remcos | 7e7bad139c491ebfadca7f60fc3dc65397a5f70a0ac505d8289a5c7d7f72be23

General

Target

009e38296268df23ce426ecb17d42c30.exe
Size

1.4MB
MD5

009e38296268df23ce426ecb17d42c30
SHA1

dd7a70de4eae1f81d1dc15eb30f220b72f4b9f0f
SHA256

7e7bad139c491ebfadca7f60fc3dc65397a5f70a0ac505d8289a5c7d7f72be23
SHA512

5720f373d1730e5a5794ba1bfb69eb40744eaf22f2ad1aa4415d62c25f99f1ef66dc6b0d84ced6d08a08ae53e8640cc085362c4757f914208a3d85c0ed4f8e92
SSDEEP

24576:j6yJMY9UFoRDhkeYM1jJR97zUbia9JVe0hs5WfBiERJchVML1bT6Eo:uY9UORVOM1jJHzaiape0hsABFRJch6L0

Score

10^/10

remcos graced rat rezer0 upx

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

GRACED

C2

thankyoulord.ddns.net:5050

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-0S5XD9
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/2688-9-0x0000000000620000-0x000000000064C000-memory.dmp	rezer0

Executes dropped EXE 1 IoCs

Processes:

test.exe

pid process

2688 test.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

784 cmd.exe

pid	process
2688	test.exe

pid	process
784	cmd.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2188-1-0x0000000000400000-0x00000000006F1000-memory.dmp	upx
behavioral1/memory/2188-32-0x0000000000400000-0x00000000006F1000-memory.dmp	upx
behavioral1/memory/2188-30-0x0000000000400000-0x00000000006F1000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

test.exe

description pid process target process

PID 2688 set thread context of 2616 2688 test.exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2656 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

test.exe

pid process

2688 test.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

test.exe

description pid process

Token: SeDebugPrivilege 2688 test.exe

description	pid	process	target process
PID 2688 set thread context of 2616	2688	test.exe	vbc.exe

pid	process
2656	schtasks.exe

pid	process
2688	test.exe

description	pid	process
Token: SeDebugPrivilege	2688	test.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

009e38296268df23ce426ecb17d42c30.execmd.exetest.exe

description	pid	process	target process
PID 2188 wrote to memory of 784	2188	009e38296268df23ce426ecb17d42c30.exe	cmd.exe
PID 2188 wrote to memory of 784	2188	009e38296268df23ce426ecb17d42c30.exe	cmd.exe
PID 2188 wrote to memory of 784	2188	009e38296268df23ce426ecb17d42c30.exe	cmd.exe
PID 2188 wrote to memory of 784	2188	009e38296268df23ce426ecb17d42c30.exe	cmd.exe
PID 784 wrote to memory of 2688	784	cmd.exe	test.exe
PID 784 wrote to memory of 2688	784	cmd.exe	test.exe
PID 784 wrote to memory of 2688	784	cmd.exe	test.exe
PID 784 wrote to memory of 2688	784	cmd.exe	test.exe
PID 2688 wrote to memory of 2656	2688	test.exe	schtasks.exe
PID 2688 wrote to memory of 2656	2688	test.exe	schtasks.exe
PID 2688 wrote to memory of 2656	2688	test.exe	schtasks.exe
PID 2688 wrote to memory of 2656	2688	test.exe	schtasks.exe
PID 2688 wrote to memory of 2616	2688	test.exe	vbc.exe
PID 2688 wrote to memory of 2616	2688	test.exe	vbc.exe
PID 2688 wrote to memory of 2616	2688	test.exe	vbc.exe
PID 2688 wrote to memory of 2616	2688	test.exe	vbc.exe
PID 2688 wrote to memory of 2616	2688	test.exe	vbc.exe
PID 2688 wrote to memory of 2616	2688	test.exe	vbc.exe
PID 2688 wrote to memory of 2616	2688	test.exe	vbc.exe
PID 2688 wrote to memory of 2616	2688	test.exe	vbc.exe
PID 2688 wrote to memory of 2616	2688	test.exe	vbc.exe
PID 2688 wrote to memory of 2616	2688	test.exe	vbc.exe
PID 2688 wrote to memory of 2616	2688	test.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\test.exe
test.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2688

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"{path}"
2⤵
PID:2616

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vXAlJeWc" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3727.tmp"
2⤵
- Creates scheduled task(s)
PID:2656

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c test.exe
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:784

C:\Users\Admin\AppData\Local\Temp\009e38296268df23ce426ecb17d42c30.exe
"C:\Users\Admin\AppData\Local\Temp\009e38296268df23ce426ecb17d42c30.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2188

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

1

T1064

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\test.exe
Filesize
65KB

MD5
f144c6bcbb141005797ad14c8f133fec

SHA1
63c2b72aed60ba39147043774f4558b2a8e50bf2

SHA256
4889e1ea24e5820f0390c9561677b6ea272add639e3354bf7241a8f1cbaca79d

SHA512
102dbb87f765986b85d7379125651440819581fed40a905c766c846714600aec638ac83b38667a2261a9bd5b131d58b22337c4a1786a6683c658e76cc2ccf087

Download Submit
C:\Users\Admin\AppData\Local\Temp\test.exe
Filesize
13KB

MD5
4313270d73dbb129aa14c2ccced7db99

SHA1
e32c0ed9510bdf8dd3264651f341fe9ab3b319ec

SHA256
0f2be7f672c2d236d90c52b2717aea2bf91bc710951eb910de7bf7d50acf8660

SHA512
79be6ba1540e12f70e2271f343ac186990f19256987060dccb798dad769fa6051a13e2e3bfe0afb2a63339e3d63987d70c2da49ffb504db5970e525df612bb73

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3727.tmp
Filesize
1KB

MD5
4e3affe5386ce9b9e4622f1be24c9da6

SHA1
ed90e903d3d95ded767bc06c885e752393cd42e1

SHA256
da340990225dfc4daa591deeb4c5e3880329bcb7faf2b407e89dac0dcbd0a3a0

SHA512
84b9e0231de0ae525b608616fa36e3fe34db5ed873da30b5e063d61806b1981576826f1d8d1106c8914df5943b5b62aa126a0779177c024516e659905c8067ab

Download Submit
\Users\Admin\AppData\Local\Temp\test.exe
Filesize
183KB

MD5
309051388dce5e5a387c254859339c14

SHA1
23e040d72bd83a2ba2517dad02ff13cf2ce41926

SHA256
2b1ae1d2d61669d4d23201c74833505672d73258bea7d93d01912376206300ee

SHA512
1146755071234eb3423ba93a49c3a0d30b32a21c1b96d2a5d788993e9baf2b567b8bbac84203473f79751f00661f15fbd2839e749c9bed52ec412e8be8213165

Download Submit
memory/2188-1-0x0000000000400000-0x00000000006F1000-memory.dmp

Filesize
2.9MB

Download
memory/2188-30-0x0000000000400000-0x00000000006F1000-memory.dmp

Filesize
2.9MB

Download
memory/2188-32-0x0000000000400000-0x00000000006F1000-memory.dmp

Filesize
2.9MB

Download
memory/2616-23-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2616-25-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2616-33-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2616-15-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2616-17-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2616-31-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2616-19-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2616-28-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2616-27-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2616-21-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2616-24-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2616-22-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2688-6-0x0000000074100000-0x00000000747EE000-memory.dmp

Filesize
6.9MB

Download
memory/2688-9-0x0000000000620000-0x000000000064C000-memory.dmp

Filesize
176KB

Download
memory/2688-5-0x0000000000870000-0x00000000008C8000-memory.dmp

Filesize
352KB

Download
memory/2688-7-0x0000000004DE0000-0x0000000004E20000-memory.dmp

Filesize
256KB

Download
memory/2688-29-0x0000000074100000-0x00000000747EE000-memory.dmp

Filesize
6.9MB

Download
memory/2688-8-0x00000000002D0000-0x00000000002D8000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads