remcos | ba8db0a36c729d98dc09fbd9c7ea62e1b62f5a435318af68bdb846063a325f21

General

Target

My 2023 Tax DocumentsPDF.exe
Size

39KB
MD5

f1b14f71252de9ac763dbfbfbfc8c2dc
SHA1

dcc2dcb26c1649887f1d5ae557a000b5fe34bb98
SHA256

796ea1d27ed5825e300c3c9505a87b2445886623235f3e41258de90ba1604cd5
SHA512

636a32fb8a88a542783aa57fe047b6bca47b2bd23b41b3902671c4e9036c6dbb97576be27fd2395a988653e6b63714277873e077519b4a06cdc5f63d3c4224e0
SSDEEP

768:YRQnUhG5bZDOTpkdD82YbQkRFokFWIILPUh:FWObZDOTpk5T6zqAh

Score

10^/10

remcos remotehost persistence rat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

clepdhunt.duckdns.org:4047

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-EN0WTA
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Blocklisted process makes network request 3 IoCs

Processes:

WScript.exe

flow pid process

32 1060 WScript.exe
34 1060 WScript.exe
38 1060 WScript.exe

flow	pid	process
32	1060	WScript.exe
34	1060	WScript.exe
38	1060	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

My 2023 Tax DocumentsPDF.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	My 2023 Tax DocumentsPDF.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*Chrome = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\VIVA_01.dll,EntryPoint"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

My 2023 Tax DocumentsPDF.exe

description pid process target process

PID 3352 set thread context of 1588 3352 My 2023 Tax DocumentsPDF.exe My 2023 Tax DocumentsPDF.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

My 2023 Tax DocumentsPDF.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings My 2023 Tax DocumentsPDF.exe

description	pid	process	target process
PID 3352 set thread context of 1588	3352	My 2023 Tax DocumentsPDF.exe	My 2023 Tax DocumentsPDF.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings	My 2023 Tax DocumentsPDF.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

My 2023 Tax DocumentsPDF.execmd.exeMy 2023 Tax DocumentsPDF.exe

description	pid	process	target process
PID 3352 wrote to memory of 1184	3352	My 2023 Tax DocumentsPDF.exe	cmd.exe
PID 3352 wrote to memory of 1184	3352	My 2023 Tax DocumentsPDF.exe	cmd.exe
PID 3352 wrote to memory of 1184	3352	My 2023 Tax DocumentsPDF.exe	cmd.exe
PID 3352 wrote to memory of 1588	3352	My 2023 Tax DocumentsPDF.exe	My 2023 Tax DocumentsPDF.exe
PID 3352 wrote to memory of 1588	3352	My 2023 Tax DocumentsPDF.exe	My 2023 Tax DocumentsPDF.exe
PID 3352 wrote to memory of 1588	3352	My 2023 Tax DocumentsPDF.exe	My 2023 Tax DocumentsPDF.exe
PID 3352 wrote to memory of 1588	3352	My 2023 Tax DocumentsPDF.exe	My 2023 Tax DocumentsPDF.exe
PID 3352 wrote to memory of 1588	3352	My 2023 Tax DocumentsPDF.exe	My 2023 Tax DocumentsPDF.exe
PID 1184 wrote to memory of 4352	1184	cmd.exe	reg.exe
PID 1184 wrote to memory of 4352	1184	cmd.exe	reg.exe
PID 1184 wrote to memory of 4352	1184	cmd.exe	reg.exe
PID 1588 wrote to memory of 1060	1588	My 2023 Tax DocumentsPDF.exe	WScript.exe
PID 1588 wrote to memory of 1060	1588	My 2023 Tax DocumentsPDF.exe	WScript.exe
PID 1588 wrote to memory of 1060	1588	My 2023 Tax DocumentsPDF.exe	WScript.exe
PID 1588 wrote to memory of 5036	1588	My 2023 Tax DocumentsPDF.exe	WScript.exe
PID 1588 wrote to memory of 5036	1588	My 2023 Tax DocumentsPDF.exe	WScript.exe
PID 1588 wrote to memory of 5036	1588	My 2023 Tax DocumentsPDF.exe	WScript.exe
PID 1588 wrote to memory of 2088	1588	My 2023 Tax DocumentsPDF.exe	WScript.exe
PID 1588 wrote to memory of 2088	1588	My 2023 Tax DocumentsPDF.exe	WScript.exe
PID 1588 wrote to memory of 2088	1588	My 2023 Tax DocumentsPDF.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\My 2023 Tax DocumentsPDF.exe
"C:\Users\Admin\AppData\Local\Temp\My 2023 Tax DocumentsPDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3352

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\Admin\AppData\Roaming\VIVA_01.dll",EntryPoint /f & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:1184

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*Chrome" /t REG_SZ /d "rundll32.exe C:\Users\Admin\AppData\Roaming\VIVA_01.dll",EntryPoint /f
3⤵
- Adds Run key to start application
PID:4352

C:\Users\Admin\AppData\Local\Temp\My 2023 Tax DocumentsPDF.exe
"C:\Users\Admin\AppData\Local\Temp\My 2023 Tax DocumentsPDF.exe"
2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1588

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Holding130rd.vbs"
3⤵
- Blocklisted process makes network request
PID:1060

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Memory.vbs"
3⤵
PID:5036

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Holding130rd.vbs"
3⤵
PID:2088

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Holding130rd.vbs
Filesize
5.8MB

MD5
23d7b25f8233971afe7801edb6615eaa

SHA1
dd3e2f1fecc1d18af047045dcba2a73359b7019f

SHA256
ecac17cda633793bbe91741f4e8ec371000d82ba9cfeab0ee79c9a84d9a0a62c

SHA512
090e4e3bb0cfdbda4f40c3ab76d3d11cb95c26e2069a4a05628875eb794f1b48904d353865c51b68c93b9c57d497abcb2a0f837e6611d3fc955511685cc0f3f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Memory.vbs
Filesize
11.2MB

MD5
e95bd9211d202fa0d5cfd86d967e3f28

SHA1
9d4bc96f4239f54868338bd1af65e8ac767bca6e

SHA256
d8cf065a3b13af731193c35c843a6bd272184784e486620d2ba904403ff577cd

SHA512
b906af1a5a946e573f17c9d2032fdc98e14c545a783624a6e3749f671629f063080a0e2507d5569ae3cda8b8db9b48fc79309ebcbd07e7aaf7d052704ac88dd2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FPBMA.vbs
Filesize
276B

MD5
08573053b297406719cdb275f62815c8

SHA1
0d82ae88fc747cfacd3a7fd80cb52d9e7f0eaa2f

SHA256
b89ba728b322bff609cc24052896f31c11091a82296e0351769543437b0788bb

SHA512
6feb1b5a0fee7f3e5d1fb2c76a8a4565e6d6f5441e2e156fbd88ef5324c823a95b2e767f8e2948e899793ba3edcc438f9afdc03fdca8dddb3d7a6537f621505d

Download Submit
memory/1588-4-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/1588-12-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/1588-34-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/1588-7-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/1588-33-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/1588-8-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/1588-9-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/1588-10-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/1588-11-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/1588-5-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/1588-13-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/1588-17-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/1588-2-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/1588-22-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/1588-31-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/1588-27-0x0000000000410000-0x0000000000492000-memory.dmp

Filesize
520KB

Download
memory/3352-3-0x0000000010000000-0x0000000010F92000-memory.dmp

Filesize
15.6MB

Download
memory/3352-6-0x0000000010000000-0x0000000010F92000-memory.dmp

Filesize
15.6MB

Download
memory/3352-0-0x0000000010000000-0x0000000010F92000-memory.dmp

Filesize
15.6MB

Download
memory/3352-1-0x0000000010000000-0x0000000010F92000-memory.dmp

Filesize
15.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads