remcos | f361275b4679dd821cec516ab8d3b1a7523f8920bbd65f22a3610d523951729b

General

Target

UTR400620101111.exe
Size

693KB
MD5

ed7e3220e46369bec523ca3338a330e5
SHA1

bcf3c8f96c5b2df5f4f694bc9be8b13f4c5d6444
SHA256

f361275b4679dd821cec516ab8d3b1a7523f8920bbd65f22a3610d523951729b
SHA512

42f41cf20e49027e229fdc711336200d58b4982c1c4c1986074a1b6cb0498c79138ad3c10009ef1d781324df270a60ca04891a252587907094ed82037e231500
SSDEEP

12288:YWh868yq0Gg4rijd3l1Gwq2k4cJptpSydNRt9WfV4kD9c3hwEAmD:YV68yq0N4cd3Gw7sJjpJdNvAn9cxw

Score

10^/10

remcos gg rat

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

gg

C2

62.102.148.185:9771

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
newstart
keylog_path
%AppData%
mouse_option
false
mutex
remcos_wgwfvnfssp
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Suspicious use of SetThreadContext 1 IoCs

Processes:

UTR400620101111.exe

description pid process target process

PID 1728 set thread context of 2692 1728 UTR400620101111.exe UTR400620101111.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2940 schtasks.exe

description	pid	process	target process
PID 1728 set thread context of 2692	1728	UTR400620101111.exe	UTR400620101111.exe

pid	process
2940	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

UTR400620101111.exepowershell.exepowershell.exe

pid	process
1728	UTR400620101111.exe
1728	UTR400620101111.exe
1728	UTR400620101111.exe
1728	UTR400620101111.exe
1728	UTR400620101111.exe
1728	UTR400620101111.exe
1728	UTR400620101111.exe
2976	powershell.exe
2604	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

UTR400620101111.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1728	UTR400620101111.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

UTR400620101111.exe

pid process

2692 UTR400620101111.exe

pid	process
2692	UTR400620101111.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

UTR400620101111.exe

description	pid	process	target process
PID 1728 wrote to memory of 2976	1728	UTR400620101111.exe	powershell.exe
PID 1728 wrote to memory of 2976	1728	UTR400620101111.exe	powershell.exe
PID 1728 wrote to memory of 2976	1728	UTR400620101111.exe	powershell.exe
PID 1728 wrote to memory of 2976	1728	UTR400620101111.exe	powershell.exe
PID 1728 wrote to memory of 2604	1728	UTR400620101111.exe	powershell.exe
PID 1728 wrote to memory of 2604	1728	UTR400620101111.exe	powershell.exe
PID 1728 wrote to memory of 2604	1728	UTR400620101111.exe	powershell.exe
PID 1728 wrote to memory of 2604	1728	UTR400620101111.exe	powershell.exe
PID 1728 wrote to memory of 2940	1728	UTR400620101111.exe	schtasks.exe
PID 1728 wrote to memory of 2940	1728	UTR400620101111.exe	schtasks.exe
PID 1728 wrote to memory of 2940	1728	UTR400620101111.exe	schtasks.exe
PID 1728 wrote to memory of 2940	1728	UTR400620101111.exe	schtasks.exe
PID 1728 wrote to memory of 2692	1728	UTR400620101111.exe	UTR400620101111.exe
PID 1728 wrote to memory of 2692	1728	UTR400620101111.exe	UTR400620101111.exe
PID 1728 wrote to memory of 2692	1728	UTR400620101111.exe	UTR400620101111.exe
PID 1728 wrote to memory of 2692	1728	UTR400620101111.exe	UTR400620101111.exe
PID 1728 wrote to memory of 2692	1728	UTR400620101111.exe	UTR400620101111.exe
PID 1728 wrote to memory of 2692	1728	UTR400620101111.exe	UTR400620101111.exe
PID 1728 wrote to memory of 2692	1728	UTR400620101111.exe	UTR400620101111.exe
PID 1728 wrote to memory of 2692	1728	UTR400620101111.exe	UTR400620101111.exe
PID 1728 wrote to memory of 2692	1728	UTR400620101111.exe	UTR400620101111.exe
PID 1728 wrote to memory of 2692	1728	UTR400620101111.exe	UTR400620101111.exe

C:\Users\Admin\AppData\Local\Temp\UTR400620101111.exe
"C:\Users\Admin\AppData\Local\Temp\UTR400620101111.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IgpZyCEcDkYjvK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5F11.tmp"
2⤵
- Creates scheduled task(s)
PID:2940

C:\Users\Admin\AppData\Local\Temp\UTR400620101111.exe
"C:\Users\Admin\AppData\Local\Temp\UTR400620101111.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:2692

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IgpZyCEcDkYjvK.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2604

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\UTR400620101111.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2976

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5F11.tmp
Filesize
1KB

MD5
4993a4d38d3cfe8f0e51f0b875bdcf54

SHA1
e61801ebf8b8ba73089d85230a090b8e1cf71ec5

SHA256
9dbb993e225a05d86f85b92d6d0c0d9ff4bf426984ea1845845ed7f4ab2856ec

SHA512
8bd282e3b369046f7e9e41bf65ef29b0025449ee551b3340cbab2e5e8f2016607005e9502ebe12ded023cc4a255d57665523edb28fc15f9f540873f82cde9024

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\I1763ADW26CV0DS9FGXG.temp
Filesize
7KB

MD5
ac243884deb94a38a91e24650ad366db

SHA1
35412b39c5a9ceeee4ee80c9a0de5c11cab840b4

SHA256
83ad0481d55ad4e9799e9e6ebf9da7ad895fe50fe6bd25ddf05e0969b828e6bf

SHA512
4b3a7cff8c5a96ea6fc03dc4804005a80fbac27dc96f838a4f9e13f18f29f9635847f18832fc0689cd068bcf599bc075648fa6f9809cc72e7f6d45b497e29e4d

Download Submit
memory/1728-5-0x00000000009F0000-0x00000000009FE000-memory.dmp

Filesize
56KB

Download
memory/1728-0-0x0000000000F20000-0x0000000000FD2000-memory.dmp

Filesize
712KB

Download
memory/1728-32-0x0000000074C80000-0x000000007536E000-memory.dmp

Filesize
6.9MB

Download
memory/1728-4-0x00000000009E0000-0x00000000009EA000-memory.dmp

Filesize
40KB

Download
memory/1728-6-0x0000000005570000-0x00000000055D0000-memory.dmp

Filesize
384KB

Download
memory/1728-7-0x0000000074C80000-0x000000007536E000-memory.dmp

Filesize
6.9MB

Download
memory/1728-2-0x0000000000E70000-0x0000000000EB0000-memory.dmp

Filesize
256KB

Download
memory/1728-3-0x0000000000620000-0x0000000000634000-memory.dmp

Filesize
80KB

Download
memory/1728-1-0x0000000074C80000-0x000000007536E000-memory.dmp

Filesize
6.9MB

Download
memory/1728-28-0x0000000000E70000-0x0000000000EB0000-memory.dmp

Filesize
256KB

Download
memory/2604-37-0x000000006FCB0000-0x000000007025B000-memory.dmp

Filesize
5.7MB

Download
memory/2604-40-0x000000006FCB0000-0x000000007025B000-memory.dmp

Filesize
5.7MB

Download
memory/2604-38-0x0000000001DC0000-0x0000000001E00000-memory.dmp

Filesize
256KB

Download
memory/2604-45-0x000000006FCB0000-0x000000007025B000-memory.dmp

Filesize
5.7MB

Download
memory/2604-43-0x0000000001DC0000-0x0000000001E00000-memory.dmp

Filesize
256KB

Download
memory/2604-42-0x0000000001DC0000-0x0000000001E00000-memory.dmp

Filesize
256KB

Download
memory/2692-46-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2692-52-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2692-61-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2692-33-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2692-60-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2692-31-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2692-29-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2692-59-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2692-24-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2692-23-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2692-22-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2692-21-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2692-20-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2692-35-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2692-47-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2692-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2692-50-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2692-49-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2692-53-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2692-58-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2692-55-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2692-54-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2692-57-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2692-56-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2976-41-0x000000006FCB0000-0x000000007025B000-memory.dmp

Filesize
5.7MB

Download
memory/2976-36-0x000000006FCB0000-0x000000007025B000-memory.dmp

Filesize
5.7MB

Download
memory/2976-39-0x00000000029E0000-0x0000000002A20000-memory.dmp

Filesize
256KB

Download
memory/2976-44-0x000000006FCB0000-0x000000007025B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads