remcos | 4c201df380edb8b733306f0082b9b075ef0c53ae1b9a44d6a87ba24aec255cce

General

Target

7a984bf728b7169341dd20d75a0d6408.exe
Size

1.4MB
MD5

7a984bf728b7169341dd20d75a0d6408
SHA1

25533a5d814cb645e30a17dc93c25ec30aec16e7
SHA256

4c201df380edb8b733306f0082b9b075ef0c53ae1b9a44d6a87ba24aec255cce
SHA512

373b7ef9ab4b7ba70b60f73f8edf2e8a2b4c63a19048bef64fb00872dca52d0821fadcc2cbce035f75fdd2fc1f03c4241951a34c10a917d7db0f20b11c01f763
SSDEEP

24576:+6yJMY9UFoRDhkeYM1jJR97zUbia9JVe0hs5WfBiERJchVML1bT6E7:JY9UORVOM1jJHzaiape0hsABFRJch6Lv

Score

10^/10

remcos graced rat rezer0 upx

Malware Config

Extracted

Family

remcos

Version

2.5.0 Pro

Botnet

GRACED

C2

thankyoulord.ddns.net:5050

Attributes

audio_folder
MicRecords
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
Remcos-0S5XD9
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5
take_screenshot_title
wikipedia;solitaire;

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/2684-9-0x0000000000B90000-0x0000000000BBC000-memory.dmp	rezer0

Executes dropped EXE 1 IoCs

Processes:

test.exe

pid process

2684 test.exe
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

2920 cmd.exe

pid	process
2684	test.exe

pid	process
2920	cmd.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2392-0-0x0000000000400000-0x00000000006F1000-memory.dmp	upx
behavioral1/memory/2392-10-0x0000000000400000-0x00000000006F1000-memory.dmp	upx
behavioral1/memory/2392-35-0x0000000000400000-0x00000000006F1000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

test.exe

description pid process target process

PID 2684 set thread context of 2812 2684 test.exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

1892 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

test.exe

pid process

2684 test.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

test.exe

description pid process

Token: SeDebugPrivilege 2684 test.exe

description	pid	process	target process
PID 2684 set thread context of 2812	2684	test.exe	vbc.exe

pid	process
1892	schtasks.exe

pid	process
2684	test.exe

description	pid	process
Token: SeDebugPrivilege	2684	test.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

7a984bf728b7169341dd20d75a0d6408.execmd.exetest.exe

description	pid	process	target process
PID 2392 wrote to memory of 2920	2392	7a984bf728b7169341dd20d75a0d6408.exe	cmd.exe
PID 2392 wrote to memory of 2920	2392	7a984bf728b7169341dd20d75a0d6408.exe	cmd.exe
PID 2392 wrote to memory of 2920	2392	7a984bf728b7169341dd20d75a0d6408.exe	cmd.exe
PID 2392 wrote to memory of 2920	2392	7a984bf728b7169341dd20d75a0d6408.exe	cmd.exe
PID 2920 wrote to memory of 2684	2920	cmd.exe	test.exe
PID 2920 wrote to memory of 2684	2920	cmd.exe	test.exe
PID 2920 wrote to memory of 2684	2920	cmd.exe	test.exe
PID 2920 wrote to memory of 2684	2920	cmd.exe	test.exe
PID 2684 wrote to memory of 1892	2684	test.exe	schtasks.exe
PID 2684 wrote to memory of 1892	2684	test.exe	schtasks.exe
PID 2684 wrote to memory of 1892	2684	test.exe	schtasks.exe
PID 2684 wrote to memory of 1892	2684	test.exe	schtasks.exe
PID 2684 wrote to memory of 2812	2684	test.exe	vbc.exe
PID 2684 wrote to memory of 2812	2684	test.exe	vbc.exe
PID 2684 wrote to memory of 2812	2684	test.exe	vbc.exe
PID 2684 wrote to memory of 2812	2684	test.exe	vbc.exe
PID 2684 wrote to memory of 2812	2684	test.exe	vbc.exe
PID 2684 wrote to memory of 2812	2684	test.exe	vbc.exe
PID 2684 wrote to memory of 2812	2684	test.exe	vbc.exe
PID 2684 wrote to memory of 2812	2684	test.exe	vbc.exe
PID 2684 wrote to memory of 2812	2684	test.exe	vbc.exe
PID 2684 wrote to memory of 2812	2684	test.exe	vbc.exe
PID 2684 wrote to memory of 2812	2684	test.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\7a984bf728b7169341dd20d75a0d6408.exe
"C:\Users\Admin\AppData\Local\Temp\7a984bf728b7169341dd20d75a0d6408.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2392

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c test.exe
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2920

C:\Users\Admin\AppData\Local\Temp\test.exe
test.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vXAlJeWc" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7C22.tmp"
4⤵
- Creates scheduled task(s)
PID:1892

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"{path}"
4⤵
PID:2812

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

1

T1064

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\test.exe
Filesize
215KB

MD5
c659ac1fc873b3d281228eb4a910b27a

SHA1
7892c55e8e93f5c31fb96e3f8f5ec311b516c75f

SHA256
2ab62d7fd6cee3d213ef004aaefc202096ee16c82b0eb00c2db38b00ff4c153a

SHA512
56f1d7cbb7020630b7e2140e457d1af1c7112abf0b224deeedc7422c3fd91f1a3ea24c6243a640d31ef3840bf5a88e1dc58f67893a9be078ff0cc8a45579df80

Download Submit
C:\Users\Admin\AppData\Local\Temp\test.exe
Filesize
120KB

MD5
8531ff0740efa4d1f65d92f52c6a8ce3

SHA1
10f8199f1da9c702cbf99b0f465633e4a9b6ed5e

SHA256
4b23d19cdaf8484cb8f88e2981a0b485c51d88924f7b7b0b9be757b5036d9142

SHA512
09fa26be704d3e493eb864b46b7ba65f727b12c216ab50777410921be418900331c827c3c7e1e1f50b6fc31d179cde28cac33fcffd6e52dee2dd708b790ff164

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp7C22.tmp
Filesize
1KB

MD5
5e71b9b2e25164df20dac4cceff76168

SHA1
8b7bc6ed4f7bb168bb95fe1a97720fb34dbc99a2

SHA256
445a86c7a8427bcbf32ea046f6088f9f31ceaac665fa4818d7bc7e57d0284287

SHA512
396476eb1eb1ddeeba30584043e2b5fc04955fa78be6aebf97b13b85eb06b6c4c7c57a585d06d360c57c3d5af9253591ac720dc1f75c456af07e15226c34ae6e

Download Submit
\Users\Admin\AppData\Local\Temp\test.exe
Filesize
245KB

MD5
bf98d15b0184b4ae2c72904d016fc146

SHA1
a84488f16fd1b99ba2b79bee579f5fd8798a79ba

SHA256
7c9e346b69a81535047c4ca8649760dfe5c26ccf4c942ebff1435c9f08d0ac2b

SHA512
661a5ddf963c3590bbeb3bd54d12af25f595ace0d7c090b13626e04c3d4d87898ff87a3a5bb416ec85e6f755cd1db0f6b70a6af0e2b0c3d278915492d3d83a3a

Download Submit
memory/2392-10-0x0000000000400000-0x00000000006F1000-memory.dmp

Filesize
2.9MB

Download
memory/2392-0-0x0000000000400000-0x00000000006F1000-memory.dmp

Filesize
2.9MB

Download
memory/2392-35-0x0000000000400000-0x00000000006F1000-memory.dmp

Filesize
2.9MB

Download
memory/2684-6-0x0000000074C40000-0x000000007532E000-memory.dmp

Filesize
6.9MB

Download
memory/2684-7-0x00000000011F0000-0x0000000001230000-memory.dmp

Filesize
256KB

Download
memory/2684-8-0x00000000003E0000-0x00000000003E8000-memory.dmp

Filesize
32KB

Download
memory/2684-9-0x0000000000B90000-0x0000000000BBC000-memory.dmp

Filesize
176KB

Download
memory/2684-5-0x00000000012E0000-0x0000000001338000-memory.dmp

Filesize
352KB

Download
memory/2684-32-0x0000000074C40000-0x000000007532E000-memory.dmp

Filesize
6.9MB

Download
memory/2812-18-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2812-38-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2812-29-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2812-24-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2812-22-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2812-26-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2812-31-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2812-20-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2812-33-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2812-34-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2812-16-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2812-36-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2812-37-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2812-28-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2812-40-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2812-41-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2812-43-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2812-45-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2812-47-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2812-49-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2812-51-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2812-53-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2812-55-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2812-57-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2812-59-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2812-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads