remcos | 47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159

General

Target

47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe
Size

964KB
MD5

0eaba88fca68eff352d2cd9b693ddda3
SHA1

ee8ff1dc367c5f3ee33f93b2a120475b84a14a96
SHA256

47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159
SHA512

09c0327dab156625de632cc5a67c9fefc889fe823230ff482e801d79fa71d9da5be3d4a4b889e95932cbf89108accfc061f656d89be16f6f0aed043e9151195b
SSDEEP

24576:IUpp36RouMMf0wB62Q01KXnotjk8QocG6ahxGne3yu/9SZ:DppAoU8w42Q0UXnotgFBQk

Score

10^/10

remcos 76364 execution rat

Malware Config

Extracted

Family

remcos

Botnet

76364

C2

103.150.8.12:5689

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-FF0K7G
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2640 powershell.exe

pid	process
2640	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe

description	pid	process	target process
PID 2480 set thread context of 2276	2480	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2708 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2640 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2640 powershell.exe

pid	process
2708	schtasks.exe

pid	process
2640	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2640	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe

C:\Users\Admin\AppData\Local\Temp\47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe
"C:\Users\Admin\AppData\Local\Temp\47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zeGjhC.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2640
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zeGjhC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4D55.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2708
- C:\Users\Admin\AppData\Local\Temp\47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe
  "C:\Users\Admin\AppData\Local\Temp\47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe"
  2⤵
  PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4D55.tmp

Filesize
1KB

MD5
a40d4ee7b412c3a6e1e913ac486da158

SHA1
1e3944ff78ef0437c5abc35d638d2958e84f5d23

SHA256
6e1fe06b7a0cfaf01179f56b46ae1e67a0230f9605fea30515bd8c91185b8452

SHA512
a73920ce682a3a3d779218b86e6c4be0273ef06194f03de4c5464884a9aa616471d0bf13aaf96e3671c09baf5137272061719e8f1c20b85f88444111c3806386

Download Submit
memory/2276-26-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2276-46-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2276-28-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2276-47-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2276-45-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2276-44-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2276-24-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2276-14-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2276-16-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2276-34-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2276-33-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2276-32-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2276-31-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2276-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2276-48-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2276-43-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2276-42-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2276-22-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2276-20-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2276-18-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2276-41-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2276-36-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2276-37-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2276-38-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2480-35-0x0000000074C60000-0x000000007534E000-memory.dmp

Filesize
6.9MB

Download
memory/2480-1-0x0000000000E40000-0x0000000000F38000-memory.dmp

Filesize
992KB

Download
memory/2480-2-0x0000000074C60000-0x000000007534E000-memory.dmp

Filesize
6.9MB

Download
memory/2480-6-0x000000000D700000-0x000000000D7BE000-memory.dmp

Filesize
760KB

Download
memory/2480-5-0x00000000003E0000-0x00000000003F0000-memory.dmp

Filesize
64KB

Download
memory/2480-0-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

Filesize
4KB

Download
memory/2480-4-0x00000000003A0000-0x00000000003AC000-memory.dmp

Filesize
48KB

Download
memory/2480-3-0x0000000000590000-0x00000000005B2000-memory.dmp

Filesize
136KB

Download

description	pid	process	target process
PID 2480 wrote to memory of 2640	2480	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe	powershell.exe
PID 2480 wrote to memory of 2640	2480	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe	powershell.exe
PID 2480 wrote to memory of 2640	2480	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe	powershell.exe
PID 2480 wrote to memory of 2640	2480	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe	powershell.exe
PID 2480 wrote to memory of 2708	2480	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe	schtasks.exe
PID 2480 wrote to memory of 2708	2480	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe	schtasks.exe
PID 2480 wrote to memory of 2708	2480	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe	schtasks.exe
PID 2480 wrote to memory of 2708	2480	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe	schtasks.exe
PID 2480 wrote to memory of 2276	2480	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe
PID 2480 wrote to memory of 2276	2480	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe
PID 2480 wrote to memory of 2276	2480	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe
PID 2480 wrote to memory of 2276	2480	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe
PID 2480 wrote to memory of 2276	2480	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe
PID 2480 wrote to memory of 2276	2480	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe
PID 2480 wrote to memory of 2276	2480	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe
PID 2480 wrote to memory of 2276	2480	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe
PID 2480 wrote to memory of 2276	2480	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe
PID 2480 wrote to memory of 2276	2480	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe
PID 2480 wrote to memory of 2276	2480	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe
PID 2480 wrote to memory of 2276	2480	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe
PID 2480 wrote to memory of 2276	2480	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe	47fef22842a3bd3769c9c78461cf85cc940167e58f96bccac4870e9acaae0159.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads