remcos | 457658800e6bb3794e69aa074fb3bc006fcc63fd4b446f80411487cf8c7eeebf

General

Target

2558c754145d6187cae9502ce7ba6ddb.exe
Size

132KB
MD5

2558c754145d6187cae9502ce7ba6ddb
SHA1

570b5e7a05317e558a907ac46ec2ffca983dd69c
SHA256

457658800e6bb3794e69aa074fb3bc006fcc63fd4b446f80411487cf8c7eeebf
SHA512

7e57de3538f6776b24a9eb66b305c95a39b0c417cd69a30c63cb871c334b701898e1de453b4b193bb9248cc2d895f7dbe5b23c3e50607bc8b0589bdcff9d7e0c
SSDEEP

1536:ITHiPBX4nDzMyRXGHrc9YRHqbTypgpmb5Q+ZReSdhk/J+YLgD3mrxb53cSuYQjKQ:xPd4n/M+WLcilrpgGH/GwY87mVmIXxq

Score

10^/10

remcos host persistence rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

systemcontrol.ddns.net:45000

systemcontrol2.ddns.net:45000

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
OfficeUpgrade.exe
copy_folder
OfficeUpgrade
delete_file
false
hide_file
true
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
Upgrader.dat
keylog_flag
false
keylog_folder
Upgrader
keylog_path
%AppData%
mouse_option
false
mutex
req_khauflaoyr
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
OfficeUpgrade
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Control Panel\International\Geo\Nation	2558c754145d6187cae9502ce7ba6ddb.exe

Executes dropped EXE 2 IoCs

pid	Process
2060	wn2ra4ohzdr.exe
4984	wn2ra4ohzdr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\raj4dkhhiap = "C:\\Users\\Admin\\AppData\\Roaming\\raj4dkhhiap\\wn2ra4ohzdr.exe"	2558c754145d6187cae9502ce7ba6ddb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2060 set thread context of 4984	2060	wn2ra4ohzdr.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4984	wn2ra4ohzdr.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2060	2460	2558c754145d6187cae9502ce7ba6ddb.exe	89
PID 2460 wrote to memory of 2060	2460	2558c754145d6187cae9502ce7ba6ddb.exe	89
PID 2460 wrote to memory of 2060	2460	2558c754145d6187cae9502ce7ba6ddb.exe	89
PID 2060 wrote to memory of 4984	2060	wn2ra4ohzdr.exe	90
PID 2060 wrote to memory of 4984	2060	wn2ra4ohzdr.exe	90
PID 2060 wrote to memory of 4984	2060	wn2ra4ohzdr.exe	90
PID 2060 wrote to memory of 4984	2060	wn2ra4ohzdr.exe	90
PID 2060 wrote to memory of 4984	2060	wn2ra4ohzdr.exe	90
PID 2060 wrote to memory of 4984	2060	wn2ra4ohzdr.exe	90
PID 2060 wrote to memory of 4984	2060	wn2ra4ohzdr.exe	90
PID 2060 wrote to memory of 4984	2060	wn2ra4ohzdr.exe	90
PID 2060 wrote to memory of 4984	2060	wn2ra4ohzdr.exe	90

C:\Users\Admin\AppData\Local\Temp\2558c754145d6187cae9502ce7ba6ddb.exe
"C:\Users\Admin\AppData\Local\Temp\2558c754145d6187cae9502ce7ba6ddb.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe
  "C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe
    "C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\raj4dkhhiap\wn2ra4ohzdr.exe

Filesize
132KB

MD5
727eb57e7910ddc13df9453360ae6eb1

SHA1
fdc496c3a940726f2e301025592c1c2586d351c9

SHA256
a3ecf350ae5349f0e2478a75615057552c78a58e8fcbd94d7c516c7e22399de2

SHA512
303a98fd440b30e51a6ce0751cf8d4cef31495a83b78cc8d0476abcd023bc9b42db5902c2fbbded6bc864137952862ebe9b920ef1c00b64a19f60207dee50607

Download Submit
memory/2060-36-0x0000000074730000-0x0000000074EE0000-memory.dmp

Filesize
7.7MB

Download
memory/2060-22-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/2060-20-0x0000000074730000-0x0000000074EE0000-memory.dmp

Filesize
7.7MB

Download
memory/2460-4-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/2460-1-0x0000000074730000-0x0000000074EE0000-memory.dmp

Filesize
7.7MB

Download
memory/2460-6-0x00000000053A0000-0x00000000053C0000-memory.dmp

Filesize
128KB

Download
memory/2460-0-0x00000000003B0000-0x00000000003D8000-memory.dmp

Filesize
160KB

Download
memory/2460-3-0x0000000004DF0000-0x0000000004E82000-memory.dmp

Filesize
584KB

Download
memory/2460-21-0x0000000074730000-0x0000000074EE0000-memory.dmp

Filesize
7.7MB

Download
memory/2460-2-0x0000000005480000-0x0000000005A24000-memory.dmp

Filesize
5.6MB

Download
memory/2460-5-0x0000000004DE0000-0x0000000004DEA000-memory.dmp

Filesize
40KB

Download
memory/4984-23-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4984-25-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4984-26-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4984-29-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4984-30-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4984-32-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4984-24-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads