remcos | 172d81908df0bfd28ef79dabd0fb2c03311597ba842565be57039c03f16c4e1a

General

Target

4787014a18e060d7defae1ece0afd19c.exe
Size

1.2MB
MD5

4787014a18e060d7defae1ece0afd19c
SHA1

260c625743e4ff36047472ec8524e01122cff7c6
SHA256

172d81908df0bfd28ef79dabd0fb2c03311597ba842565be57039c03f16c4e1a
SHA512

d4c874463678ab1cc9befbfa6d36fe629716d59532f686604cd8bd018783e2922ceecc1f2279d133a11566cec64eebd955f9e1661edfe7f963fe1dfb3f57e55b
SSDEEP

24576:xz68LS/d3YK64JyI/GFwJQIhSXyCGxHMIlNUZDj5xwpCsRhna9uTgF3v:1dK64JSw6ZlGxHVlyZl+pjhcuO3

Score

10^/10

remcos zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzvolando rat

Malware Config

Extracted

Family

remcos

Version

3.1.2 Pro

Botnet

ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZVOLANDO

C2

dominoduck2119.duckdns.org:9807

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
Appdriver.exe
copy_folder
Appdataaa
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
loggs.dat
keylog_flag
false
keylog_folder
Appdataaa
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-PYW8BL
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Appdataa
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

CustAttr .NET packer 1 IoCs

Detects CustAttr .NET packer in memory.

resource	yara_rule
behavioral1/memory/2800-3-0x00000000003B0000-0x00000000003C2000-memory.dmp	CustAttr

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2800 set thread context of 3052	2800	4787014a18e060d7defae1ece0afd19c.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2800	4787014a18e060d7defae1ece0afd19c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2800	4787014a18e060d7defae1ece0afd19c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3052	RegSvcs.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2112	2800	4787014a18e060d7defae1ece0afd19c.exe	30
PID 2800 wrote to memory of 2112	2800	4787014a18e060d7defae1ece0afd19c.exe	30
PID 2800 wrote to memory of 2112	2800	4787014a18e060d7defae1ece0afd19c.exe	30
PID 2800 wrote to memory of 2112	2800	4787014a18e060d7defae1ece0afd19c.exe	30
PID 2800 wrote to memory of 3052	2800	4787014a18e060d7defae1ece0afd19c.exe	32
PID 2800 wrote to memory of 3052	2800	4787014a18e060d7defae1ece0afd19c.exe	32
PID 2800 wrote to memory of 3052	2800	4787014a18e060d7defae1ece0afd19c.exe	32
PID 2800 wrote to memory of 3052	2800	4787014a18e060d7defae1ece0afd19c.exe	32
PID 2800 wrote to memory of 3052	2800	4787014a18e060d7defae1ece0afd19c.exe	32
PID 2800 wrote to memory of 3052	2800	4787014a18e060d7defae1ece0afd19c.exe	32
PID 2800 wrote to memory of 3052	2800	4787014a18e060d7defae1ece0afd19c.exe	32
PID 2800 wrote to memory of 3052	2800	4787014a18e060d7defae1ece0afd19c.exe	32
PID 2800 wrote to memory of 3052	2800	4787014a18e060d7defae1ece0afd19c.exe	32
PID 2800 wrote to memory of 3052	2800	4787014a18e060d7defae1ece0afd19c.exe	32
PID 2800 wrote to memory of 3052	2800	4787014a18e060d7defae1ece0afd19c.exe	32
PID 2800 wrote to memory of 3052	2800	4787014a18e060d7defae1ece0afd19c.exe	32
PID 2800 wrote to memory of 3052	2800	4787014a18e060d7defae1ece0afd19c.exe	32
PID 2800 wrote to memory of 3052	2800	4787014a18e060d7defae1ece0afd19c.exe	32
PID 2800 wrote to memory of 3052	2800	4787014a18e060d7defae1ece0afd19c.exe	32
PID 2800 wrote to memory of 3052	2800	4787014a18e060d7defae1ece0afd19c.exe	32

C:\Users\Admin\AppData\Local\Temp\4787014a18e060d7defae1ece0afd19c.exe
"C:\Users\Admin\AppData\Local\Temp\4787014a18e060d7defae1ece0afd19c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bmWwyNAzSm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6DEF.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2112
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp6DEF.tmp

Filesize
1KB

MD5
95aff7f6aa5045e3bc0bf40461280041

SHA1
07aa570336303bfea2b9e272289b56e010da60c7

SHA256
eac4b624827104b5c4fb97a1bf9bec8fbec1d509bc381dd92c45a2d8b2e7909e

SHA512
b25d64c24f27a9e896227c99f586f09aca4abf3d7c89d1ff7d32d017adbb6742fab48fe51f8444ce2df95eba0f14726e5bf5285567c57645f745cac23de975aa

Download Submit
C:\Users\Admin\AppData\Roaming\Appdataaa\loggs.dat

Filesize
74B

MD5
63d13d0ecab87294880eacbbeb590534

SHA1
8de50cef2057eaee51242efcf6d243f252173d19

SHA256
9ad8bf16785b89d9eb0b96b8ee43c2bba236d239e9f4e96c2fccc4459b4c15cd

SHA512
e2f988130e28938004d3f6c8cb077790731e027243412d7597b92f4498b5a9709a4e7ea87fadac61d725c17e9bd2602d6c8ca74cf883b113399006fdff2d2508

Download Submit
memory/2800-31-0x00000000747D0000-0x0000000074EBE000-memory.dmp

Filesize
6.9MB

Download
memory/2800-1-0x0000000001070000-0x00000000011AC000-memory.dmp

Filesize
1.2MB

Download
memory/2800-0-0x00000000747D0000-0x0000000074EBE000-memory.dmp

Filesize
6.9MB

Download
memory/2800-5-0x0000000000DF0000-0x0000000000E30000-memory.dmp

Filesize
256KB

Download
memory/2800-6-0x0000000005B30000-0x0000000005BF0000-memory.dmp

Filesize
768KB

Download
memory/2800-7-0x0000000004C20000-0x0000000004C98000-memory.dmp

Filesize
480KB

Download
memory/2800-2-0x0000000000DF0000-0x0000000000E30000-memory.dmp

Filesize
256KB

Download
memory/2800-3-0x00000000003B0000-0x00000000003C2000-memory.dmp

Filesize
72KB

Download
memory/2800-4-0x00000000747D0000-0x0000000074EBE000-memory.dmp

Filesize
6.9MB

Download
memory/3052-20-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3052-21-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3052-13-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3052-30-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3052-26-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3052-27-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3052-24-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3052-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3052-17-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3052-18-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3052-19-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3052-15-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3052-14-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3052-29-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads