remcos | 1f0a225b3b04a26d777a315cb1cacde6d5b0d7fc9e182a96ef035b41adada2de

General

Target

GH0987654560087.bat.exe
Size

1.3MB
MD5

f0b143f0d8012b2acb59e94544ee8a95
SHA1

215cd6adf283a17bf4c717e27842bc1e9bfb2058
SHA256

1f0a225b3b04a26d777a315cb1cacde6d5b0d7fc9e182a96ef035b41adada2de
SHA512

64b5dd4b4f14c090a06cbfa3dc69028efdc9c2c973afe7b3449eb4211611d8f373124eef14553548dd0cfc18b057d9518000ea6a8082fe1987c05b89f9a9dfa1
SSDEEP

24576:HYc6g/pOKKeFZYokY8+VnPZhNsqWOgjcjqQvWV:HrZYokYNnFsfxjcjqbV

Score

10^/10

remcos remotehost rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

107.175.229.139:8087

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-IZFV1M
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Drops startup file 2 IoCs

Processes:

Powershell.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe	Powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe	Powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

GH0987654560087.bat.exe

description pid process target process

PID 2072 set thread context of 2648 2072 GH0987654560087.bat.exe RegAsm.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Powershell.exe

pid process

2936 Powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Powershell.exe

description pid process

Token: SeDebugPrivilege 2936 Powershell.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

RegAsm.exe

pid process

2648 RegAsm.exe

description	pid	process	target process
PID 2072 set thread context of 2648	2072	GH0987654560087.bat.exe	RegAsm.exe

pid	process
2936	Powershell.exe

description	pid	process
Token: SeDebugPrivilege	2936	Powershell.exe

pid	process
2648	RegAsm.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

GH0987654560087.bat.exe

description	pid	process	target process
PID 2072 wrote to memory of 2936	2072	GH0987654560087.bat.exe	Powershell.exe
PID 2072 wrote to memory of 2936	2072	GH0987654560087.bat.exe	Powershell.exe
PID 2072 wrote to memory of 2936	2072	GH0987654560087.bat.exe	Powershell.exe
PID 2072 wrote to memory of 2936	2072	GH0987654560087.bat.exe	Powershell.exe
PID 2072 wrote to memory of 2648	2072	GH0987654560087.bat.exe	RegAsm.exe
PID 2072 wrote to memory of 2648	2072	GH0987654560087.bat.exe	RegAsm.exe
PID 2072 wrote to memory of 2648	2072	GH0987654560087.bat.exe	RegAsm.exe
PID 2072 wrote to memory of 2648	2072	GH0987654560087.bat.exe	RegAsm.exe
PID 2072 wrote to memory of 2648	2072	GH0987654560087.bat.exe	RegAsm.exe
PID 2072 wrote to memory of 2648	2072	GH0987654560087.bat.exe	RegAsm.exe
PID 2072 wrote to memory of 2648	2072	GH0987654560087.bat.exe	RegAsm.exe
PID 2072 wrote to memory of 2648	2072	GH0987654560087.bat.exe	RegAsm.exe
PID 2072 wrote to memory of 2648	2072	GH0987654560087.bat.exe	RegAsm.exe
PID 2072 wrote to memory of 2648	2072	GH0987654560087.bat.exe	RegAsm.exe
PID 2072 wrote to memory of 2648	2072	GH0987654560087.bat.exe	RegAsm.exe
PID 2072 wrote to memory of 2648	2072	GH0987654560087.bat.exe	RegAsm.exe
PID 2072 wrote to memory of 2648	2072	GH0987654560087.bat.exe	RegAsm.exe
PID 2072 wrote to memory of 2648	2072	GH0987654560087.bat.exe	RegAsm.exe
PID 2072 wrote to memory of 2648	2072	GH0987654560087.bat.exe	RegAsm.exe
PID 2072 wrote to memory of 2648	2072	GH0987654560087.bat.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\GH0987654560087.bat.exe
"C:\Users\Admin\AppData\Local\Temp\GH0987654560087.bat.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2072

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
"Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\GH0987654560087.bat.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe'
2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2936

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
2⤵
- Suspicious use of SetWindowsHookEx
PID:2648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat
Filesize
144B

MD5
da1c2259a5f1874bcd0bf3be4be41a02

SHA1
7a30e2449a433d7824019ada370bd5e25d0fa472

SHA256
5a7e7c7babb22cf972a2b7fa21ce3251e1e222d02265dcded4b3e54af9f5943c

SHA512
51b6248b96d855204e7d3320e3a357932f2e369166e79a3f90385041d575af142d2651f9cec35a05c2e74e1c6fb9a124c9c223f4253c86dad1bbc399685e2efc

Download Submit
memory/2072-10-0x0000000000320000-0x000000000032A000-memory.dmp

Filesize
40KB

Download
memory/2072-1-0x0000000074A10000-0x00000000750FE000-memory.dmp

Filesize
6.9MB

Download
memory/2072-2-0x0000000000750000-0x0000000000790000-memory.dmp

Filesize
256KB

Download
memory/2072-3-0x0000000000E00000-0x0000000000EAE000-memory.dmp

Filesize
696KB

Download
memory/2072-0-0x0000000001020000-0x000000000116A000-memory.dmp

Filesize
1.3MB

Download
memory/2072-23-0x0000000074A10000-0x00000000750FE000-memory.dmp

Filesize
6.9MB

Download
memory/2648-24-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2648-31-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2648-21-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2648-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2648-71-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2648-18-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2648-17-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2648-16-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2648-15-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2648-14-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2648-13-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2648-12-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2648-11-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2648-70-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2648-65-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2648-33-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2648-32-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2648-63-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2648-28-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2648-27-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2648-38-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2648-39-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2648-58-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2648-44-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2648-45-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2648-51-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2648-52-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2648-57-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2936-6-0x0000000070110000-0x00000000706BB000-memory.dmp

Filesize
5.7MB

Download
memory/2936-9-0x0000000070110000-0x00000000706BB000-memory.dmp

Filesize
5.7MB

Download
memory/2936-29-0x0000000070110000-0x00000000706BB000-memory.dmp

Filesize
5.7MB

Download
memory/2936-7-0x0000000002A40000-0x0000000002A80000-memory.dmp

Filesize
256KB

Download
memory/2936-8-0x0000000002A40000-0x0000000002A80000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing