remcos | a605d51f7da78056ad5a2922d08b852b905acfe17f052156338b5df58c6a6b76

General

Target

c241c794d9907434ffb83508ea0f5eeb.exe
Size

404KB
MD5

c241c794d9907434ffb83508ea0f5eeb
SHA1

9083b8bfc8c5e94ed517134fb9ea9e798fb10ab3
SHA256

a605d51f7da78056ad5a2922d08b852b905acfe17f052156338b5df58c6a6b76
SHA512

21cbded7587d58a78ea453b82f907b149f9193c9fd3fb977739920ec0c3b2120ce9afaf318d29ff0f72858b62b5afd64e06cb8237256a094a345ea334517432c
SSDEEP

6144:m//Ic8/hZ8lsQ2fTQqOqIrIOmGCMdxT/y03RrAC1Hatc9cq7:mp8cQTQqOJrIOLdB/yoREC1HIi5

Score

10^/10

remcos host persistence rat upx

Malware Config

Extracted

Family

remcos

Botnet

Host

C2

185.140.53.37:1900

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%WinDir%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
remcos_ewbkendenhpkpep
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

185.140.53.37:1900

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%WinDir%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
remcos_ewbkendenhpkpep
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 2 IoCs

Processes:

remcos.exeremcos.exe

pid process

2080 remcos.exe
2832 remcos.exe
Loads dropped DLL 3 IoCs

Processes:

cmd.exeremcos.exe

pid process

2612 cmd.exe
2612 cmd.exe
2080 remcos.exe

pid	process
2080	remcos.exe
2832	remcos.exe

pid	process
2612	cmd.exe
2612	cmd.exe
2080	remcos.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2080-35-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
C:\Windows\remcos\remcos.exe	upx
behavioral1/memory/2080-26-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral1/memory/2612-23-0x00000000001B0000-0x0000000000265000-memory.dmp	upx
behavioral1/memory/2980-5-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral1/memory/2980-0-0x0000000000400000-0x00000000004B5000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

c241c794d9907434ffb83508ea0f5eeb.exeremcos.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Windows\\remcos\\remcos.exe\""	c241c794d9907434ffb83508ea0f5eeb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Windows\\remcos\\remcos.exe\""	remcos.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

c241c794d9907434ffb83508ea0f5eeb.exeremcos.exe

description	pid	process	target process
PID 2980 set thread context of 1524	2980	c241c794d9907434ffb83508ea0f5eeb.exe	c241c794d9907434ffb83508ea0f5eeb.exe
PID 2080 set thread context of 2832	2080	remcos.exe	remcos.exe

Drops file in Windows directory 2 IoCs

Processes:

c241c794d9907434ffb83508ea0f5eeb.exe

description	ioc	process
File opened for modification	C:\Windows\remcos\remcos.exe	c241c794d9907434ffb83508ea0f5eeb.exe
File created	C:\Windows\remcos\remcos.exe	c241c794d9907434ffb83508ea0f5eeb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2728 PING.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

c241c794d9907434ffb83508ea0f5eeb.exeremcos.exe

pid process

2980 c241c794d9907434ffb83508ea0f5eeb.exe
2080 remcos.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

c241c794d9907434ffb83508ea0f5eeb.exeremcos.exe

pid process

2980 c241c794d9907434ffb83508ea0f5eeb.exe
2080 remcos.exe

pid	process
2728	PING.EXE

pid	process
2980	c241c794d9907434ffb83508ea0f5eeb.exe
2080	remcos.exe

pid	process
2980	c241c794d9907434ffb83508ea0f5eeb.exe
2080	remcos.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

c241c794d9907434ffb83508ea0f5eeb.exec241c794d9907434ffb83508ea0f5eeb.execmd.exeremcos.exe

description	pid	process	target process
PID 2980 wrote to memory of 1524	2980	c241c794d9907434ffb83508ea0f5eeb.exe	c241c794d9907434ffb83508ea0f5eeb.exe
PID 2980 wrote to memory of 1524	2980	c241c794d9907434ffb83508ea0f5eeb.exe	c241c794d9907434ffb83508ea0f5eeb.exe
PID 2980 wrote to memory of 1524	2980	c241c794d9907434ffb83508ea0f5eeb.exe	c241c794d9907434ffb83508ea0f5eeb.exe
PID 2980 wrote to memory of 1524	2980	c241c794d9907434ffb83508ea0f5eeb.exe	c241c794d9907434ffb83508ea0f5eeb.exe
PID 1524 wrote to memory of 2612	1524	c241c794d9907434ffb83508ea0f5eeb.exe	cmd.exe
PID 1524 wrote to memory of 2612	1524	c241c794d9907434ffb83508ea0f5eeb.exe	cmd.exe
PID 1524 wrote to memory of 2612	1524	c241c794d9907434ffb83508ea0f5eeb.exe	cmd.exe
PID 1524 wrote to memory of 2612	1524	c241c794d9907434ffb83508ea0f5eeb.exe	cmd.exe
PID 1524 wrote to memory of 2612	1524	c241c794d9907434ffb83508ea0f5eeb.exe	cmd.exe
PID 1524 wrote to memory of 2612	1524	c241c794d9907434ffb83508ea0f5eeb.exe	cmd.exe
PID 1524 wrote to memory of 2612	1524	c241c794d9907434ffb83508ea0f5eeb.exe	cmd.exe
PID 2612 wrote to memory of 2728	2612	cmd.exe	PING.EXE
PID 2612 wrote to memory of 2728	2612	cmd.exe	PING.EXE
PID 2612 wrote to memory of 2728	2612	cmd.exe	PING.EXE
PID 2612 wrote to memory of 2728	2612	cmd.exe	PING.EXE
PID 2612 wrote to memory of 2080	2612	cmd.exe	remcos.exe
PID 2612 wrote to memory of 2080	2612	cmd.exe	remcos.exe
PID 2612 wrote to memory of 2080	2612	cmd.exe	remcos.exe
PID 2612 wrote to memory of 2080	2612	cmd.exe	remcos.exe
PID 2080 wrote to memory of 2832	2080	remcos.exe	remcos.exe
PID 2080 wrote to memory of 2832	2080	remcos.exe	remcos.exe
PID 2080 wrote to memory of 2832	2080	remcos.exe	remcos.exe
PID 2080 wrote to memory of 2832	2080	remcos.exe	remcos.exe

C:\Users\Admin\AppData\Local\Temp\c241c794d9907434ffb83508ea0f5eeb.exe
"C:\Users\Admin\AppData\Local\Temp\c241c794d9907434ffb83508ea0f5eeb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2980

C:\Users\Admin\AppData\Local\Temp\c241c794d9907434ffb83508ea0f5eeb.exe
"C:\Users\Admin\AppData\Local\Temp\c241c794d9907434ffb83508ea0f5eeb.exe"
2⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612

C:\Windows\SysWOW64\PING.EXE
PING 127.0.0.1 -n 2
4⤵
- Runs ping.exe
PID:2728

C:\Windows\remcos\remcos.exe
"C:\Windows\remcos\remcos.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2080

C:\Windows\remcos\remcos.exe
"C:\Windows\remcos\remcos.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
PID:2832

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.bat
Filesize
79B

MD5
e31c5298e512a57c08e540781b438406

SHA1
518d7fceb915e513207e90e9881f732b38cdaddc

SHA256
90c22d29540b16f794cd58a9153c03dd96a0541851f875b549273c2ffdc63a36

SHA512
828530316d7fce6f44b91f026878b0d46cc55a4d8cb6d5c2aa7e7d1f00b3f442578acd1b2ed1199b1ca70177bf08a3ed235508aa0bedfe079d13349c1619e8b7

Download Submit
C:\Windows\remcos\remcos.exe
Filesize
404KB

MD5
c241c794d9907434ffb83508ea0f5eeb

SHA1
9083b8bfc8c5e94ed517134fb9ea9e798fb10ab3

SHA256
a605d51f7da78056ad5a2922d08b852b905acfe17f052156338b5df58c6a6b76

SHA512
21cbded7587d58a78ea453b82f907b149f9193c9fd3fb977739920ec0c3b2120ce9afaf318d29ff0f72858b62b5afd64e06cb8237256a094a345ea334517432c

Download Submit
memory/1524-2-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1524-7-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1524-10-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1524-19-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2080-27-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2080-35-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2080-36-0x00000000036E0000-0x00000000036F7000-memory.dmp

Filesize
92KB

Download
memory/2080-29-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/2080-33-0x00000000036E0000-0x0000000003795000-memory.dmp

Filesize
724KB

Download
memory/2080-26-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2612-23-0x00000000001B0000-0x0000000000265000-memory.dmp

Filesize
724KB

Download
memory/2832-37-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2832-34-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2832-39-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2832-42-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2832-44-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2832-47-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2832-49-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2980-5-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2980-4-0x0000000001F30000-0x0000000001F3B000-memory.dmp

Filesize
44KB

Download
memory/2980-6-0x0000000001F40000-0x0000000001F41000-memory.dmp

Filesize
4KB

Download
memory/2980-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2980-0-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads