remcos | 18e9a22ee167304fab2f07f7423b88e12953c8aaa0a28e7fd3e75e48a67188b4

General

Target

0c3a8cefb4da3f02bffad97bde2b6a10_NeikiAnalytics.exe
Size

1.4MB
MD5

0c3a8cefb4da3f02bffad97bde2b6a10
SHA1

2101a88c17f0b55ec69328b93d646db12b3b21d3
SHA256

18e9a22ee167304fab2f07f7423b88e12953c8aaa0a28e7fd3e75e48a67188b4
SHA512

8237757dbeed34807c1cf454b2b5d58b4517c7025e67305407b3e59701f787187df4dec2b5a70788ae4c17402551633724a2d89b05ea529227c0d7320b97bdde
SSDEEP

24576:FD39v74lfGQrFUspugRNJI2DJ53J/J/L5dJPjoA:Fp7E+QrFUBgq2N

Score

10^/10

remcos host persistence rat spyware stealer

Malware Config

Extracted

Family

remcos

Version

1.7 Pro

Botnet

Host

C2

213.183.58.19:4000

Attributes

audio_folder
audio
audio_path
%AppData%
audio_record_time
5
connect_delay
0
connect_interval
5
copy_file
remcos.exe
copy_folder
remcos
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
false
install_path
%AppData%
keylog_crypt
true
keylog_file
read.dat
keylog_flag
false
keylog_folder
CastC
keylog_path
%AppData%
mouse_option
false
mutex
remcos_sccafsoidz
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screens
screenshot_path
%AppData%
screenshot_time
1
startup_value
remcos
take_screenshot_option
false
take_screenshot_time
5

Signatures

Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Executes dropped EXE 2 IoCs

Processes:

sbietrcl.exesbietrcl.exe

pid process

2816 sbietrcl.exe
2764 sbietrcl.exe
Loads dropped DLL 2 IoCs

Processes:

0c3a8cefb4da3f02bffad97bde2b6a10_NeikiAnalytics.exesbietrcl.exe

pid process

2316 0c3a8cefb4da3f02bffad97bde2b6a10_NeikiAnalytics.exe
2816 sbietrcl.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2816	sbietrcl.exe
2764	sbietrcl.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

0c3a8cefb4da3f02bffad97bde2b6a10_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\sbietrcl.exe"	0c3a8cefb4da3f02bffad97bde2b6a10_NeikiAnalytics.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

sbietrcl.exe

description pid process target process

PID 2816 set thread context of 2764 2816 sbietrcl.exe sbietrcl.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 2816 set thread context of 2764	2816	sbietrcl.exe	sbietrcl.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

0c3a8cefb4da3f02bffad97bde2b6a10_NeikiAnalytics.exesbietrcl.exe

pid	process
2316	0c3a8cefb4da3f02bffad97bde2b6a10_NeikiAnalytics.exe
2316	0c3a8cefb4da3f02bffad97bde2b6a10_NeikiAnalytics.exe
2316	0c3a8cefb4da3f02bffad97bde2b6a10_NeikiAnalytics.exe
2316	0c3a8cefb4da3f02bffad97bde2b6a10_NeikiAnalytics.exe
2316	0c3a8cefb4da3f02bffad97bde2b6a10_NeikiAnalytics.exe
2316	0c3a8cefb4da3f02bffad97bde2b6a10_NeikiAnalytics.exe
2816	sbietrcl.exe
2816	sbietrcl.exe
2816	sbietrcl.exe
2816	sbietrcl.exe
2816	sbietrcl.exe
2816	sbietrcl.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

0c3a8cefb4da3f02bffad97bde2b6a10_NeikiAnalytics.exesbietrcl.exe

description pid process

Token: SeDebugPrivilege 2316 0c3a8cefb4da3f02bffad97bde2b6a10_NeikiAnalytics.exe
Token: SeDebugPrivilege 2816 sbietrcl.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

sbietrcl.exe

pid process

2764 sbietrcl.exe

description	pid	process
Token: SeDebugPrivilege	2316	0c3a8cefb4da3f02bffad97bde2b6a10_NeikiAnalytics.exe
Token: SeDebugPrivilege	2816	sbietrcl.exe

pid	process
2764	sbietrcl.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

0c3a8cefb4da3f02bffad97bde2b6a10_NeikiAnalytics.exesbietrcl.exe

description	pid	process	target process
PID 2316 wrote to memory of 2816	2316	0c3a8cefb4da3f02bffad97bde2b6a10_NeikiAnalytics.exe	sbietrcl.exe
PID 2316 wrote to memory of 2816	2316	0c3a8cefb4da3f02bffad97bde2b6a10_NeikiAnalytics.exe	sbietrcl.exe
PID 2316 wrote to memory of 2816	2316	0c3a8cefb4da3f02bffad97bde2b6a10_NeikiAnalytics.exe	sbietrcl.exe
PID 2316 wrote to memory of 2816	2316	0c3a8cefb4da3f02bffad97bde2b6a10_NeikiAnalytics.exe	sbietrcl.exe
PID 2816 wrote to memory of 2764	2816	sbietrcl.exe	sbietrcl.exe
PID 2816 wrote to memory of 2764	2816	sbietrcl.exe	sbietrcl.exe
PID 2816 wrote to memory of 2764	2816	sbietrcl.exe	sbietrcl.exe
PID 2816 wrote to memory of 2764	2816	sbietrcl.exe	sbietrcl.exe
PID 2816 wrote to memory of 2764	2816	sbietrcl.exe	sbietrcl.exe
PID 2816 wrote to memory of 2764	2816	sbietrcl.exe	sbietrcl.exe
PID 2816 wrote to memory of 2764	2816	sbietrcl.exe	sbietrcl.exe
PID 2816 wrote to memory of 2764	2816	sbietrcl.exe	sbietrcl.exe
PID 2816 wrote to memory of 2764	2816	sbietrcl.exe	sbietrcl.exe
PID 2816 wrote to memory of 2764	2816	sbietrcl.exe	sbietrcl.exe

C:\Users\Admin\AppData\Local\Temp\0c3a8cefb4da3f02bffad97bde2b6a10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0c3a8cefb4da3f02bffad97bde2b6a10_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2816

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2764

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
51071f630ac34f0d426a4b3f23f60561

SHA1
11442cf955249301e04413ed6965bd5d4871fa19

SHA256
29d50cea313f4d5cf9013516c9e02faf246151b0315085ae773acb8d68391bb1

SHA512
ddc6848f51aa75a7d5135584ad2c5e733fe5128b113208dac3c65e5a61cd5f8b66140ccea12404566fc4c7f9f5c86d5bc3ece7182e7a6acf40a72835b0143d78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3E48.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\sbietrcl.exe
Filesize
1.4MB

MD5
d6e70c0ec80e6e82465fbc52aad1485c

SHA1
602ca7c7b7087a78264a27259a75ae2142cf01ce

SHA256
d32099983ff3d059877120302f4141f87ddaeb47086c6d390ef4718024b354fe

SHA512
c3bd9d902c33acf9cc3ffa2267b73888b4ed2f78efad00613b39c7d3674b6bbd7575040c59379e2550192572ad6aeafd9c59de15712b3cb5d53449cd27b0b179

Download Submit
memory/2316-1-0x00000000741C0000-0x000000007476B000-memory.dmp

Filesize
5.7MB

Download
memory/2316-13-0x00000000741C0000-0x000000007476B000-memory.dmp

Filesize
5.7MB

Download
memory/2316-12-0x00000000741C0000-0x000000007476B000-memory.dmp

Filesize
5.7MB

Download
memory/2316-0-0x00000000741C1000-0x00000000741C2000-memory.dmp

Filesize
4KB

Download
memory/2316-30-0x00000000741C0000-0x000000007476B000-memory.dmp

Filesize
5.7MB

Download
memory/2316-2-0x00000000741C0000-0x000000007476B000-memory.dmp

Filesize
5.7MB

Download
memory/2764-67-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2764-70-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2764-62-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2764-61-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2764-45-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2764-51-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2764-57-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2764-55-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2764-53-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2764-49-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2764-47-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2764-66-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2764-65-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2816-32-0x00000000741C0000-0x000000007476B000-memory.dmp

Filesize
5.7MB

Download
memory/2816-42-0x00000000741C0000-0x000000007476B000-memory.dmp

Filesize
5.7MB

Download
memory/2816-60-0x00000000741C0000-0x000000007476B000-memory.dmp

Filesize
5.7MB

Download
memory/2816-43-0x00000000741C0000-0x000000007476B000-memory.dmp

Filesize
5.7MB

Download
memory/2816-34-0x00000000741C0000-0x000000007476B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads