remcos | 269616c92c90474d1bd9100a160b478aa29124751e7862d99093376470a99bf6

General

Target

77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe
Size

1023.9MB
MD5

e187abc066f3a9b3751199160e80416e
SHA1

9615d3c182031fd626fc9f4eb691ee1f94b516f1
SHA256

6abbdd5105f4caf66cc11b6dbaf1ee4713ffcd5da388271c06e7498b38a76e92
SHA512

92ec4972052995e313a20cdd6c3461bab8e0811697bd9b3704a6c2082ec91f8d0439853415c4d67b965af1a9ce043d445b3fa5d8ce617dfa2d6ef8b06002f8e1
SSDEEP

24576:3qpXIhjkNbsNcg8McK/kUacq9Zm7W8WQYI:ahI1UgBVu39Y7GQY

Score

10^/10

remcos baloto rat

Malware Config

Extracted

Family

remcos

Botnet

BALOTO

C2

nazareno77.con-ip.com:7770

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-GC9ATE
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 548 set thread context of 4924	548	77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe	96

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4132	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4924	csc.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 4924	548	77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe	96
PID 548 wrote to memory of 4924	548	77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe	96
PID 548 wrote to memory of 4924	548	77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe	96
PID 548 wrote to memory of 4924	548	77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe	96
PID 548 wrote to memory of 4924	548	77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe	96
PID 548 wrote to memory of 4924	548	77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe	96
PID 548 wrote to memory of 4924	548	77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe	96
PID 548 wrote to memory of 4924	548	77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe	96
PID 548 wrote to memory of 4924	548	77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe	96
PID 548 wrote to memory of 4924	548	77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe	96
PID 548 wrote to memory of 4924	548	77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe	96
PID 548 wrote to memory of 4924	548	77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe	96
PID 548 wrote to memory of 220	548	77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe	97
PID 548 wrote to memory of 220	548	77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe	97
PID 548 wrote to memory of 220	548	77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe	97
PID 548 wrote to memory of 1580	548	77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe	98
PID 548 wrote to memory of 1580	548	77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe	98
PID 548 wrote to memory of 1580	548	77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe	98
PID 548 wrote to memory of 4688	548	77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe	99
PID 548 wrote to memory of 4688	548	77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe	99
PID 548 wrote to memory of 4688	548	77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe	99
PID 1580 wrote to memory of 4132	1580	cmd.exe	103
PID 1580 wrote to memory of 4132	1580	cmd.exe	103
PID 1580 wrote to memory of 4132	1580	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe
"C:\Users\Admin\AppData\Local\Temp\77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:4924
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\AppData"
  2⤵
  PID:220
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:4132
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\77B3279A611F820EC3ADFFA041C6E00DF83AC3F85B6A141F37A7D3078D492246.exe" "C:\Users\Admin\AppData\Roaming\AppData\AppData.exe"
  2⤵
  PID:4688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
552799717266f5d6335503470e5feedd

SHA1
f5ab41dc0da3f32af499f7016deb86724b40206f

SHA256
bae62f156843ff893e20e032cb745c915ba1914867677a4c9d64223433813c79

SHA512
19f7ef32dd0d5325bc0cf9daf7d2d50cfd86a00d66007c63ce206bd8ae597500b1bde55db58760cf79285772d4737e6fb5759f6c0ba54601f6f1c2b06b08d5da

Download Submit
memory/548-10-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download
memory/548-1-0x0000000074700000-0x0000000074EB0000-memory.dmp

Filesize
7.7MB

Download
memory/548-2-0x0000000005130000-0x00000000056D4000-memory.dmp

Filesize
5.6MB

Download
memory/548-3-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

Filesize
64KB

Download
memory/548-0-0x0000000000170000-0x0000000000272000-memory.dmp

Filesize
1.0MB

Download
memory/4924-14-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4924-4-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4924-6-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4924-12-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4924-9-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4924-13-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4924-5-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4924-21-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4924-22-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4924-8-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4924-27-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4924-28-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4924-34-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4924-35-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4924-40-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4924-41-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4924-46-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4924-48-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4924-53-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/4924-54-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads