remcos | e5f662cfb991bb883da1cd920b511f4f2d7556c9b1a4e072b74c19457940547e

General

Target

03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe
Size

483KB
MD5

06f5b8dffc6c138828adbc7f29cfc7f0
SHA1

b59ef5d613a1e49c7034c3ee05780ce054ca0054
SHA256

03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7
SHA512

e706a0b3b1981cac8ddcf81482b306b4538fbfbf5c332f2b484f8c503b66d73cd09ffaab0515ecb2063d1e4a27dc30a662cc0be4f5287d2982cfbb47c7dad893
SSDEEP

6144:aXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNx5Gv:aX7tPMK8ctGe4Dzl4h2QnuPs/ZDIcv

Score

10^/10

remcos remote persistence rat

Malware Config

Extracted

Family

remcos

Botnet

Remote

C2

leetboy.dynuddns.net:1998

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
svcs.exe
copy_folder
microsofts
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
true
install_path
%AppData%
keylog_crypt
true
keylog_file
logs.dat
keylog_flag
false
keylog_folder
logsa
mouse_option
false
mutex
Rmc-3XK1S0
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 1 IoCs

Processes:

svcs.exe

pid process

2904 svcs.exe

pid	process
2904	svcs.exe

Loads dropped DLL 2 IoCs

Processes:

03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe

pid	process
1332	03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe
1332	03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exesvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-3XK1S0 = "\"C:\\Users\\Admin\\AppData\\Roaming\\microsofts\\svcs.exe\""	03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-3XK1S0 = "\"C:\\Users\\Admin\\AppData\\Roaming\\microsofts\\svcs.exe\""	03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-3XK1S0 = "\"C:\\Users\\Admin\\AppData\\Roaming\\microsofts\\svcs.exe\""	svcs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-3XK1S0 = "\"C:\\Users\\Admin\\AppData\\Roaming\\microsofts\\svcs.exe\""	svcs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

svcs.exe

pid process

2904 svcs.exe

pid	process
2904	svcs.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe

description	pid	process	target process
PID 1332 wrote to memory of 2904	1332	03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe	svcs.exe
PID 1332 wrote to memory of 2904	1332	03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe	svcs.exe
PID 1332 wrote to memory of 2904	1332	03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe	svcs.exe
PID 1332 wrote to memory of 2904	1332	03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe	svcs.exe

C:\Users\Admin\AppData\Local\Temp\03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe
"C:\Users\Admin\AppData\Local\Temp\03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1332

C:\Users\Admin\AppData\Roaming\microsofts\svcs.exe
"C:\Users\Admin\AppData\Roaming\microsofts\svcs.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:2904

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\logsa\logs.dat
Filesize
144B

MD5
ff4c39f8aa58ca93379c27103b53802b

SHA1
f81265dcec9ef746f4615c474e764827d7443cb6

SHA256
5b481a91654b9b689dea60128ea964ee5a9588df7b44e0bd40597b87e4ea0132

SHA512
0a8cbc48844904493cacecb9352ac34ca2460a4303280cff3e257692b83548cce048ea8b8c67510d539bf3729216558dde54c94387ceb90270a06cb1c3999d79

Download Submit
\Users\Admin\AppData\Roaming\microsofts\svcs.exe
Filesize
483KB

MD5
06f5b8dffc6c138828adbc7f29cfc7f0

SHA1
b59ef5d613a1e49c7034c3ee05780ce054ca0054

SHA256
03ba551339062106448ff58cbc393338483439513ec8439497bf47153e13f4b7

SHA512
e706a0b3b1981cac8ddcf81482b306b4538fbfbf5c332f2b484f8c503b66d73cd09ffaab0515ecb2063d1e4a27dc30a662cc0be4f5287d2982cfbb47c7dad893

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads