remcos | e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1

General

Target

e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1.exe
Size

1.7MB
MD5

c779ffff94891ca1070d9a1bcb817bc7
SHA1

f26cf7d8bfb6e6243f64c9134fdc5fc7f4dbd2a6
SHA256

e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1
SHA512

216d800555e6d2d00d4a2e1cf612912701e41eb850571b228715f162daaba1f4f34b1edc1e875cdf89403cfcff4e110f9e05a9e7f53267fe0f165d9b847ddf56
SSDEEP

24576:kqUGqoAb+k8wwE6fibNsRt7Z+rJ+6rWuDBFRlC08a8SLOXEjJUWfsyu9HbZCI9qb:hAb+iwiZqt7ZeI8NLlC08a82dIC

Score

10^/10

remcos nuevo1 persistence rat

Malware Config

Extracted

Family

remcos

Botnet

NUEVO1

C2

robertobarbosalora09.con-ip.com:1880

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-973XCI
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Muhandra = "C:\\Users\\Admin\\Documents\\ChromeUpdate\\cr0wdik.exe"	e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1.exe

pid process

956 e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1.exe

pid process

3696 e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1.exe

pid	process
956	e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1.exe

pid	process
3696	e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1.exe

description	pid	process	target process
PID 956 wrote to memory of 3696	956	e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1.exe	e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1.exe
PID 956 wrote to memory of 3696	956	e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1.exe	e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1.exe
PID 956 wrote to memory of 3696	956	e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1.exe	e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1.exe
PID 956 wrote to memory of 3696	956	e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1.exe	e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1.exe
PID 956 wrote to memory of 3696	956	e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1.exe	e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1.exe
PID 956 wrote to memory of 3696	956	e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1.exe	e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1.exe

C:\Users\Admin\AppData\Local\Temp\e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1.exe
"C:\Users\Admin\AppData\Local\Temp\e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:956

C:\Users\Admin\AppData\Local\Temp\e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1.exe
"C:\Users\Admin\AppData\Local\Temp\e662f5731b7f35cb926136137e52a6a54973b3b603ba6efc62dc5d841d839ae1.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:3696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4060 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:2884

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat
Filesize
144B

MD5
20c594905039096cfcab5f350733ab72

SHA1
2a61a670a92bf1793be2fe93ff62a1bfff1a8dcc

SHA256
f3d5e3c68426bf0a99707a3b70068d82b1e0fdf14db1f7b34e36bf500828940c

SHA512
f215f739d3dfd8b2ae22589e529facab4e9a571fcfe3f3db17f61c2e1a4eefb02b1a91d883788d2ca936de2d6b3d2f2005239798bd33c20775fe25eb43e89602

Download Submit
memory/956-0-0x0000000000400000-0x00000000005B1000-memory.dmp

Filesize
1.7MB

Download
memory/956-1-0x0000000000400000-0x00000000005B1000-memory.dmp

Filesize
1.7MB

Download
memory/956-2-0x0000000000400000-0x00000000005B1000-memory.dmp

Filesize
1.7MB

Download
memory/956-3-0x0000000000400000-0x00000000005B1000-memory.dmp

Filesize
1.7MB

Download
memory/956-8-0x0000000000400000-0x00000000005B1000-memory.dmp

Filesize
1.7MB

Download
memory/3696-7-0x00000000000D0000-0x0000000000152000-memory.dmp

Filesize
520KB

Download
memory/3696-19-0x00000000000D0000-0x0000000000152000-memory.dmp

Filesize
520KB

Download
memory/3696-9-0x00000000000D0000-0x0000000000152000-memory.dmp

Filesize
520KB

Download
memory/3696-10-0x00000000000D0000-0x0000000000152000-memory.dmp

Filesize
520KB

Download
memory/3696-12-0x00000000000D0000-0x0000000000152000-memory.dmp

Filesize
520KB

Download
memory/3696-13-0x00000000000D0000-0x0000000000152000-memory.dmp

Filesize
520KB

Download
memory/3696-14-0x00000000000D0000-0x0000000000152000-memory.dmp

Filesize
520KB

Download
memory/3696-17-0x00000000000D0000-0x0000000000152000-memory.dmp

Filesize
520KB

Download
memory/3696-18-0x00000000000D0000-0x0000000000152000-memory.dmp

Filesize
520KB

Download
memory/3696-6-0x00000000000D0000-0x0000000000152000-memory.dmp

Filesize
520KB

Download
memory/3696-21-0x00000000000D0000-0x0000000000152000-memory.dmp

Filesize
520KB

Download
memory/3696-24-0x00000000000D0000-0x0000000000152000-memory.dmp

Filesize
520KB

Download
memory/3696-4-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/3696-27-0x00000000000D0000-0x0000000000152000-memory.dmp

Filesize
520KB

Download
memory/3696-28-0x00000000000D0000-0x0000000000152000-memory.dmp

Filesize
520KB

Download
memory/3696-35-0x00000000000D0000-0x0000000000152000-memory.dmp

Filesize
520KB

Download
memory/3696-43-0x00000000000D0000-0x0000000000152000-memory.dmp

Filesize
520KB

Download
memory/3696-44-0x00000000000D0000-0x0000000000152000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads