remcos | 49f4cc2bea40cf52315aed5b939de396212e16902e5ea23ff699c372d609cbb2

General

Target
49f4cc2bea40cf52315aed5b939de396212e16902e5ea23ff699c372d609cbb2.exe
Size 469KB
Sample240510-rhb8aadc89
SHA256 49f4cc2bea40cf52315aed5b939de396212e16902e5ea23ff699c372d609cbb2
MD5 95939f7e0943f1428467c77c293e6036
SHA1 892d0c06a2c9377b716e3e456c15fa0a5c2d070a
SHA512 ad55cf00384915a788343eff3b54811050e3964f4c6598515465dce462bce71116fe52d03057ecf202fa08ef405df70c1bf07dfe65ccf37f3e58f16bf6e64f56
SSDEEP 12288:umnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSa3n9:WiLJbpI7I2WhQqZ7m9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos edgeupdater persistence rat

Malware Config

Extracted

Family

remcos

Botnet

EdgeUpdater

C2

rornfl12.duckdns.org:2405

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
Edgeupdater.exe
copy_folder
microsoftEdge
delete_file
false
hide_file
true
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-NZEE04
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Edgeupdater
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	49f4cc2bea40cf52315aed5b939de396212e16902e5ea23ff699c372d609cbb2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Edgeupdater = "\"C:\\ProgramData\\microsoftEdge\\Edgeupdater.exe\""	49f4cc2bea40cf52315aed5b939de396212e16902e5ea23ff699c372d609cbb2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Edgeupdater.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Edgeupdater = "\"C:\\ProgramData\\microsoftEdge\\Edgeupdater.exe\""	Edgeupdater.exe

Executes dropped EXE 1 IoCs

pid	Process
1836	Edgeupdater.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Edgeupdater = "\"C:\\ProgramData\\microsoftEdge\\Edgeupdater.exe\""	Edgeupdater.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Edgeupdater = "\"C:\\ProgramData\\microsoftEdge\\Edgeupdater.exe\""	49f4cc2bea40cf52315aed5b939de396212e16902e5ea23ff699c372d609cbb2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Edgeupdater = "\"C:\\ProgramData\\microsoftEdge\\Edgeupdater.exe\""	49f4cc2bea40cf52315aed5b939de396212e16902e5ea23ff699c372d609cbb2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Edgeupdater = "\"C:\\ProgramData\\microsoftEdge\\Edgeupdater.exe\""	Edgeupdater.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000_Classes\Local Settings	49f4cc2bea40cf52315aed5b939de396212e16902e5ea23ff699c372d609cbb2.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 3360	2368	49f4cc2bea40cf52315aed5b939de396212e16902e5ea23ff699c372d609cbb2.exe	79
PID 2368 wrote to memory of 3360	2368	49f4cc2bea40cf52315aed5b939de396212e16902e5ea23ff699c372d609cbb2.exe	79
PID 2368 wrote to memory of 3360	2368	49f4cc2bea40cf52315aed5b939de396212e16902e5ea23ff699c372d609cbb2.exe	79
PID 3360 wrote to memory of 3888	3360	WScript.exe	82
PID 3360 wrote to memory of 3888	3360	WScript.exe	82
PID 3360 wrote to memory of 3888	3360	WScript.exe	82
PID 3888 wrote to memory of 1836	3888	cmd.exe	84
PID 3888 wrote to memory of 1836	3888	cmd.exe	84
PID 3888 wrote to memory of 1836	3888	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\49f4cc2bea40cf52315aed5b939de396212e16902e5ea23ff699c372d609cbb2.exe
"C:\Users\Admin\AppData\Local\Temp\49f4cc2bea40cf52315aed5b939de396212e16902e5ea23ff699c372d609cbb2.exe"
1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\microsoftEdge\Edgeupdater.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3888
  - - C:\ProgramData\microsoftEdge\Edgeupdater.exe
      C:\ProgramData\microsoftEdge\Edgeupdater.exe
      4⤵
      Adds policy Run key to start application
      Executes dropped EXE
      Adds Run key to start application
      PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Edgeupdater.exe

Path C:\ProgramData\microsoftEdge\Edgeupdater.exe
Size 469KB
SHA256 49f4cc2bea40cf52315aed5b939de396212e16902e5ea23ff699c372d609cbb2
MD5 95939f7e0943f1428467c77c293e6036
SHA1 892d0c06a2c9377b716e3e456c15fa0a5c2d070a
SHA512 ad55cf00384915a788343eff3b54811050e3964f4c6598515465dce462bce71116fe52d03057ecf202fa08ef405df70c1bf07dfe65ccf37f3e58f16bf6e64f56
SSDEEP 12288:umnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSa3n9:WiLJbpI7I2WhQqZ7m9
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 410B
SHA256 1e9cb576fd6e7af381e5e24429a8a514d36aff8ed0f6f579c609cc646cbddcea
MD5 19f4614bb43cdf3e42d786d19a92f4ac
SHA1 bd3fa3595e247387810e31b3d3fd4a08b54dacc7
SHA512 aa9611fa7d87c2237abeb9d23dd03da4250ba4192bdc276f4c6f3c8747ee8cb6768b160e843012d8c550e8c1744cbfb4746b1d928c66495aa08740f55092bcf4
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads