remcos | c5f6ee32772795855cd46bccd2244c618d6dc848e2afcb5505bf6a6924495199

General

Target
Docx 000512849361284512251697741528.exe
Size 1023.9MB
Sample240301-wqa3eabc68
SHA256 484e4f62c109300d3640cc2311c6aacd1260a40edf377535dbc04d6d9c41f312
MD5 a3a743966f2964c4f4b8276651a2283d
SHA1 713b9f11578f0f893716d23ddc9482883909fc1e
SHA512 14d44084a7847ac7d8fadb5b90c5c95cb497d87d70a892b9b60ff3fda268d6bcfcf5dec8422e7bc0afee4baef1584efb9fafcd2b8ae49c325cb17ed49042ed91
SSDEEP 12288:xNKz+fhEBtw5I7liKstJTQJMS6zuApDt4:xNKz+W6jtBQDNA1t4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos marmol rat

Malware Config

Extracted

Family

remcos

Botnet

MARMOL

C2

febrero29.con-ip.com:7770

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-FY6FCA
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2780 set thread context of 2252	2780	Docx 000512849361284512251697741528.exe	94

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1484	2252	WerFault.exe	94

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4004	schtasks.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2252	2780	Docx 000512849361284512251697741528.exe	94
PID 2780 wrote to memory of 2252	2780	Docx 000512849361284512251697741528.exe	94
PID 2780 wrote to memory of 2252	2780	Docx 000512849361284512251697741528.exe	94
PID 2780 wrote to memory of 2252	2780	Docx 000512849361284512251697741528.exe	94
PID 2780 wrote to memory of 2252	2780	Docx 000512849361284512251697741528.exe	94
PID 2780 wrote to memory of 2252	2780	Docx 000512849361284512251697741528.exe	94
PID 2780 wrote to memory of 2252	2780	Docx 000512849361284512251697741528.exe	94
PID 2780 wrote to memory of 2252	2780	Docx 000512849361284512251697741528.exe	94
PID 2780 wrote to memory of 2252	2780	Docx 000512849361284512251697741528.exe	94
PID 2780 wrote to memory of 2252	2780	Docx 000512849361284512251697741528.exe	94
PID 2780 wrote to memory of 2252	2780	Docx 000512849361284512251697741528.exe	94
PID 2780 wrote to memory of 2252	2780	Docx 000512849361284512251697741528.exe	94
PID 2780 wrote to memory of 2372	2780	Docx 000512849361284512251697741528.exe	95
PID 2780 wrote to memory of 2372	2780	Docx 000512849361284512251697741528.exe	95
PID 2780 wrote to memory of 2372	2780	Docx 000512849361284512251697741528.exe	95
PID 2780 wrote to memory of 3356	2780	Docx 000512849361284512251697741528.exe	98
PID 2780 wrote to memory of 3356	2780	Docx 000512849361284512251697741528.exe	98
PID 2780 wrote to memory of 3356	2780	Docx 000512849361284512251697741528.exe	98
PID 2780 wrote to memory of 916	2780	Docx 000512849361284512251697741528.exe	99
PID 2780 wrote to memory of 916	2780	Docx 000512849361284512251697741528.exe	99
PID 2780 wrote to memory of 916	2780	Docx 000512849361284512251697741528.exe	99
PID 3356 wrote to memory of 4004	3356	cmd.exe	102
PID 3356 wrote to memory of 4004	3356	cmd.exe	102
PID 3356 wrote to memory of 4004	3356	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\Docx 000512849361284512251697741528.exe
"C:\Users\Admin\AppData\Local\Temp\Docx 000512849361284512251697741528.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 512
    3⤵
    - Program crash
    PID:1484
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\AppData"
  2⤵
  PID:2372
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\AppData\AppData.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:4004
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\Docx 000512849361284512251697741528.exe" "C:\Users\Admin\AppData\Roaming\AppData\AppData.exe"
  2⤵
  PID:916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2252 -ip 2252
1⤵
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2252-4-0x00000000005B0000-0x0000000000632000-memory.dmp

Download

memory/2252-9-0x00000000005B0000-0x0000000000632000-memory.dmp

Download

memory/2252-14-0x00000000005B0000-0x0000000000632000-memory.dmp

Download

memory/2780-0-0x0000000074F30000-0x00000000756E0000-memory.dmp

Download

memory/2780-1-0x0000000000040000-0x00000000000D6000-memory.dmp

Download

memory/2780-2-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

Download

memory/2780-3-0x0000000005280000-0x0000000005824000-memory.dmp

Download

memory/2780-16-0x0000000074F30000-0x00000000756E0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads