remcos | a5d707684f36df7d6046e10f9bd793090d5750716895c366ef7d407988a2bca7

General

Target

RFQ 1100-656-02.exe
Size

856KB
MD5

a27c4215869da7c1f2121c54ec27549b
SHA1

f370447ada466a0db44bbd930e8517f79c35f0ba
SHA256

358f8d58da6f43e4cdb17fecc2e1fbb6a6492ca681d7c48080fd432ae834aa9c
SHA512

4b0c74606e1bc5422e21af49cfc433f71084661f4fbb5624efb57f46bcfdd916e3681ece8b28c343787fb1613e6791bef6ffca2f7ce1b1f140aa1cde7fffa556
SSDEEP

24576:j/odxK26kNtue9MTdBfW3HJfREKSPZYhkngIlBUKDWA:GrtuHBBUHJaPZYh3y3WA

Score

10^/10

remcos ky mix collection evasion execution rat trojan

Malware Config

Extracted

Family

remcos

Botnet

KY MIX

C2

192.210.201.57:52499

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-M2GVTY
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1548.002

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

RFQ 1100-656-02.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RFQ 1100-656-02.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2860 powershell.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RFQ 1100-656-02.exe

pid	process
2860	powershell.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

wab.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

RFQ 1100-656-02.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RFQ 1100-656-02.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RFQ 1100-656-02.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

RFQ 1100-656-02.exewab.exe

description	pid	process	target process
PID 2512 set thread context of 1752	2512	RFQ 1100-656-02.exe	wab.exe
PID 1752 set thread context of 2880	1752	wab.exe	wab.exe
PID 1752 set thread context of 676	1752	wab.exe	wab.exe
PID 1752 set thread context of 484	1752	wab.exe	wab.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exewab.exe

pid process

2860 powershell.exe
2880 wab.exe
2880 wab.exe
Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

wab.exe

pid process

1752 wab.exe
1752 wab.exe
1752 wab.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exewab.exe

description pid process

Token: SeDebugPrivilege 2860 powershell.exe
Token: SeDebugPrivilege 484 wab.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

wab.exe

pid process

1752 wab.exe

pid	process
2860	powershell.exe
2880	wab.exe
2880	wab.exe

pid	process
1752	wab.exe
1752	wab.exe
1752	wab.exe

description	pid	process
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeDebugPrivilege	484	wab.exe

pid	process
1752	wab.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

RFQ 1100-656-02.exe

description	pid	process	target process
PID 2512 wrote to memory of 2860	2512	RFQ 1100-656-02.exe	powershell.exe
PID 2512 wrote to memory of 2860	2512	RFQ 1100-656-02.exe	powershell.exe
PID 2512 wrote to memory of 2860	2512	RFQ 1100-656-02.exe	powershell.exe
PID 2512 wrote to memory of 2536	2512	RFQ 1100-656-02.exe	ngen.exe
PID 2512 wrote to memory of 2536	2512	RFQ 1100-656-02.exe	ngen.exe
PID 2512 wrote to memory of 2536	2512	RFQ 1100-656-02.exe	ngen.exe
PID 2512 wrote to memory of 2536	2512	RFQ 1100-656-02.exe	ngen.exe
PID 2512 wrote to memory of 2536	2512	RFQ 1100-656-02.exe	ngen.exe
PID 2512 wrote to memory of 2536	2512	RFQ 1100-656-02.exe	ngen.exe
PID 2512 wrote to memory of 2536	2512	RFQ 1100-656-02.exe	ngen.exe
PID 2512 wrote to memory of 2536	2512	RFQ 1100-656-02.exe	ngen.exe
PID 2512 wrote to memory of 2536	2512	RFQ 1100-656-02.exe	ngen.exe
PID 2512 wrote to memory of 2536	2512	RFQ 1100-656-02.exe	ngen.exe
PID 2512 wrote to memory of 2536	2512	RFQ 1100-656-02.exe	ngen.exe
PID 2512 wrote to memory of 2536	2512	RFQ 1100-656-02.exe	ngen.exe
PID 2512 wrote to memory of 2556	2512	RFQ 1100-656-02.exe	svchost.exe
PID 2512 wrote to memory of 2556	2512	RFQ 1100-656-02.exe	svchost.exe
PID 2512 wrote to memory of 2556	2512	RFQ 1100-656-02.exe	svchost.exe
PID 2512 wrote to memory of 2556	2512	RFQ 1100-656-02.exe	svchost.exe
PID 2512 wrote to memory of 2556	2512	RFQ 1100-656-02.exe	svchost.exe
PID 2512 wrote to memory of 2556	2512	RFQ 1100-656-02.exe	svchost.exe
PID 2512 wrote to memory of 2556	2512	RFQ 1100-656-02.exe	svchost.exe
PID 2512 wrote to memory of 2556	2512	RFQ 1100-656-02.exe	svchost.exe
PID 2512 wrote to memory of 2556	2512	RFQ 1100-656-02.exe	svchost.exe
PID 2512 wrote to memory of 2556	2512	RFQ 1100-656-02.exe	svchost.exe
PID 2512 wrote to memory of 2556	2512	RFQ 1100-656-02.exe	svchost.exe
PID 2512 wrote to memory of 2568	2512	RFQ 1100-656-02.exe	csc.exe
PID 2512 wrote to memory of 2568	2512	RFQ 1100-656-02.exe	csc.exe
PID 2512 wrote to memory of 2568	2512	RFQ 1100-656-02.exe	csc.exe
PID 2512 wrote to memory of 2568	2512	RFQ 1100-656-02.exe	csc.exe
PID 2512 wrote to memory of 2568	2512	RFQ 1100-656-02.exe	csc.exe
PID 2512 wrote to memory of 2568	2512	RFQ 1100-656-02.exe	csc.exe
PID 2512 wrote to memory of 2568	2512	RFQ 1100-656-02.exe	csc.exe
PID 2512 wrote to memory of 2568	2512	RFQ 1100-656-02.exe	csc.exe
PID 2512 wrote to memory of 2568	2512	RFQ 1100-656-02.exe	csc.exe
PID 2512 wrote to memory of 2568	2512	RFQ 1100-656-02.exe	csc.exe
PID 2512 wrote to memory of 2568	2512	RFQ 1100-656-02.exe	csc.exe
PID 2512 wrote to memory of 2568	2512	RFQ 1100-656-02.exe	csc.exe
PID 2512 wrote to memory of 2480	2512	RFQ 1100-656-02.exe	calc.exe
PID 2512 wrote to memory of 2480	2512	RFQ 1100-656-02.exe	calc.exe
PID 2512 wrote to memory of 2480	2512	RFQ 1100-656-02.exe	calc.exe
PID 2512 wrote to memory of 2480	2512	RFQ 1100-656-02.exe	calc.exe
PID 2512 wrote to memory of 2480	2512	RFQ 1100-656-02.exe	calc.exe
PID 2512 wrote to memory of 2480	2512	RFQ 1100-656-02.exe	calc.exe
PID 2512 wrote to memory of 2480	2512	RFQ 1100-656-02.exe	calc.exe
PID 2512 wrote to memory of 2480	2512	RFQ 1100-656-02.exe	calc.exe
PID 2512 wrote to memory of 2480	2512	RFQ 1100-656-02.exe	calc.exe
PID 2512 wrote to memory of 2480	2512	RFQ 1100-656-02.exe	calc.exe
PID 2512 wrote to memory of 2480	2512	RFQ 1100-656-02.exe	calc.exe
PID 2512 wrote to memory of 1896	2512	RFQ 1100-656-02.exe	ilasm.exe
PID 2512 wrote to memory of 1896	2512	RFQ 1100-656-02.exe	ilasm.exe
PID 2512 wrote to memory of 1896	2512	RFQ 1100-656-02.exe	ilasm.exe
PID 2512 wrote to memory of 1896	2512	RFQ 1100-656-02.exe	ilasm.exe
PID 2512 wrote to memory of 2288	2512	RFQ 1100-656-02.exe	cmd.exe
PID 2512 wrote to memory of 2288	2512	RFQ 1100-656-02.exe	cmd.exe
PID 2512 wrote to memory of 2288	2512	RFQ 1100-656-02.exe	cmd.exe
PID 2512 wrote to memory of 2288	2512	RFQ 1100-656-02.exe	cmd.exe
PID 2512 wrote to memory of 2288	2512	RFQ 1100-656-02.exe	cmd.exe
PID 2512 wrote to memory of 2288	2512	RFQ 1100-656-02.exe	cmd.exe
PID 2512 wrote to memory of 2288	2512	RFQ 1100-656-02.exe	cmd.exe
PID 2512 wrote to memory of 2288	2512	RFQ 1100-656-02.exe	cmd.exe
PID 2512 wrote to memory of 2288	2512	RFQ 1100-656-02.exe	cmd.exe
PID 2512 wrote to memory of 2288	2512	RFQ 1100-656-02.exe	cmd.exe
PID 2512 wrote to memory of 2288	2512	RFQ 1100-656-02.exe	cmd.exe

System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

RFQ 1100-656-02.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RFQ 1100-656-02.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RFQ 1100-656-02.exe

C:\Users\Admin\AppData\Local\Temp\RFQ 1100-656-02.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ 1100-656-02.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2512

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RFQ 1100-656-02.exe" -Force
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2860

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
2⤵
PID:2536

C:\Windows\System32\svchost.exe
"C:\Windows\System32\svchost.exe"
2⤵
PID:2556

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
2⤵
PID:2568

C:\Windows\System32\calc.exe
"C:\Windows\System32\calc.exe"
2⤵
PID:2480

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
2⤵
PID:1896

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
2⤵
PID:2288

C:\Windows\System32\notepad.exe
"C:\Windows\System32\notepad.exe"
2⤵
PID:1204

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
2⤵
PID:2212

C:\Program Files (x86)\Windows Mail\wab.exe
"C:\Program Files (x86)\Windows Mail\wab.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:1752

C:\Program Files (x86)\Windows Mail\wab.exe
"C:\Program Files (x86)\Windows Mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\xbuthfkekjeoidhdxdiq"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2880

C:\Program Files (x86)\Windows Mail\wab.exe
"C:\Program Files (x86)\Windows Mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\idamixvgyrwtkrvhoovrgdj"
3⤵
- Accesses Microsoft Outlook accounts
PID:676

C:\Program Files (x86)\Windows Mail\wab.exe
"C:\Program Files (x86)\Windows Mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\kxnwjqgamaoguxrlxzqlrqvtkg"
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:484

C:\Program Files (x86)\Windows Mail\wab.exe
"C:\Program Files (x86)\Windows Mail\wab.exe"
2⤵
PID:1624

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat
Filesize
144B

MD5
b4d35c2eeab701cc661fad92232def4e

SHA1
4153d625e4582f13671c4893c64ee35d506ac679

SHA256
d4e6dcbd2f59a5bf3e733d64bdbcc1b1b1b66f282f763ab2eb28af04fbfebc65

SHA512
6f134dbcd5ed741d729e6285d557c1f9d9b55575c2429a6adbc82bc667587db454d49f4fec927e2f81f7b343385365896aea1540390bb90307200bc20a8aeb69

Download Submit
C:\Users\Admin\AppData\Local\Temp\xbuthfkekjeoidhdxdiq
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/2512-0-0x000007FEF5EE3000-0x000007FEF5EE4000-memory.dmp

Filesize
4KB

Download
memory/2512-1-0x0000000001180000-0x000000000118C000-memory.dmp

Filesize
48KB

Download
memory/2512-2-0x000007FEF5EE0000-0x000007FEF68CC000-memory.dmp

Filesize
9.9MB

Download
memory/2512-3-0x00000000003A0000-0x00000000003A6000-memory.dmp

Filesize
24KB

Download
memory/2512-4-0x0000000000A30000-0x0000000000B02000-memory.dmp

Filesize
840KB

Download
memory/2512-148-0x000007FEF5EE0000-0x000007FEF68CC000-memory.dmp

Filesize
9.9MB

Download
memory/2536-24-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2536-26-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2536-20-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2536-18-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2536-16-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2536-14-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2536-22-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2536-12-0x0000000000400000-0x0000000000482000-memory.dmp

Filesize
520KB

Download
memory/2860-11-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download
memory/2860-10-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/2860-9-0x0000000002F30000-0x0000000002FB0000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads