remcos | 2e368631139e75aa6cce30aef3ccdfe59dc2131a7f5166fa5b0e36c969eb5ada

General

Target

215dc8f3f75f1d67d9b6fcec09cb4d00.exe
Size

888KB
MD5

215dc8f3f75f1d67d9b6fcec09cb4d00
SHA1

b78ba4e1350b1173b1a2457209993f439fa7e199
SHA256

2e368631139e75aa6cce30aef3ccdfe59dc2131a7f5166fa5b0e36c969eb5ada
SHA512

2a094dd055eedbe761e7da1b7eb44e1a4da04eb79a44bbb7b003a6bc31dadd90deb9cee2e101e55dfba72a700681557cc032547e8bea40f6c0bec2fd418e2ede
SSDEEP

24576:R6SNOGucnCSGYVWX54fKQ7ov6pASCDvHKfpket/0Ms20:kyOPE4WoTQa6pA97HqeeC

Score

10^/10

remcos buddy collection rat spyware stealer

Malware Config

Extracted

Family

remcos

Botnet

BUDDY

C2

192.210.201.57:52499

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-LMLI87
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

NirSoft MailPassView 2 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/3872-36-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView
behavioral2/memory/3872-37-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 2 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/1400-35-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView
behavioral2/memory/1400-42-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1400-35-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/3872-36-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/3872-37-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/1400-42-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

215dc8f3f75f1d67d9b6fcec09cb4d00.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	215dc8f3f75f1d67d9b6fcec09cb4d00.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

215dc8f3f75f1d67d9b6fcec09cb4d00.exe215dc8f3f75f1d67d9b6fcec09cb4d00.exe

description	pid	process	target process
PID 4320 set thread context of 2252	4320	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
PID 2252 set thread context of 1400	2252	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
PID 2252 set thread context of 3872	2252	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
PID 2252 set thread context of 2572	2252	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

220 2572 WerFault.exe 215dc8f3f75f1d67d9b6fcec09cb4d00.exe

pid	pid_target	process	target process
220	2572	WerFault.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

215dc8f3f75f1d67d9b6fcec09cb4d00.exe

pid	process
1400	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
1400	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
1400	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
1400	215dc8f3f75f1d67d9b6fcec09cb4d00.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

215dc8f3f75f1d67d9b6fcec09cb4d00.exe

pid process

2252 215dc8f3f75f1d67d9b6fcec09cb4d00.exe
2252 215dc8f3f75f1d67d9b6fcec09cb4d00.exe
2252 215dc8f3f75f1d67d9b6fcec09cb4d00.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

215dc8f3f75f1d67d9b6fcec09cb4d00.exe

pid process

2252 215dc8f3f75f1d67d9b6fcec09cb4d00.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

215dc8f3f75f1d67d9b6fcec09cb4d00.exe

pid process

2572 215dc8f3f75f1d67d9b6fcec09cb4d00.exe

pid	process
2252	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
2252	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
2252	215dc8f3f75f1d67d9b6fcec09cb4d00.exe

pid	process
2252	215dc8f3f75f1d67d9b6fcec09cb4d00.exe

pid	process
2572	215dc8f3f75f1d67d9b6fcec09cb4d00.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

215dc8f3f75f1d67d9b6fcec09cb4d00.exe215dc8f3f75f1d67d9b6fcec09cb4d00.exe

C:\Users\Admin\AppData\Local\Temp\215dc8f3f75f1d67d9b6fcec09cb4d00.exe
"C:\Users\Admin\AppData\Local\Temp\215dc8f3f75f1d67d9b6fcec09cb4d00.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4320

C:\Users\Admin\AppData\Local\Temp\215dc8f3f75f1d67d9b6fcec09cb4d00.exe
"C:\Users\Admin\AppData\Local\Temp\215dc8f3f75f1d67d9b6fcec09cb4d00.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252

C:\Users\Admin\AppData\Local\Temp\215dc8f3f75f1d67d9b6fcec09cb4d00.exe
C:\Users\Admin\AppData\Local\Temp\215dc8f3f75f1d67d9b6fcec09cb4d00.exe /stext "C:\Users\Admin\AppData\Local\Temp\ljtraoztxxosou"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1400

C:\Users\Admin\AppData\Local\Temp\215dc8f3f75f1d67d9b6fcec09cb4d00.exe
C:\Users\Admin\AppData\Local\Temp\215dc8f3f75f1d67d9b6fcec09cb4d00.exe /stext "C:\Users\Admin\AppData\Local\Temp\vlgjahrnlfgfyizwe"
3⤵
- Accesses Microsoft Outlook accounts
PID:3872

C:\Users\Admin\AppData\Local\Temp\215dc8f3f75f1d67d9b6fcec09cb4d00.exe
C:\Users\Admin\AppData\Local\Temp\215dc8f3f75f1d67d9b6fcec09cb4d00.exe /stext "C:\Users\Admin\AppData\Local\Temp\gflcbzcohnykbovavvgt"
3⤵
- Suspicious use of UnmapMainImage
PID:2572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2572 -s 12
4⤵
- Program crash
PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2572 -ip 2572
1⤵
PID:4020

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat
Filesize
144B

MD5
34ada4841b2f4cea278be1817fa6e03a

SHA1
a225aa8ea97dee21223983364503a4496785810d

SHA256
3da9fbd94d2af745279f53cc795c5ea63c22af0147e993b687e68f8ab85c0797

SHA512
0dfbd53d711a5742c3628e6f6fd8d80f1ee955cc855417ece5de6b6a36e4ab483b796d50878a9840a64d026dee70a6b2aa9d00b59d6a30f7e1d757d038b57876

Download Submit
C:\Users\Admin\AppData\Local\Temp\ljtraoztxxosou
Filesize
4KB

MD5
ec0cf9ff722f9a9259c3338972c40886

SHA1
31bad5285affb58c5ebe0569bbdb9bd1deab245c

SHA256
30190665467845aed54732c31c7e385368c10acb595cffdd7ca9523fff051a19

SHA512
bdfaf9576db431d3c4d14e0ea5deafce661fceda6d5123a6f4b84d50a576dd1ccf4202091dc0b55bed665dd45b4e30d2a797bda6015b06f5771064f9bab32d1a

Download Submit
memory/1400-27-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1400-42-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1400-31-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1400-35-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2252-51-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2252-53-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2252-88-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2252-87-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2252-80-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2252-11-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2252-12-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2252-14-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2252-79-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2252-16-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2252-18-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2252-20-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2252-19-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2252-21-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2252-22-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2252-23-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2252-24-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2252-26-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2252-72-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2252-71-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2252-64-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2252-63-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2252-58-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2252-55-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2252-54-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2252-52-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2252-48-0x0000000010000000-0x0000000010019000-memory.dmp

Filesize
100KB

Download
memory/2252-46-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2252-45-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2572-33-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2572-47-0x0000000000390000-0x0000000000390000-memory.dmp

Download
memory/3872-28-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3872-32-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3872-37-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/3872-36-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4320-1-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/4320-5-0x0000000005010000-0x000000000501A000-memory.dmp

Filesize
40KB

Download
memory/4320-7-0x00000000060A0000-0x00000000060AA000-memory.dmp

Filesize
40KB

Download
memory/4320-0-0x0000000000390000-0x0000000000474000-memory.dmp

Filesize
912KB

Download
memory/4320-4-0x0000000004F00000-0x0000000004F10000-memory.dmp

Filesize
64KB

Download
memory/4320-3-0x0000000004F40000-0x0000000004FD2000-memory.dmp

Filesize
584KB

Download
memory/4320-2-0x00000000054F0000-0x0000000005A94000-memory.dmp

Filesize
5.6MB

Download
memory/4320-6-0x00000000052D0000-0x00000000052E4000-memory.dmp

Filesize
80KB

Download
memory/4320-15-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/4320-10-0x00000000088B0000-0x000000000894C000-memory.dmp

Filesize
624KB

Download
memory/4320-9-0x0000000006120000-0x00000000061E0000-memory.dmp

Filesize
768KB

Download
memory/4320-8-0x00000000060B0000-0x00000000060BC000-memory.dmp

Filesize
48KB

Download

description	pid	process	target process
PID 4320 wrote to memory of 2252	4320	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
PID 4320 wrote to memory of 2252	4320	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
PID 4320 wrote to memory of 2252	4320	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
PID 4320 wrote to memory of 2252	4320	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
PID 4320 wrote to memory of 2252	4320	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
PID 4320 wrote to memory of 2252	4320	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
PID 4320 wrote to memory of 2252	4320	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
PID 4320 wrote to memory of 2252	4320	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
PID 4320 wrote to memory of 2252	4320	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
PID 4320 wrote to memory of 2252	4320	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
PID 4320 wrote to memory of 2252	4320	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
PID 4320 wrote to memory of 2252	4320	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
PID 2252 wrote to memory of 1400	2252	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
PID 2252 wrote to memory of 1400	2252	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
PID 2252 wrote to memory of 1400	2252	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
PID 2252 wrote to memory of 1400	2252	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
PID 2252 wrote to memory of 3872	2252	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
PID 2252 wrote to memory of 3872	2252	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
PID 2252 wrote to memory of 3872	2252	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
PID 2252 wrote to memory of 3872	2252	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
PID 2252 wrote to memory of 2572	2252	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
PID 2252 wrote to memory of 2572	2252	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
PID 2252 wrote to memory of 2572	2252	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe
PID 2252 wrote to memory of 2572	2252	215dc8f3f75f1d67d9b6fcec09cb4d00.exe	215dc8f3f75f1d67d9b6fcec09cb4d00.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads