remcos | 2c4bbc96d9a6d42c0b43e55735bfb7f90f891d97eee01b0c3520fdaf8f32c2fa

General

Target

5d9ad67271af866ddcb6584cc9aa4e80.exe
Size

1.4MB
MD5

5d9ad67271af866ddcb6584cc9aa4e80
SHA1

bb8110ec39e7b059a86aaa24bdbd0bb65eccb5d7
SHA256

2c4bbc96d9a6d42c0b43e55735bfb7f90f891d97eee01b0c3520fdaf8f32c2fa
SHA512

351cc842e76a8e538c8a9559fa46d10581dadf844362069fca86014be64f71ba4e14b63d3bcc2c7d162568a1e8034567bdd7abd50125807568f7f3dbef843933
SSDEEP

24576:Y6yJMY9UFoRDhkeYM1jJR97zUbia9JVe0hs5WfBiERJchVML1bT6EX:3Y9UORVOM1jJHzaiape0hsABFRJch6Lj

Score

10^/10

remcos graced rat rezer0 upx

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

GRACED

C2

thankyoulord.ddns.net:5050

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-0S5XD9
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral2/memory/1748-12-0x00000000059F0000-0x0000000005A1C000-memory.dmp	rezer0

Executes dropped EXE 1 IoCs

Processes:

test.exe

pid process

1748 test.exe

pid	process
1748	test.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3484-0-0x0000000000400000-0x00000000006F1000-memory.dmp	upx
behavioral2/memory/3484-14-0x0000000000400000-0x00000000006F1000-memory.dmp	upx
behavioral2/memory/3484-26-0x0000000000400000-0x00000000006F1000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2608 schtasks.exe

pid	process
2608	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

5d9ad67271af866ddcb6584cc9aa4e80.execmd.exe

description	pid	process	target process
PID 3484 wrote to memory of 4796	3484	5d9ad67271af866ddcb6584cc9aa4e80.exe	cmd.exe
PID 3484 wrote to memory of 4796	3484	5d9ad67271af866ddcb6584cc9aa4e80.exe	cmd.exe
PID 3484 wrote to memory of 4796	3484	5d9ad67271af866ddcb6584cc9aa4e80.exe	cmd.exe
PID 4796 wrote to memory of 1748	4796	cmd.exe	test.exe
PID 4796 wrote to memory of 1748	4796	cmd.exe	test.exe
PID 4796 wrote to memory of 1748	4796	cmd.exe	test.exe

C:\Users\Admin\AppData\Local\Temp\5d9ad67271af866ddcb6584cc9aa4e80.exe
"C:\Users\Admin\AppData\Local\Temp\5d9ad67271af866ddcb6584cc9aa4e80.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3484

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c test.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:4796

C:\Users\Admin\AppData\Local\Temp\test.exe
test.exe
3⤵
- Executes dropped EXE
PID:1748

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"{path}"
4⤵
PID:1484

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"{path}"
4⤵
PID:1416

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vXAlJeWc" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6DEC.tmp"
4⤵
- Creates scheduled task(s)
PID:2608

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

1

T1064

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\test.exe
Filesize
206KB

MD5
522dc369060cabbc566ea164507e9a34

SHA1
448ffd41acd10986b34c6144c2b81a23f311b52d

SHA256
11d3c8d7cf6f9684099fd4565e47a909234cdd9bb8c241c8062ca36a4823676b

SHA512
b29914e098452605772eb78a9ca9d56a86f6c2add4c9911d469b50afb975b9e03277228604bb3f5abe7816cd3802512ba02c0a696938b38869f9174079e3a507

Download Submit
C:\Users\Admin\AppData\Local\Temp\test.exe
Filesize
133KB

MD5
dd51247de84d7ccf2c3d484e64d7c8c2

SHA1
9c7b341723d626cff20d0a128dd90afa18bb33f1

SHA256
a7d4ea8d4e40afcc1b54be8ece829c261cf5232d74193be80ce5727ba3fac09f

SHA512
3e12f6e1dde1fe0634f167d558c2023b8c918aab3867bc738ac85c44d7fcef0b473ecb6ded61ed8de3a0f079ec2507fead4dcd923e624442e9c8a30732302ad2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6DEC.tmp
Filesize
1KB

MD5
9723c06541ad7bbfc2915228736b121d

SHA1
5aa17dcd4490497e67f4918f991bf10f0b117000

SHA256
f6e0363560785935100a4aaeb9a90e4646b110d94df67bf4d7e22f43d890cc98

SHA512
76226d54204d87e55862a8bc05073013663de6700ebf83a62d7a9e49ea90e29392d13bc12985a7e2a76be35446d21f92c5a078429fd65618be6d459f605cf247

Download Submit
C:\Users\Admin\AppData\Roaming\vXAlJeWc.exe
Filesize
44KB

MD5
7a239a402515b2c096cb9e3ae7bfa5aa

SHA1
335d64e67e4a29f6187d2d6132abdab211909cf4

SHA256
3ac094fac9323f2d65aaa5810851ddbc4200df3b9d9b95a7139e703cf679b2a0

SHA512
632193425526a3a931db53861074aac2682d6537fe1fe22f96d87aec0dc66ab713bd66eab89df9c0877fd186fbcc00484f97ab10cee26a506cfeb8f72e1a5923

Download Submit
memory/1416-28-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1416-27-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1416-50-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1416-46-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1416-44-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1416-32-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1416-31-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1416-29-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1416-20-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1416-24-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1416-23-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1748-11-0x0000000005590000-0x0000000005598000-memory.dmp

Filesize
32KB

Download
memory/1748-25-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/1748-6-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/1748-7-0x0000000005BC0000-0x0000000006164000-memory.dmp

Filesize
5.6MB

Download
memory/1748-12-0x00000000059F0000-0x0000000005A1C000-memory.dmp

Filesize
176KB

Download
memory/1748-13-0x0000000006210000-0x00000000062AC000-memory.dmp

Filesize
624KB

Download
memory/1748-5-0x0000000000B40000-0x0000000000B98000-memory.dmp

Filesize
352KB

Download
memory/1748-10-0x00000000055A0000-0x00000000055AA000-memory.dmp

Filesize
40KB

Download
memory/1748-9-0x0000000005550000-0x0000000005560000-memory.dmp

Filesize
64KB

Download
memory/1748-8-0x0000000005610000-0x00000000056A2000-memory.dmp

Filesize
584KB

Download
memory/3484-26-0x0000000000400000-0x00000000006F1000-memory.dmp

Filesize
2.9MB

Download
memory/3484-14-0x0000000000400000-0x00000000006F1000-memory.dmp

Filesize
2.9MB

Download
memory/3484-0-0x0000000000400000-0x00000000006F1000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads