remcos | 73cb25c9129d5d9b51766e6efe54c27cfa70defbd43fa003d7b1245b449f7722

General

Target

34986689526a986f09c61c45185a4581.exe
Size

1024.0MB
MD5

be6bc5b118e0e19f09dd4b8a98a84f46
SHA1

9badc3c3f408e3031ed598d5d02f90f6fc5fb8c5
SHA256

be0a17f55ad9f4dcf1e45b6fca28902ba2f821aa215d65b690b8f91cdfca8b59
SHA512

757659ed1708880b7bcfcc3c18b9e7bccfc5823932558fe27f85ae69eceeaeadc49f385cf6187f29f0e3a9e8474d0b4f5683039d544c652ef636809806eb8e6f
SSDEEP

24576:a/8mm44MRdxUAx7Af/8s5OdvAnVUKb0OUImZOv0iLbuN7O0bM2o9KgC9ayRtknbJ:WIB5+55Ov3cayRE

Score

10^/10

remcos oro rat

Malware Config

Extracted

Family

remcos

Botnet

ORO

C2

olkmnbftyujbvfd.con-ip.com:1883

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-QZT2TS
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4424 set thread context of 3644	4424	34986689526a986f09c61c45185a4581.exe	87

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4704	3644	WerFault.exe	87
4588	3644	WerFault.exe	87

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3452	schtasks.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 3644	4424	34986689526a986f09c61c45185a4581.exe	87
PID 4424 wrote to memory of 3644	4424	34986689526a986f09c61c45185a4581.exe	87
PID 4424 wrote to memory of 3644	4424	34986689526a986f09c61c45185a4581.exe	87
PID 4424 wrote to memory of 3644	4424	34986689526a986f09c61c45185a4581.exe	87
PID 4424 wrote to memory of 3644	4424	34986689526a986f09c61c45185a4581.exe	87
PID 4424 wrote to memory of 3644	4424	34986689526a986f09c61c45185a4581.exe	87
PID 4424 wrote to memory of 3644	4424	34986689526a986f09c61c45185a4581.exe	87
PID 4424 wrote to memory of 3644	4424	34986689526a986f09c61c45185a4581.exe	87
PID 4424 wrote to memory of 3644	4424	34986689526a986f09c61c45185a4581.exe	87
PID 4424 wrote to memory of 3644	4424	34986689526a986f09c61c45185a4581.exe	87
PID 4424 wrote to memory of 3644	4424	34986689526a986f09c61c45185a4581.exe	87
PID 4424 wrote to memory of 3644	4424	34986689526a986f09c61c45185a4581.exe	87
PID 4424 wrote to memory of 1420	4424	34986689526a986f09c61c45185a4581.exe	88
PID 4424 wrote to memory of 1420	4424	34986689526a986f09c61c45185a4581.exe	88
PID 4424 wrote to memory of 1420	4424	34986689526a986f09c61c45185a4581.exe	88
PID 4424 wrote to memory of 4528	4424	34986689526a986f09c61c45185a4581.exe	90
PID 4424 wrote to memory of 4528	4424	34986689526a986f09c61c45185a4581.exe	90
PID 4424 wrote to memory of 4528	4424	34986689526a986f09c61c45185a4581.exe	90
PID 4424 wrote to memory of 3704	4424	34986689526a986f09c61c45185a4581.exe	89
PID 4424 wrote to memory of 3704	4424	34986689526a986f09c61c45185a4581.exe	89
PID 4424 wrote to memory of 3704	4424	34986689526a986f09c61c45185a4581.exe	89
PID 4528 wrote to memory of 3452	4528	cmd.exe	95
PID 4528 wrote to memory of 3452	4528	cmd.exe	95
PID 4528 wrote to memory of 3452	4528	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\34986689526a986f09c61c45185a4581.exe
"C:\Users\Admin\AppData\Local\Temp\34986689526a986f09c61c45185a4581.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  PID:3644
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 516
    3⤵
    - Program crash
    PID:4704
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 520
    3⤵
    - Program crash
    PID:4588
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\AppData"
  2⤵
  PID:1420
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\34986689526a986f09c61c45185a4581.exe" "C:\Users\Admin\AppData\Roaming\AppData\AppData.exe"
  2⤵
  PID:3704
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 25 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 25 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:3452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3644 -ip 3644
1⤵
PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3644 -ip 3644
1⤵
PID:3744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3644-135-0x0000000000430000-0x0000000000450000-memory.dmp

Filesize
128KB

Download
memory/3644-136-0x00000000004F0000-0x0000000000571000-memory.dmp

Filesize
516KB

Download
memory/3644-141-0x00000000004F0000-0x0000000000571000-memory.dmp

Filesize
516KB

Download
memory/3644-147-0x00000000004F0000-0x0000000000571000-memory.dmp

Filesize
516KB

Download
memory/4424-133-0x0000000000A60000-0x00000000016EA000-memory.dmp

Filesize
12.5MB

Download
memory/4424-134-0x0000000006120000-0x0000000006130000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads