007ccb21c8fdf3140c3445481ca6e839da82fef962
SHA512

0e3669cf074a7abb63fb7a0c85dd0024f0e1b11773c99e8d54c005003a668e65562390423508dbd2398c410b7997443e7e91cc51142cdbab850ea7c94f1275e3
SSDEEP

6144:h1EwL0xQk9VdeLuVnQs8QLgt8cBvnkCX/3Rde+A+DdsAOZZRXXrcN12OhX:h1EZT90uNQzYgScBvnn/XpTs/ZRdOhX

Score

10^/10

remcos remotefhostf persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemotefHostf

C2

94.142.138.111:5701

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
rfmcos.exe
copy_folder
Rfmcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmcf-6KJV62
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

202577211d7d1710869244007ccb21c8fdf3140c3445481ca6e839da82fef962.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	202577211d7d1710869244007ccb21c8fdf3140c3445481ca6e839da82fef962.exe

Executes dropped EXE 1 IoCs

Processes:

rfmcos.exe

pid process

2000 rfmcos.exe

pid	process
2000	rfmcos.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

rfmcos.exe202577211d7d1710869244007ccb21c8fdf3140c3445481ca6e839da82fef962.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmcf-6KJV62 = "\"C:\\ProgramData\\Rfmcos\\rfmcos.exe\""	rfmcos.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Windows\CurrentVersion\Run\	202577211d7d1710869244007ccb21c8fdf3140c3445481ca6e839da82fef962.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmcf-6KJV62 = "\"C:\\ProgramData\\Rfmcos\\rfmcos.exe\""	202577211d7d1710869244007ccb21c8fdf3140c3445481ca6e839da82fef962.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	202577211d7d1710869244007ccb21c8fdf3140c3445481ca6e839da82fef962.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmcf-6KJV62 = "\"C:\\ProgramData\\Rfmcos\\rfmcos.exe\""	202577211d7d1710869244007ccb21c8fdf3140c3445481ca6e839da82fef962.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Windows\CurrentVersion\Run\	rfmcos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmcf-6KJV62 = "\"C:\\ProgramData\\Rfmcos\\rfmcos.exe\""	rfmcos.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	rfmcos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

202577211d7d1710869244007ccb21c8fdf3140c3445481ca6e839da82fef962.exe

description	pid	process	target process
PID 1740 wrote to memory of 2000	1740	202577211d7d1710869244007ccb21c8fdf3140c3445481ca6e839da82fef962.exe	rfmcos.exe
PID 1740 wrote to memory of 2000	1740	202577211d7d1710869244007ccb21c8fdf3140c3445481ca6e839da82fef962.exe	rfmcos.exe
PID 1740 wrote to memory of 2000	1740	202577211d7d1710869244007ccb21c8fdf3140c3445481ca6e839da82fef962.exe	rfmcos.exe

C:\Users\Admin\AppData\Local\Temp\202577211d7d1710869244007ccb21c8fdf3140c3445481ca6e839da82fef962.exe
"C:\Users\Admin\AppData\Local\Temp\202577211d7d1710869244007ccb21c8fdf3140c3445481ca6e839da82fef962.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1740

C:\ProgramData\Rfmcos\rfmcos.exe
"C:\ProgramData\Rfmcos\rfmcos.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2000

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Rfmcos\rfmcos.exe
Filesize
478KB

MD5
9aa44989b63c667ede9f25e26497c20f

SHA1
28d3d9c5e486abf89ba305ca371271ceef9af55b

SHA256
202577211d7d1710869244007ccb21c8fdf3140c3445481ca6e839da82fef962

SHA512
0e3669cf074a7abb63fb7a0c85dd0024f0e1b11773c99e8d54c005003a668e65562390423508dbd2398c410b7997443e7e91cc51142cdbab850ea7c94f1275e3

Download Submit
C:\ProgramData\Rfmcos\rfmcos.exe
Filesize
478KB

MD5
9aa44989b63c667ede9f25e26497c20f

SHA1
28d3d9c5e486abf89ba305ca371271ceef9af55b

SHA256
202577211d7d1710869244007ccb21c8fdf3140c3445481ca6e839da82fef962

SHA512
0e3669cf074a7abb63fb7a0c85dd0024f0e1b11773c99e8d54c005003a668e65562390423508dbd2398c410b7997443e7e91cc51142cdbab850ea7c94f1275e3

Download Submit
C:\ProgramData\Rfmcos\rfmcos.exe
Filesize
478KB

MD5
9aa44989b63c667ede9f25e26497c20f

SHA1
28d3d9c5e486abf89ba305ca371271ceef9af55b

SHA256
202577211d7d1710869244007ccb21c8fdf3140c3445481ca6e839da82fef962

SHA512
0e3669cf074a7abb63fb7a0c85dd0024f0e1b11773c99e8d54c005003a668e65562390423508dbd2398c410b7997443e7e91cc51142cdbab850ea7c94f1275e3

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads