remcos | 02499e35a4c7f0cd87c60a05ea4013fedf5c6832841fa7467b6dc1f8828e8625

General

Target

OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe
Size

1023.9MB
MD5

ba2e773cd0a1a5c4dc596feeaf5af8ff
SHA1

9a40d52553d84beb3e99a04c8f2256edde6e8fc1
SHA256

c46852f35f00af54166b854f90f8ff080acddd83214788f0f7c95e036e2c5e0e
SHA512

db537dd1ab3454811a86140400cd6def061d6b7bcfafbe34188089791766b5aaa0c64f97484f75bcdea920183f08af7359b0ce5e5335b83c2c3eb0f0600672cd
SSDEEP

12288:Ax+UJLtMI05GWvOU7iTsP0ER4DP3jUO4iiyYSY5T7MRzsK:b6LtMBkW2pTRzUVpPSOTgJJ

Score

10^/10

remcos pull rat

Malware Config

Extracted

Family

remcos

Botnet

PULL

C2

fdvijkrfdsojnlmrfsdojnlmfrdvcj.con-ip.com:1997

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-H54XLO
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe

description pid process target process

PID 2608 set thread context of 2616 2608 OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe csc.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2476 schtasks.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

csc.exe

pid process

2616 csc.exe

description	pid	process	target process
PID 2608 set thread context of 2616	2608	OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe	csc.exe

pid	process
2476	schtasks.exe

pid	process
2616	csc.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.execmd.exe

description	pid	process	target process
PID 2608 wrote to memory of 2616	2608	OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe	csc.exe
PID 2608 wrote to memory of 2616	2608	OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe	csc.exe
PID 2608 wrote to memory of 2616	2608	OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe	csc.exe
PID 2608 wrote to memory of 2616	2608	OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe	csc.exe
PID 2608 wrote to memory of 2616	2608	OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe	csc.exe
PID 2608 wrote to memory of 2616	2608	OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe	csc.exe
PID 2608 wrote to memory of 2616	2608	OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe	csc.exe
PID 2608 wrote to memory of 2616	2608	OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe	csc.exe
PID 2608 wrote to memory of 2616	2608	OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe	csc.exe
PID 2608 wrote to memory of 2616	2608	OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe	csc.exe
PID 2608 wrote to memory of 2616	2608	OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe	csc.exe
PID 2608 wrote to memory of 2616	2608	OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe	csc.exe
PID 2608 wrote to memory of 2616	2608	OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe	csc.exe
PID 2608 wrote to memory of 2492	2608	OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe	cmd.exe
PID 2608 wrote to memory of 2492	2608	OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe	cmd.exe
PID 2608 wrote to memory of 2492	2608	OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe	cmd.exe
PID 2608 wrote to memory of 2492	2608	OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe	cmd.exe
PID 2608 wrote to memory of 2728	2608	OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe	cmd.exe
PID 2608 wrote to memory of 2728	2608	OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe	cmd.exe
PID 2608 wrote to memory of 2728	2608	OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe	cmd.exe
PID 2608 wrote to memory of 2728	2608	OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe	cmd.exe
PID 2608 wrote to memory of 2596	2608	OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe	cmd.exe
PID 2608 wrote to memory of 2596	2608	OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe	cmd.exe
PID 2608 wrote to memory of 2596	2608	OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe	cmd.exe
PID 2608 wrote to memory of 2596	2608	OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe	cmd.exe
PID 2728 wrote to memory of 2476	2728	cmd.exe	schtasks.exe
PID 2728 wrote to memory of 2476	2728	cmd.exe	schtasks.exe
PID 2728 wrote to memory of 2476	2728	cmd.exe	schtasks.exe
PID 2728 wrote to memory of 2476	2728	cmd.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe
"C:\Users\Admin\AppData\Local\Temp\OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2616
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\AppData"
  2⤵
  PID:2492
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\OFICIO Y DETALLE DE ACTUACIÓN JUDICIAL RAD.563213.exe" "C:\Users\Admin\AppData\Roaming\AppData\AppData.exe"
  2⤵
  PID:2596
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
394af363d4ac82f572af704904170c63

SHA1
ac9c7cb69b59672967237d49863ebbd247d1c381

SHA256
e7d5e33a77ee16d2a077d2d6f91a54a964c705c5578d0ce04833a48240373512

SHA512
894501fb26ef90c6f8821c7149d338a6f2e67c17b7dae6eeabfa5f93c8fa85a9f6afa756ea5856af6d6a18087d97e3cb8f6c39f71e4b41c014a2172065dcd3d4

Download Submit
memory/2608-0-0x00000000001F0000-0x0000000000298000-memory.dmp

Filesize
672KB

Download
memory/2608-1-0x0000000074E80000-0x000000007556E000-memory.dmp

Filesize
6.9MB

Download
memory/2608-2-0x0000000004770000-0x00000000047B0000-memory.dmp

Filesize
256KB

Download
memory/2608-3-0x0000000001F40000-0x0000000001FBE000-memory.dmp

Filesize
504KB

Download
memory/2608-26-0x0000000074E80000-0x000000007556E000-memory.dmp

Filesize
6.9MB

Download
memory/2616-9-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download
memory/2616-31-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download
memory/2616-7-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download
memory/2616-10-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download
memory/2616-11-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download
memory/2616-12-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download
memory/2616-13-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2616-15-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download
memory/2616-20-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download
memory/2616-25-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download
memory/2616-6-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download
memory/2616-27-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download
memory/2616-30-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download
memory/2616-8-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download
memory/2616-32-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download
memory/2616-33-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download
memory/2616-34-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download
memory/2616-35-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download
memory/2616-36-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download
memory/2616-4-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download
memory/2616-44-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download
memory/2616-45-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download
memory/2616-46-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download
memory/2616-55-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download
memory/2616-56-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download
memory/2616-63-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download
memory/2616-64-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download
memory/2616-71-0x00000000000C0000-0x0000000000142000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads