remcos | aa4f91582c090e99b67390b61edf78df4525c6f2125c38a2a0b1a925bbe7fab4

General

Target
x1TYUNtEO1zz.exe
Size 469KB
Sample240510-rxz8naea66
SHA256 aa4f91582c090e99b67390b61edf78df4525c6f2125c38a2a0b1a925bbe7fab4
MD5 bd8b7958eeae8d1adf54148d23079863
SHA1 5b48f72267da36089181f175b3ea111dc6274377
SHA512 e494a21740da130d0f79dabde3611f78f5e3874cce59aee8203b1218466e58ac1a9e9483324b58a2c6ea4a7f07ced11497103fe393f931bba47956b7b1ed62e8
SSDEEP 12288:Obmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSan9:uiLJbpI7I2WhQqZ7a9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

remcos nuevos persistence rat

Malware Config

Extracted

Family

remcos

Botnet

Nuevos

C2

nuevosremcs.duckdns.org:9090

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
notepads.exe
copy_folder
data
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
install_path
%AppData%
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
notas
mouse_option
false
mutex
Rmc-LYXPNU
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
system32
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	x1TYUNtEO1zz.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
3204	notepads.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system32 = "\"C:\\Users\\Admin\\AppData\\Roaming\\data\\notepads.exe\""	x1TYUNtEO1zz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system32 = "\"C:\\Users\\Admin\\AppData\\Roaming\\data\\notepads.exe\""	x1TYUNtEO1zz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system32 = "\"C:\\Users\\Admin\\AppData\\Roaming\\data\\notepads.exe\""	notepads.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\system32 = "\"C:\\Users\\Admin\\AppData\\Roaming\\data\\notepads.exe\""	notepads.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	x1TYUNtEO1zz.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3204	notepads.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 4424	4004	x1TYUNtEO1zz.exe	81
PID 4004 wrote to memory of 4424	4004	x1TYUNtEO1zz.exe	81
PID 4004 wrote to memory of 4424	4004	x1TYUNtEO1zz.exe	81
PID 4424 wrote to memory of 1552	4424	WScript.exe	82
PID 4424 wrote to memory of 1552	4424	WScript.exe	82
PID 4424 wrote to memory of 1552	4424	WScript.exe	82
PID 1552 wrote to memory of 3204	1552	cmd.exe	84
PID 1552 wrote to memory of 3204	1552	cmd.exe	84
PID 1552 wrote to memory of 3204	1552	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\x1TYUNtEO1zz.exe
"C:\Users\Admin\AppData\Local\Temp\x1TYUNtEO1zz.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\data\notepads.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1552
  - - C:\Users\Admin\AppData\Roaming\data\notepads.exe
      C:\Users\Admin\AppData\Roaming\data\notepads.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetWindowsHookEx
      PID:3204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\notas\logs.dat
Size 144B
SHA256 15dda1d3edfb9a62ae6cb8b424a8ad2a048edab52cdff248d7a25c6ea27a82f0
MD5 8aef52429755cc7d7019b06917fc54a2
SHA1 d49e47426f0003063d46bf2045fd47074a8d5fec
SHA512 7908d292f89f1723424827d76a6bb5453e91b408af2acf0ebe4ccdbdd606fd956c901f545e372c0150050438bb402fd58f7137d2b4e7226b9fd8594b112e7a3e
MD5 SHA1 SHA512

Submit Download

install.vbs

Path C:\Users\Admin\AppData\Local\Temp\install.vbs
Size 418B
SHA256 1bf4eaa1b06f079565ca6ea81082736efd1e25d6465c353ad992ba8c38940c3f
MD5 1653e8468b0d0cd87a484261da3a898b
SHA1 ab798bd56e8dfebf82b4feda4e1549778d19848b
SHA512 5df77f64350879e22a6b9f018bdd8fcf90920cc9f4026ed9bf733b5e965214abd8c3643b211b2f814cd2a9e016f0c15762eaee133feef6ed5c37bdd66ff7be2f
MD5 SHA1 SHA512

Submit Download

notepads.exe

Path C:\Users\Admin\AppData\Roaming\data\notepads.exe
Size 469KB
SHA256 aa4f91582c090e99b67390b61edf78df4525c6f2125c38a2a0b1a925bbe7fab4
MD5 bd8b7958eeae8d1adf54148d23079863
SHA1 5b48f72267da36089181f175b3ea111dc6274377
SHA512 e494a21740da130d0f79dabde3611f78f5e3874cce59aee8203b1218466e58ac1a9e9483324b58a2c6ea4a7f07ced11497103fe393f931bba47956b7b1ed62e8
SSDEEP 12288:Obmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQSan9:uiLJbpI7I2WhQqZ7a9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads