remcos | 115eecb607fdaf63fa831cc0ec169c2efa99a31f690ba2d43ebe15c58d958a42

General

Target

NEAS.1109042c3f41ad8b2b37562004c61130_JC.exe
Size

1.1MB
MD5

1109042c3f41ad8b2b37562004c61130
SHA1

b198c98a92b13396bf7de61487d61e86bc6a13d4
SHA256

115eecb607fdaf63fa831cc0ec169c2efa99a31f690ba2d43ebe15c58d958a42
SHA512

5be01e9d10904fbda94e9d92dd86ffbb7033a77d9d6880f5759cdb04b9b01339728319b61f1d9378423b2ffa513d615385258d546ef0ca8c1b4e9e4edd5145c1
SSDEEP

12288:OfeDOa9rDeYSorINpj5XqkJD0QrOod7XxlW91RRep+rgRNyA55IxJ2DJ53J/J/Z:FD39v74lfGQrFUspugRNJI2DJ53J/J/Z

Score

10^/10

remcos host persistence rat spyware stealer

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

213.183.58.19:4000

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
read.dat
keylog_flag
false
keylog_folder
CastC
keylog_path
%AppData%
mouse_option
false
mutex
remcos_sccafsoidz
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 2 IoCs

pid	Process
2592	sbietrcl.exe
2628	sbietrcl.exe

Loads dropped DLL 1 IoCs

pid	Process
1864	NEAS.1109042c3f41ad8b2b37562004c61130_JC.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\sbietrcl.exe"	NEAS.1109042c3f41ad8b2b37562004c61130_JC.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2592 set thread context of 2628	2592	sbietrcl.exe	29

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1864	NEAS.1109042c3f41ad8b2b37562004c61130_JC.exe
1864	NEAS.1109042c3f41ad8b2b37562004c61130_JC.exe
1864	NEAS.1109042c3f41ad8b2b37562004c61130_JC.exe
1864	NEAS.1109042c3f41ad8b2b37562004c61130_JC.exe
1864	NEAS.1109042c3f41ad8b2b37562004c61130_JC.exe
1864	NEAS.1109042c3f41ad8b2b37562004c61130_JC.exe
2592	sbietrcl.exe
2592	sbietrcl.exe
2592	sbietrcl.exe
2592	sbietrcl.exe
2592	sbietrcl.exe
2592	sbietrcl.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1864	NEAS.1109042c3f41ad8b2b37562004c61130_JC.exe
Token: SeDebugPrivilege	2592	sbietrcl.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2628	sbietrcl.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 2592	1864	NEAS.1109042c3f41ad8b2b37562004c61130_JC.exe	28
PID 1864 wrote to memory of 2592	1864	NEAS.1109042c3f41ad8b2b37562004c61130_JC.exe	28
PID 1864 wrote to memory of 2592	1864	NEAS.1109042c3f41ad8b2b37562004c61130_JC.exe	28
PID 1864 wrote to memory of 2592	1864	NEAS.1109042c3f41ad8b2b37562004c61130_JC.exe	28
PID 2592 wrote to memory of 2628	2592	sbietrcl.exe	29
PID 2592 wrote to memory of 2628	2592	sbietrcl.exe	29
PID 2592 wrote to memory of 2628	2592	sbietrcl.exe	29
PID 2592 wrote to memory of 2628	2592	sbietrcl.exe	29
PID 2592 wrote to memory of 2628	2592	sbietrcl.exe	29
PID 2592 wrote to memory of 2628	2592	sbietrcl.exe	29
PID 2592 wrote to memory of 2628	2592	sbietrcl.exe	29
PID 2592 wrote to memory of 2628	2592	sbietrcl.exe	29
PID 2592 wrote to memory of 2628	2592	sbietrcl.exe	29
PID 2592 wrote to memory of 2628	2592	sbietrcl.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.1109042c3f41ad8b2b37562004c61130_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.1109042c3f41ad8b2b37562004c61130_JC.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8e067b345a41c2e8ba337708893b1f1

SHA1
7c0e0a0f789c22c48c1f22cca868bc855087e848

SHA256
b8bd8c10fd00a04d18434cc09d55fc49b66942e478aa4af3fc28855b64dc981e

SHA512
b3cf578d59d32457d3d8387ed71fb63ef4263f822395e1c5a34aed8bf531b4a18ebf4cced75a1c04751e2c666b59f264c3a1dcd87e884b42aea77596a210de9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6680.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe

Filesize
1.1MB

MD5
1dbda53945761d0065e9935f9c5f7796

SHA1
736a8db178aaaf561a3423ff840da559406d4e40

SHA256
081ceb5f95c1fb570976985476db26529256bd85b475a88d343c61a8d515a498

SHA512
0a732ed4104481e441f140e9c7d7621aa4ae6bfd0b30385b8e91680670743b246980889e78af330b9842eb5e81de0e38d37c6738d77a3030ecbb651c65e89f60

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe

Filesize
1.1MB

MD5
1dbda53945761d0065e9935f9c5f7796

SHA1
736a8db178aaaf561a3423ff840da559406d4e40

SHA256
081ceb5f95c1fb570976985476db26529256bd85b475a88d343c61a8d515a498

SHA512
0a732ed4104481e441f140e9c7d7621aa4ae6bfd0b30385b8e91680670743b246980889e78af330b9842eb5e81de0e38d37c6738d77a3030ecbb651c65e89f60

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe

Filesize
1.1MB

MD5
1dbda53945761d0065e9935f9c5f7796

SHA1
736a8db178aaaf561a3423ff840da559406d4e40

SHA256
081ceb5f95c1fb570976985476db26529256bd85b475a88d343c61a8d515a498

SHA512
0a732ed4104481e441f140e9c7d7621aa4ae6bfd0b30385b8e91680670743b246980889e78af330b9842eb5e81de0e38d37c6738d77a3030ecbb651c65e89f60

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe

Filesize
1.1MB

MD5
1dbda53945761d0065e9935f9c5f7796

SHA1
736a8db178aaaf561a3423ff840da559406d4e40

SHA256
081ceb5f95c1fb570976985476db26529256bd85b475a88d343c61a8d515a498

SHA512
0a732ed4104481e441f140e9c7d7621aa4ae6bfd0b30385b8e91680670743b246980889e78af330b9842eb5e81de0e38d37c6738d77a3030ecbb651c65e89f60

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe

Filesize
1.1MB

MD5
1dbda53945761d0065e9935f9c5f7796

SHA1
736a8db178aaaf561a3423ff840da559406d4e40

SHA256
081ceb5f95c1fb570976985476db26529256bd85b475a88d343c61a8d515a498

SHA512
0a732ed4104481e441f140e9c7d7621aa4ae6bfd0b30385b8e91680670743b246980889e78af330b9842eb5e81de0e38d37c6738d77a3030ecbb651c65e89f60

Download Submit
memory/1864-25-0x0000000074740000-0x0000000074CEB000-memory.dmp

Filesize
5.7MB

Download
memory/1864-13-0x0000000000430000-0x0000000000470000-memory.dmp

Filesize
256KB

Download
memory/1864-12-0x0000000000430000-0x0000000000470000-memory.dmp

Filesize
256KB

Download
memory/1864-2-0x0000000000430000-0x0000000000470000-memory.dmp

Filesize
256KB

Download
memory/1864-0-0x0000000074740000-0x0000000074CEB000-memory.dmp

Filesize
5.7MB

Download
memory/1864-32-0x0000000074740000-0x0000000074CEB000-memory.dmp

Filesize
5.7MB

Download
memory/1864-1-0x0000000074740000-0x0000000074CEB000-memory.dmp

Filesize
5.7MB

Download
memory/2592-44-0x0000000000B70000-0x0000000000BB0000-memory.dmp

Filesize
256KB

Download
memory/2592-33-0x0000000074740000-0x0000000074CEB000-memory.dmp

Filesize
5.7MB

Download
memory/2592-34-0x0000000000B70000-0x0000000000BB0000-memory.dmp

Filesize
256KB

Download
memory/2592-45-0x0000000000B70000-0x0000000000BB0000-memory.dmp

Filesize
256KB

Download
memory/2592-62-0x0000000074740000-0x0000000074CEB000-memory.dmp

Filesize
5.7MB

Download
memory/2592-35-0x0000000074740000-0x0000000074CEB000-memory.dmp

Filesize
5.7MB

Download
memory/2628-50-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2628-61-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2628-52-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2628-56-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2628-48-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2628-46-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2628-54-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2628-58-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2628-63-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2628-64-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2628-66-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2628-67-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2628-68-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2628-71-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads