remcos | 35a16a156ed57760d503624ac6b8def2ab5f92f2760e3cd7d4dbee731ea787dc

General

Target

c03ce838f2bba250ac039f9509f7c93e.exe
Size

1.4MB
MD5

c03ce838f2bba250ac039f9509f7c93e
SHA1

28adabeac4ac799a87d8a0557636f71106ef94f1
SHA256

35a16a156ed57760d503624ac6b8def2ab5f92f2760e3cd7d4dbee731ea787dc
SHA512

cc007d96d622a761ce7901b1b2ee21750ec01aacf75ca24ffe92910680baa73a1d9680d915e430849210e34f761cd7f757748050fdff35a0e2b019460e1c09f6
SSDEEP

24576:Y6yJMY9UFoRDhkeYM1jJR97zUbia9JVe0hs5WfBiERJchVML1bT6Ed:3Y9UORVOM1jJHzaiape0hsABFRJch6LB

Score

10^/10

remcos graced rat rezer0 upx

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

GRACED

C2

thankyoulord.ddns.net:5050

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-0S5XD9
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral2/memory/1420-12-0x0000000005270000-0x000000000529C000-memory.dmp	rezer0

Executes dropped EXE 1 IoCs

Processes:

test.exe

pid process

1420 test.exe

pid	process
1420	test.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4800-0-0x0000000000400000-0x00000000006F1000-memory.dmp	upx
behavioral2/memory/4800-25-0x0000000000400000-0x00000000006F1000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1976 schtasks.exe

pid	process
1976	schtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

c03ce838f2bba250ac039f9509f7c93e.execmd.exe

description	pid	process	target process
PID 4800 wrote to memory of 4480	4800	c03ce838f2bba250ac039f9509f7c93e.exe	cmd.exe
PID 4800 wrote to memory of 4480	4800	c03ce838f2bba250ac039f9509f7c93e.exe	cmd.exe
PID 4800 wrote to memory of 4480	4800	c03ce838f2bba250ac039f9509f7c93e.exe	cmd.exe
PID 4480 wrote to memory of 1420	4480	cmd.exe	test.exe
PID 4480 wrote to memory of 1420	4480	cmd.exe	test.exe
PID 4480 wrote to memory of 1420	4480	cmd.exe	test.exe

C:\Users\Admin\AppData\Local\Temp\c03ce838f2bba250ac039f9509f7c93e.exe
"C:\Users\Admin\AppData\Local\Temp\c03ce838f2bba250ac039f9509f7c93e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4800

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c test.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:4480

C:\Users\Admin\AppData\Local\Temp\test.exe
test.exe
3⤵
- Executes dropped EXE
PID:1420

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vXAlJeWc" /XML "C:\Users\Admin\AppData\Local\Temp\tmp788B.tmp"
4⤵
- Creates scheduled task(s)
PID:1976

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"{path}"
4⤵
PID:1432

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

1

T1064

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\test.exe
Filesize
18KB

MD5
e6e309670ecf18824e6fa3bca4352338

SHA1
2a013a0c065f106c9042e70e17c451e43742f2b6

SHA256
a3b0629ade4f60c9955aec6449c35fe09a47b5ab97e713333cca66d997c1fe61

SHA512
effb63efc6d9e4a11298a5f21eec46cc9d7002d7249e190f938f5ccce9f6085e0a6f4532741152ae52173a97a31744e93596cc5add059cb7632497c379aab9f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\test.exe
Filesize
36KB

MD5
ec43862da7c5397fdf22bc31b2c47187

SHA1
7e074eada8d89bbf55df8b3439d31f52b9b962d9

SHA256
717f450f4ab25daef6d9ada949c611ed5fa6bbae6090069ebd234acfc1306e15

SHA512
13dc758b7c18ed495dedfca35ba222fd9d4e9371af5f96bb8108df75bd78256e621cd3e22a1e8da9fff185ac841ed1d6d0259ed0271f84f16bff22bf12fa316d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp788B.tmp
Filesize
1KB

MD5
9723c06541ad7bbfc2915228736b121d

SHA1
5aa17dcd4490497e67f4918f991bf10f0b117000

SHA256
f6e0363560785935100a4aaeb9a90e4646b110d94df67bf4d7e22f43d890cc98

SHA512
76226d54204d87e55862a8bc05073013663de6700ebf83a62d7a9e49ea90e29392d13bc12985a7e2a76be35446d21f92c5a078429fd65618be6d459f605cf247

Download Submit
C:\Users\Admin\AppData\Roaming\vXAlJeWc.exe
Filesize
10KB

MD5
bca919f315ca9d62a5179547c18877fa

SHA1
1a6b5f2230d71acd7688ba1ed118d15ecf4dd50b

SHA256
fdf6a0e308e093f557ea6c5f4f5ee66af8883a6ac1bfdbaad578e85407698153

SHA512
94ef3ca46cfd6dcca9e4208d3e5da6d54240cdd3333a381f8819c50f3489d6cbb5246d83d1f91841070baa20f1feaecc099c7b6977540195c5ec95a06de3eb5c

Download Submit
memory/1420-24-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/1420-5-0x0000000000600000-0x0000000000658000-memory.dmp

Filesize
352KB

Download
memory/1420-7-0x00000000054B0000-0x0000000005A54000-memory.dmp

Filesize
5.6MB

Download
memory/1420-9-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

Filesize
64KB

Download
memory/1420-10-0x0000000004F30000-0x0000000004F3A000-memory.dmp

Filesize
40KB

Download
memory/1420-11-0x0000000004F20000-0x0000000004F28000-memory.dmp

Filesize
32KB

Download
memory/1420-13-0x0000000005B60000-0x0000000005BFC000-memory.dmp

Filesize
624KB

Download
memory/1420-12-0x0000000005270000-0x000000000529C000-memory.dmp

Filesize
176KB

Download
memory/1420-8-0x0000000004FA0000-0x0000000005032000-memory.dmp

Filesize
584KB

Download
memory/1420-6-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/1432-23-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1432-26-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1432-20-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1432-27-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1432-28-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1432-29-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1432-31-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1432-40-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1432-46-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4800-14-0x0000000000400000-0x00000000006F1000-memory.dmp

Filesize
2.9MB

Download
memory/4800-25-0x0000000000400000-0x00000000006F1000-memory.dmp

Filesize
2.9MB

Download
memory/4800-0-0x0000000000400000-0x00000000006F1000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads