remcos | c695d187c552f8dcd820c4d6a419b0c050a664883fd4fcfbd5a5b4df914d61e0

General

Target
1668-89-0x0000000004FA0000-0x0000000004FE0000-memory.exe
Size 256KB
Sample240302-j6versbg2t
SHA256 c695d187c552f8dcd820c4d6a419b0c050a664883fd4fcfbd5a5b4df914d61e0
MD5 49211559d690667fb9e84ac745dd606f
SHA1 7de58d8c1f22e56c9b973164f8b797384b763ba9
SHA512 58370cb2e003dffee26e514782a9e80825a4e1cd95c574adc42e7192005bb63bed50c8a4dc54167e5b180de00a17806aefb0b80cde2b30f3fed232bd3dd2868a
SSDEEP 6144:ehzOv2fM13jsIFShVrNT7P/PDIfDM13jsIFSHNT7P/PkNT7P/PGM13jsIFSaXhzD:e6sM9oIoH1QM9oIoH1M1uM9oIoaX6u
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos happy new month evasion persistence rat trojan

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Happy New Month

C2

arttronova124.duckdns.org:3030

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
Windows Audio Service.exe
copy_folder
Microsoft Media Corp
delete_file
false
hide_file
true
hide_keylog_file
true
install_flag
true
install_path
%WinDir%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Windows Display
keylog_path
%WinDir%
mouse_option
false
mutex
Windows Audio
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
Microsoft Sound EndPoints
take_screenshot_option
true
take_screenshot_time
5
take_screenshot_title
Username;password;proforma;invoice;notepad

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	1668-89-0x0000000004FA0000-0x0000000004FE0000-memory.exe

Executes dropped EXE 1 IoCs

pid	Process
3372	Windows Audio Service.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Sound EndPoints = "\"C:\\Windows\\Microsoft Media Corp\\Windows Audio Service.exe\""	1668-89-0x0000000004FA0000-0x0000000004FE0000-memory.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Sound EndPoints = "\"C:\\Windows\\Microsoft Media Corp\\Windows Audio Service.exe\""	Windows Audio Service.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft Media Corp\Windows Audio Service.exe	1668-89-0x0000000004FA0000-0x0000000004FE0000-memory.exe
File opened for modification	C:\Windows\Microsoft Media Corp	1668-89-0x0000000004FA0000-0x0000000004FE0000-memory.exe
File opened for modification	C:\Windows\Windows Display\logs.dat	Windows Audio Service.exe
File created	C:\Windows\Windows Display\logs.dat	Windows Audio Service.exe
File created	C:\Windows\Microsoft Media Corp\Windows Audio Service.exe	1668-89-0x0000000004FA0000-0x0000000004FE0000-memory.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
4056	reg.exe
4224	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1236	PING.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3372	Windows Audio Service.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3372	Windows Audio Service.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 4964	3936	1668-89-0x0000000004FA0000-0x0000000004FE0000-memory.exe	87
PID 3936 wrote to memory of 4964	3936	1668-89-0x0000000004FA0000-0x0000000004FE0000-memory.exe	87
PID 3936 wrote to memory of 4964	3936	1668-89-0x0000000004FA0000-0x0000000004FE0000-memory.exe	87
PID 4964 wrote to memory of 4056	4964	cmd.exe	89
PID 4964 wrote to memory of 4056	4964	cmd.exe	89
PID 4964 wrote to memory of 4056	4964	cmd.exe	89
PID 3936 wrote to memory of 3336	3936	1668-89-0x0000000004FA0000-0x0000000004FE0000-memory.exe	90
PID 3936 wrote to memory of 3336	3936	1668-89-0x0000000004FA0000-0x0000000004FE0000-memory.exe	90
PID 3936 wrote to memory of 3336	3936	1668-89-0x0000000004FA0000-0x0000000004FE0000-memory.exe	90
PID 3336 wrote to memory of 1236	3336	cmd.exe	92
PID 3336 wrote to memory of 1236	3336	cmd.exe	92
PID 3336 wrote to memory of 1236	3336	cmd.exe	92
PID 3336 wrote to memory of 3372	3336	cmd.exe	96
PID 3336 wrote to memory of 3372	3336	cmd.exe	96
PID 3336 wrote to memory of 3372	3336	cmd.exe	96
PID 3372 wrote to memory of 3676	3372	Windows Audio Service.exe	97
PID 3372 wrote to memory of 3676	3372	Windows Audio Service.exe	97
PID 3372 wrote to memory of 3676	3372	Windows Audio Service.exe	97
PID 3372 wrote to memory of 5100	3372	Windows Audio Service.exe	99
PID 3372 wrote to memory of 5100	3372	Windows Audio Service.exe	99
PID 3372 wrote to memory of 5100	3372	Windows Audio Service.exe	99
PID 3676 wrote to memory of 4224	3676	cmd.exe	100
PID 3676 wrote to memory of 4224	3676	cmd.exe	100
PID 3676 wrote to memory of 4224	3676	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\1668-89-0x0000000004FA0000-0x0000000004FE0000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1668-89-0x0000000004FA0000-0x0000000004FE0000-memory.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Windows\SysWOW64\cmd.exe
  /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - Modifies registry key
    PID:4056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Windows\SysWOW64\PING.EXE
    PING 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:1236
- - C:\Windows\Microsoft Media Corp\Windows Audio Service.exe
    "C:\Windows\Microsoft Media Corp\Windows Audio Service.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Windows\SysWOW64\cmd.exe
      /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3676
    - - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        UAC bypass
        Modifies registry key
        
        PID:4224
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
      4⤵
      PID:5100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install.bat

Path C:\Users\Admin\AppData\Local\Temp\install.bat
Size 108B
SHA256 62628e6b2fe6ad893b3cd688da49c6eec67266c6a00508f4f9c189bef4e09f4a
MD5 5478adcfef5625fa418c0b5e82aeb720
SHA1 fed6821b291318efc380c19b983b31e287559981
SHA512 91eb838fca8304948382e84d8cb5c3187aab74ed416137ff183ac8797289e27d5ea609429437fb8e6839ddf23f6217a379a5991c6bc95a72c43720bc74e6fb0c
MD5 SHA1 SHA512

Submit Download

Windows Audio Service.exe

Path C:\Windows\Microsoft Media Corp\Windows Audio Service.exe
Size 256KB
SHA256 c695d187c552f8dcd820c4d6a419b0c050a664883fd4fcfbd5a5b4df914d61e0
MD5 49211559d690667fb9e84ac745dd606f
SHA1 7de58d8c1f22e56c9b973164f8b797384b763ba9
SHA512 58370cb2e003dffee26e514782a9e80825a4e1cd95c574adc42e7192005bb63bed50c8a4dc54167e5b180de00a17806aefb0b80cde2b30f3fed232bd3dd2868a
SSDEEP 6144:ehzOv2fM13jsIFShVrNT7P/PDIfDM13jsIFSHNT7P/PkNT7P/PGM13jsIFSaXhzD:e6sM9oIoH1QM9oIoH1M1uM9oIoaX6u
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads