remcos | a605d51f7da78056ad5a2922d08b852b905acfe17f052156338b5df58c6a6b76

General

Target

c241c794d9907434ffb83508ea0f5eeb.exe
Size

404KB
MD5

c241c794d9907434ffb83508ea0f5eeb
SHA1

9083b8bfc8c5e94ed517134fb9ea9e798fb10ab3
SHA256

a605d51f7da78056ad5a2922d08b852b905acfe17f052156338b5df58c6a6b76
SHA512

21cbded7587d58a78ea453b82f907b149f9193c9fd3fb977739920ec0c3b2120ce9afaf318d29ff0f72858b62b5afd64e06cb8237256a094a345ea334517432c
SSDEEP

6144:m//Ic8/hZ8lsQ2fTQqOqIrIOmGCMdxT/y03RrAC1Hatc9cq7:mp8cQTQqOJrIOLdB/yoREC1HIi5

Score

10^/10

remcos host persistence rat upx

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

185.140.53.37:1900

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%WinDir%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
keylog_path
%AppData%
mouse_option
false
mutex
remcos_ewbkendenhpkpep
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

c241c794d9907434ffb83508ea0f5eeb.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	c241c794d9907434ffb83508ea0f5eeb.exe

Executes dropped EXE 2 IoCs

Processes:

remcos.exeremcos.exe

pid process

4124 remcos.exe
464 remcos.exe

pid	process
4124	remcos.exe
464	remcos.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2320-0-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
behavioral2/memory/2320-6-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
C:\Windows\remcos\remcos.exe	upx
behavioral2/memory/4124-19-0x0000000000400000-0x00000000004B5000-memory.dmp	upx
C:\Windows\remcos\remcos.exe	upx
behavioral2/memory/4124-25-0x0000000000400000-0x00000000004B5000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

c241c794d9907434ffb83508ea0f5eeb.exeremcos.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Windows\\remcos\\remcos.exe\""	c241c794d9907434ffb83508ea0f5eeb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Windows\\remcos\\remcos.exe\""	remcos.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

c241c794d9907434ffb83508ea0f5eeb.exeremcos.exe

description	pid	process	target process
PID 2320 set thread context of 4440	2320	c241c794d9907434ffb83508ea0f5eeb.exe	c241c794d9907434ffb83508ea0f5eeb.exe
PID 4124 set thread context of 464	4124	remcos.exe	remcos.exe

Drops file in Windows directory 2 IoCs

Processes:

c241c794d9907434ffb83508ea0f5eeb.exe

description	ioc	process
File created	C:\Windows\remcos\remcos.exe	c241c794d9907434ffb83508ea0f5eeb.exe
File opened for modification	C:\Windows\remcos\remcos.exe	c241c794d9907434ffb83508ea0f5eeb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3524 PING.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

c241c794d9907434ffb83508ea0f5eeb.exeremcos.exe

pid process

2320 c241c794d9907434ffb83508ea0f5eeb.exe
2320 c241c794d9907434ffb83508ea0f5eeb.exe
4124 remcos.exe
4124 remcos.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

c241c794d9907434ffb83508ea0f5eeb.exeremcos.exe

pid process

2320 c241c794d9907434ffb83508ea0f5eeb.exe
4124 remcos.exe

pid	process
3524	PING.EXE

pid	process
2320	c241c794d9907434ffb83508ea0f5eeb.exe
2320	c241c794d9907434ffb83508ea0f5eeb.exe
4124	remcos.exe
4124	remcos.exe

pid	process
2320	c241c794d9907434ffb83508ea0f5eeb.exe
4124	remcos.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

c241c794d9907434ffb83508ea0f5eeb.exec241c794d9907434ffb83508ea0f5eeb.execmd.exeremcos.exe

description	pid	process	target process
PID 2320 wrote to memory of 4440	2320	c241c794d9907434ffb83508ea0f5eeb.exe	c241c794d9907434ffb83508ea0f5eeb.exe
PID 2320 wrote to memory of 4440	2320	c241c794d9907434ffb83508ea0f5eeb.exe	c241c794d9907434ffb83508ea0f5eeb.exe
PID 2320 wrote to memory of 4440	2320	c241c794d9907434ffb83508ea0f5eeb.exe	c241c794d9907434ffb83508ea0f5eeb.exe
PID 4440 wrote to memory of 3840	4440	c241c794d9907434ffb83508ea0f5eeb.exe	cmd.exe
PID 4440 wrote to memory of 3840	4440	c241c794d9907434ffb83508ea0f5eeb.exe	cmd.exe
PID 4440 wrote to memory of 3840	4440	c241c794d9907434ffb83508ea0f5eeb.exe	cmd.exe
PID 3840 wrote to memory of 3524	3840	cmd.exe	PING.EXE
PID 3840 wrote to memory of 3524	3840	cmd.exe	PING.EXE
PID 3840 wrote to memory of 3524	3840	cmd.exe	PING.EXE
PID 3840 wrote to memory of 4124	3840	cmd.exe	remcos.exe
PID 3840 wrote to memory of 4124	3840	cmd.exe	remcos.exe
PID 3840 wrote to memory of 4124	3840	cmd.exe	remcos.exe
PID 4124 wrote to memory of 464	4124	remcos.exe	remcos.exe
PID 4124 wrote to memory of 464	4124	remcos.exe	remcos.exe
PID 4124 wrote to memory of 464	4124	remcos.exe	remcos.exe

C:\Users\Admin\AppData\Local\Temp\c241c794d9907434ffb83508ea0f5eeb.exe
"C:\Users\Admin\AppData\Local\Temp\c241c794d9907434ffb83508ea0f5eeb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2320

C:\Users\Admin\AppData\Local\Temp\c241c794d9907434ffb83508ea0f5eeb.exe
"C:\Users\Admin\AppData\Local\Temp\c241c794d9907434ffb83508ea0f5eeb.exe"
2⤵
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4440

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\install.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:3840

C:\Windows\SysWOW64\PING.EXE
PING 127.0.0.1 -n 2
4⤵
- Runs ping.exe
PID:3524

C:\Windows\remcos\remcos.exe
"C:\Windows\remcos\remcos.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4124

C:\Windows\remcos\remcos.exe
"C:\Windows\remcos\remcos.exe"
5⤵
- Executes dropped EXE
- Adds Run key to start application
PID:464

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.bat
Filesize
79B

MD5
e31c5298e512a57c08e540781b438406

SHA1
518d7fceb915e513207e90e9881f732b38cdaddc

SHA256
90c22d29540b16f794cd58a9153c03dd96a0541851f875b549273c2ffdc63a36

SHA512
828530316d7fce6f44b91f026878b0d46cc55a4d8cb6d5c2aa7e7d1f00b3f442578acd1b2ed1199b1ca70177bf08a3ed235508aa0bedfe079d13349c1619e8b7

Download Submit
C:\Windows\remcos\remcos.exe
Filesize
404KB

MD5
c241c794d9907434ffb83508ea0f5eeb

SHA1
9083b8bfc8c5e94ed517134fb9ea9e798fb10ab3

SHA256
a605d51f7da78056ad5a2922d08b852b905acfe17f052156338b5df58c6a6b76

SHA512
21cbded7587d58a78ea453b82f907b149f9193c9fd3fb977739920ec0c3b2120ce9afaf318d29ff0f72858b62b5afd64e06cb8237256a094a345ea334517432c

Download Submit
C:\Windows\remcos\remcos.exe
Filesize
62KB

MD5
2d99a69613840db9fdce8aaf9220012c

SHA1
63292201aba3a30579d86172c28026f8e7ee54e0

SHA256
effd91c8ba6caf4b270d03d88a84639650bd8939fb3d6bef1ba4fcafff61005e

SHA512
1647d2de2f8ead5f8050a9146b4b896d7e8c9569f59a8e02cfdb5a6308adf7b07a4cdb2bef41938601597b624c3d7765d8a34351c42036f00b2d937e8407df64

Download Submit
memory/464-28-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/464-26-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/464-40-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/464-38-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/464-35-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/464-33-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/464-30-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/464-27-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2320-3-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/2320-1-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Filesize
4KB

Download
memory/2320-2-0x0000000002420000-0x000000000242B000-memory.dmp

Filesize
44KB

Download
memory/2320-0-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/2320-6-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4124-25-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4124-21-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/4124-19-0x0000000000400000-0x00000000004B5000-memory.dmp

Filesize
724KB

Download
memory/4124-20-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/4440-4-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4440-14-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4440-8-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4440-7-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads